Analysis
-
max time kernel
4s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
-
submitted
21-11-2024 07:38
General
-
Target
a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh
-
Size
24KB
-
MD5
583c626e8ba30e2c920358b3b1c28519
-
SHA1
3b96052208c8a976ddc930a91ed7d507f31bc868
-
SHA256
a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51
-
SHA512
fd4b8f91a161f3086290e92a2f9502f7005bd83e00535f3376c2827b20ec40754b31250908242311f7f756644a25262794c80b898533dea698e86611274b7fbd
-
SSDEEP
768:32xRI1YH38QoMfzBIef2Wcu/J5L/J5+15BKll:0IXWcmjAmz
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 3 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 3 IoCs
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
-
Software Deployment Tools 1 TTPs 3 IoCs
Use software deployment tools to execute code.
Processes
-
/tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh/tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh1⤵
-
/usr/local/sbin/bashbash /tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh1⤵
-
/usr/local/bin/bashbash /tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh1⤵
-
/usr/sbin/bashbash /tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh1⤵
-
/usr/bin/bashbash /tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh1⤵
-
/sbin/bashbash /tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh1⤵
-
/bin/bashbash /tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh1⤵
-
/usr/bin/basenamebasename /tmp/a86b877e9e694a1f2b70a3a193fe135b751d78fa1ad4a795f11cbc34d4b78a51.sh2⤵
-
-
/usr/bin/teetee /tmp/l2tp.log2⤵
- Writes file to tmp directory
-
-
/usr/bin/clearclear2⤵
-
-
/bin/grepgrep "SELINUX=enforcing" /etc/selinux/config2⤵
-
-
/bin/grepgrep -Eqi debian2⤵
-
-
/bin/catcat /etc/issue2⤵
-
-
/bin/grepgrep -Eqi ubuntu2⤵
-
-
/bin/catcat /etc/issue2⤵
-
-
/usr/bin/headhead -n 12⤵
-
-
/bin/egrepegrep -v "^192\\.168|^172\\.1[6-9]\\.|^172\\.2[0-9]\\.|^172\\.3[0-2]\\.|^10\\.|^127\\.|^255\\.|^0\\."2⤵
-
-
/bin/egrepegrep -o "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"2⤵
-
-
/bin/grepgrep -E -v "^192\\.168|^172\\.1[6-9]\\.|^172\\.2[0-9]\\.|^172\\.3[0-2]\\.|^10\\.|^127\\.|^255\\.|^0\\."2⤵
-
-
/bin/grepgrep -E -o "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"2⤵
-
-
/bin/ipip addr2⤵
- System Network Configuration Discovery
-
-
/usr/bin/wgetwget -qO- -t1 -T2 ipv4.icanhazip.com2⤵
- System Network Configuration Discovery
-
-
/bin/sedsed "s/^[ \\t]*//;s/[ \\t]*\$//"2⤵
-
-
/usr/bin/awkawk -F: "/model name/ {name=\$2} END {print name}" /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/usr/bin/awkawk -F: "/model name/ {core++} END {print core}" /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/bin/sedsed "s/^[ \\t]*//;s/[ \\t]*\$//"2⤵
-
-
/usr/bin/awkawk -F: "/cpu MHz/ {freq=\$2} END {print freq}" /proc/cpuinfo2⤵
- Checks CPU configuration
-
-
/usr/bin/awkawk "/Mem/ {print \$2}"2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "/Swap/ {print \$2}"2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{a=\$1/86400;b=(\$1%86400)/3600;c=(\$1%3600)/60;d=\$1%60} {printf(\"%ddays, %d:%d:%d\\n\",a,b,c,d)}" /proc/uptime2⤵
-
-
/bin/sedsed "s/^[ \\t]*//;s/[ \\t]*\$//"2⤵
-
-
/usr/bin/awkawk "-Fload average:" "{print \$2}"2⤵
-
-
/usr/bin/headhead -12⤵
-
-
/usr/bin/ww2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "-F[= \"]" "/PRETTY_NAME/{print \$3,\$4,\$5}" /etc/os-release2⤵
- Reads runtime system information
-
-
/bin/unameuname -m2⤵
-
-
/usr/bin/getconfgetconf LONG_BIT2⤵
-
-
/bin/hostnamehostname2⤵
-
-
/bin/unameuname -r2⤵
-
-
/bin/sttystty -g2⤵
-
-
/bin/sttystty -echo2⤵
-
-
/bin/sttystty cbreak2⤵
-
-
/bin/dddd "if=/dev/tty" "bs=1" "count=1"2⤵
-
-
/bin/sttystty -raw2⤵
-
-
/bin/sttystty echo2⤵
-
-
/bin/sttystty2⤵
-
-
/bin/mknodmknod /dev/random c 1 92⤵
-
-
/bin/grepgrep -Eqi debian2⤵
-
-
/bin/catcat /etc/issue2⤵
-
-
/bin/grepgrep -Eqi ubuntu2⤵
-
-
/bin/catcat /etc/issue2⤵
-
-
/usr/bin/apt-getapt-get -y update2⤵
- Writes file to tmp directory
- Software Deployment Tools
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
/usr/lib/apt/methods/https/usr/lib/apt/methods/https3⤵
-
-
/bin/shsh -c "[ ! -e /run/systemd/system ] || [ \$(id -u) -ne 0 ] || systemctl start --no-block apt-news.service esm-cache.service || true"3⤵
-
/usr/bin/idid -u4⤵
-
-
/bin/systemctlsystemctl start --no-block apt-news.service esm-cache.service4⤵
- Reads runtime system information
-
-
-
/usr/lib/apt/methods/https/usr/lib/apt/methods/https3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
-
/bin/grepgrep -Eqi debian2⤵
-
-
/bin/catcat /etc/issue2⤵
-
-
/bin/grepgrep -Eqi ubuntu2⤵
-
-
/bin/catcat /etc/issue2⤵
-
-
/usr/bin/apt-getapt-get -y install wget gcc ppp flex bison make python libnss3-dev libnss3-tools libselinux-dev iptables libnspr4-dev pkg-config libpam0g-dev libcap-ng-dev libcap-ng-utils libunbound-dev libevent-dev libcurl4-nss-dev libsystemd-dev2⤵
- Writes file to tmp directory
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
-
/usr/bin/apt-getapt-get -y --no-install-recommends install xmlto2⤵
- Writes file to tmp directory
- Software Deployment Tools
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
- Reads runtime system information
-
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
-
/usr/bin/apt-getapt-get -y install xl2tpd2⤵
- Writes file to tmp directory
- Software Deployment Tools
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵
-
-
-
/bin/rmrm -rf /tmp/l2tp2⤵
-
-
/bin/mkdirmkdir -p /tmp/l2tp2⤵
-
-
/usr/bin/wgetwget -c -t3 -T60 https://dl.lamp.sh/files/libreswan-3.27.tar.gz2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
235KB
MD5373fe2f2ef99005d2550a482f09a3e51
SHA168e6572b55b1e77f7d171ebac7b2579b7a6bd51d
SHA2567552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5
SHA512def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b
-
Filesize
4KB
MD5e32af2c5f3725e422ba815255642f599
SHA13607977a023a2740608caa53105783954ff4e2ff
SHA256cf119da5393f59c30f2448299e6820ee75a4d5f6c420d59100dac620a393ada9
SHA512da0145de9299564d7965f57aa65e9d203bbe2e41ca4ee0eeaa18a790d0655b0a1c311d341e91d6bfe6deee4d8c339e7769923416f2e8e613cb858f426cf7e69c