747091fd60a9c41ff26d3878bac923c9c14b5472238874754577e14d47b8cba7

Resubmissions

27-11-2024 08:55

241127-kvn92stkar 10

27-11-2024 05:48

241127-ghggwszqes 10

Analysis

max time kernel
0s
max time network
180s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
27-11-2024 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xrx/init.sh
Size

1020KB
MD5

42693670c71a529a11e81943f5b36c5b
SHA1

9026cc25786215bba3bc06c4875f7da410425f8c
SHA256

eb2329422e52901d0bea0c0fcc4b3a6d1923ef278a96d2a14ab1839882cd0ecf
SHA512

a92d9bd9cd4c1c81a2e8042a9b7c31badba5e033743f34fb851b60350c5833afb246c64fc982112afecad9b1fc48bfdeab16a7bda169b4a635a8922549067d82
SSDEEP

12288:ztLJzlNZDaY9FnavUIqEhgvmKe36myOP7/67LN5kwrHNq9EnE:zvxNZD7FnavUILhgvJeb/67LFLNq9

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

pidof

description	ioc	Process
File opened for reading	/proc/13/stat	pidof
File opened for reading	/proc/105/cmdline	pidof
File opened for reading	/proc/617/cmdline	pidof
File opened for reading	/proc/633/stat	pidof
File opened for reading	/proc/922/cmdline	pidof
File opened for reading	/proc/1088/cmdline	pidof
File opened for reading	/proc/1110/cmdline	pidof
File opened for reading	/proc/1145/stat	pidof
File opened for reading	/proc/1338/cmdline	pidof
File opened for reading	/proc/6/cmdline	pidof
File opened for reading	/proc/167/cmdline	pidof
File opened for reading	/proc/452/cmdline	pidof
File opened for reading	/proc/453/cmdline	pidof
File opened for reading	/proc/519/stat	pidof
File opened for reading	/proc/537/cmdline	pidof
File opened for reading	/proc/579/cmdline	pidof
File opened for reading	/proc/1001/stat	pidof
File opened for reading	/proc/1094/cmdline	pidof
File opened for reading	/proc/1206/cmdline	pidof
File opened for reading	/proc/1361/cmdline	pidof
File opened for reading	/proc/1397/stat	pidof
File opened for reading	/proc/85/stat	pidof
File opened for reading	/proc/140/cmdline	pidof
File opened for reading	/proc/990/stat	pidof
File opened for reading	/proc/1103/cmdline	pidof
File opened for reading	/proc/75/cmdline	pidof
File opened for reading	/proc/454/cmdline	pidof
File opened for reading	/proc/498/cmdline	pidof
File opened for reading	/proc/575/cmdline	pidof
File opened for reading	/proc/668/stat	pidof
File opened for reading	/proc/1001/cmdline	pidof
File opened for reading	/proc/1079/cmdline	pidof
File opened for reading	/proc/1312/stat	pidof
File opened for reading	/proc/1347/cmdline	pidof
File opened for reading	/proc/162/stat	pidof
File opened for reading	/proc/673/cmdline	pidof
File opened for reading	/proc/1347/stat	pidof
File opened for reading	/proc/23/stat	pidof
File opened for reading	/proc/200/stat	pidof
File opened for reading	/proc/454/stat	pidof
File opened for reading	/proc/1340/stat	pidof
File opened for reading	/proc/1346/cmdline	pidof
File opened for reading	/proc/1361/stat	pidof
File opened for reading	/proc/1065/cmdline	pidof
File opened for reading	/proc/1404/stat	pidof
File opened for reading	/proc/3/cmdline	pidof
File opened for reading	/proc/13/cmdline	pidof
File opened for reading	/proc/79/cmdline	pidof
File opened for reading	/proc/270/stat	pidof
File opened for reading	/proc/694/stat	pidof
File opened for reading	/proc/803/cmdline	pidof
File opened for reading	/proc/858/cmdline	pidof
File opened for reading	/proc/71/cmdline	pidof
File opened for reading	/proc/441/cmdline	pidof
File opened for reading	/proc/632/stat	pidof
File opened for reading	/proc/668/cmdline	pidof
File opened for reading	/proc/779/stat	pidof
File opened for reading	/proc/5/stat	pidof
File opened for reading	/proc/11/stat	pidof
File opened for reading	/proc/242/cmdline	pidof
File opened for reading	/proc/615/cmdline	pidof
File opened for reading	/proc/22/stat	pidof
File opened for reading	/proc/168/cmdline	pidof
File opened for reading	/proc/171/cmdline	pidof

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

Processes:

init.shbashinit.shbash

pid	Process
1400	init.sh
1400	bash
1400	init.sh
1400	bash

/tmp/xrx/init.sh
/tmp/xrx/init.sh strace -f -e "trace=execve" -o trace_output.txt bash script.sh
1⤵
- System Network Configuration Discovery
PID:1400

/bin/bash
/tmp/xrx/init.sh -c "exec '/tmp/xrx/init.sh' \"\$@\"" /tmp/xrx/init.sh strace -f -e "trace=execve" -o trace_output.txt bash script.sh
1⤵
- System Network Configuration Discovery
PID:1400

/tmp/xrx/init.sh
/tmp/xrx/init.sh strace -f -e "trace=execve" -o trace_output.txt bash script.sh
1⤵
- System Network Configuration Discovery
PID:1400

/bin/bash
/tmp/xrx/init.sh -c " #!/bin/bash if [[ \$(cat config.json | grep xxcountxx) ]]; then echo \"configuring miner\" sed -i \"s/xxcountxx/\$(nproc)/g\" config.json else echo \"using preconfigured miner\" fi PID=\$(pidof xrx) if [ \$# -eq 0 ]; then ##if no arguments if [ -z \"\${PID}\" ]; then ./xrx </dev/null &>/dev/null & disown -h %1 echo \"miner online\" else echo \"miner already online\" fi fi " /tmp/xrx/init.sh strace -f -e "trace=execve" -o trace_output.txt bash script.sh
1⤵
- System Network Configuration Discovery
PID:1400
- /usr/bin/grep
  grep xxcountxx
  2⤵
  PID:1403
- /usr/bin/cat
  cat config.json
  2⤵
  PID:1402
- /usr/bin/pidof
  pidof xrx
  2⤵
  - Reads runtime system information
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads