747091fd60a9c41ff26d3878bac923c9c14b5472238874754577e14d47b8cba7

Resubmissions

27-11-2024 08:55

241127-kvn92stkar 10

27-11-2024 05:48

241127-ghggwszqes 10

Analysis

max time kernel
0s
max time network
132s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
27-11-2024 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
Size

1020KB
MD5

42693670c71a529a11e81943f5b36c5b
SHA1

9026cc25786215bba3bc06c4875f7da410425f8c
SHA256

eb2329422e52901d0bea0c0fcc4b3a6d1923ef278a96d2a14ab1839882cd0ecf
SHA512

a92d9bd9cd4c1c81a2e8042a9b7c31badba5e033743f34fb851b60350c5833afb246c64fc982112afecad9b1fc48bfdeab16a7bda169b4a635a8922549067d82
SSDEEP

12288:ztLJzlNZDaY9FnavUIqEhgvmKe36myOP7/67LN5kwrHNq9EnE:zvxNZD7FnavUILhgvJeb/67LFLNq9

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

pidof

description	ioc	Process
File opened for reading	/proc/49/cmdline	pidof
File opened for reading	/proc/1803/cmdline	pidof
File opened for reading	/proc/1952/cmdline	pidof
File opened for reading	/proc/2129/stat	pidof
File opened for reading	/proc/2476/cmdline	pidof
File opened for reading	/proc/2326/cmdline	pidof
File opened for reading	/proc/2473/stat	pidof
File opened for reading	/proc/3/stat	pidof
File opened for reading	/proc/38/cmdline	pidof
File opened for reading	/proc/43/cmdline	pidof
File opened for reading	/proc/1911/cmdline	pidof
File opened for reading	/proc/2191/cmdline	pidof
File opened for reading	/proc/2/stat	pidof
File opened for reading	/proc/194/stat	pidof
File opened for reading	/proc/1116/stat	pidof
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/191/cmdline	pidof
File opened for reading	/proc/1044/cmdline	pidof
File opened for reading	/proc/1957/cmdline	pidof
File opened for reading	/proc/21/cmdline	pidof
File opened for reading	/proc/191/stat	pidof
File opened for reading	/proc/1392/cmdline	pidof
File opened for reading	/proc/2283/stat	pidof
File opened for reading	/proc/2475/cmdline	pidof
File opened for reading	/proc/12/cmdline	pidof
File opened for reading	/proc/18/stat	pidof
File opened for reading	/proc/31/stat	pidof
File opened for reading	/proc/202/cmdline	pidof
File opened for reading	/proc/1703/cmdline	pidof
File opened for reading	/proc/55/stat	pidof
File opened for reading	/proc/787/cmdline	pidof
File opened for reading	/proc/8/cmdline	pidof
File opened for reading	/proc/22/cmdline	pidof
File opened for reading	/proc/36/cmdline	pidof
File opened for reading	/proc/49/stat	pidof
File opened for reading	/proc/52/stat	pidof
File opened for reading	/proc/1693/cmdline	pidof
File opened for reading	/proc/1770/stat	pidof
File opened for reading	/proc/1911/stat	pidof
File opened for reading	/proc/17/stat	pidof
File opened for reading	/proc/32/stat	pidof
File opened for reading	/proc/357/stat	pidof
File opened for reading	/proc/1246/stat	pidof
File opened for reading	/proc/1331/cmdline	pidof
File opened for reading	/proc/1935/stat	pidof
File opened for reading	/proc/2227/stat	pidof
File opened for reading	/proc/2303/cmdline	pidof
File opened for reading	/proc/2265/stat	pidof
File opened for reading	/proc/6/stat	pidof
File opened for reading	/proc/386/stat	pidof
File opened for reading	/proc/1057/cmdline	pidof
File opened for reading	/proc/1794/cmdline	pidof
File opened for reading	/proc/1990/cmdline	pidof
File opened for reading	/proc/765/cmdline	pidof
File opened for reading	/proc/772/stat	pidof
File opened for reading	/proc/1964/cmdline	pidof
File opened for reading	/proc/1/stat	pidof
File opened for reading	/proc/39/stat	pidof
File opened for reading	/proc/51/stat	pidof
File opened for reading	/proc/63/stat	pidof
File opened for reading	/proc/601/stat	pidof
File opened for reading	/proc/1985/stat	pidof
File opened for reading	/proc/2013/cmdline	pidof
File opened for reading	/proc/195/cmdline	pidof

/tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
/tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
1⤵
PID:2476

/bin/bash
/tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B -c "exec '/tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B' \"\$@\"" /tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
1⤵
PID:2476

/tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
/tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
1⤵
PID:2476

/bin/bash
/tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B -c " #!/bin/bash if [[ \$(cat config.json | grep xxcountxx) ]]; then echo \"configuring miner\" sed -i \"s/xxcountxx/\$(nproc)/g\" config.json else echo \"using preconfigured miner\" fi PID=\$(pidof xrx) if [ \$# -eq 0 ]; then ##if no arguments if [ -z \"\${PID}\" ]; then ./xrx </dev/null &>/dev/null & disown -h %1 echo \"miner online\" else echo \"miner already online\" fi fi " /tmp/样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
1⤵
PID:2476
- /usr/bin/cat
  cat config.json
  2⤵
  PID:2479
- /usr/bin/grep
  grep xxcountxx
  2⤵
  PID:2480
- /usr/bin/pidof
  pidof xrx
  2⤵
  - Reads runtime system information
  PID:2481
- /tmp/样本/Linux/shc加密脚本/xrx
  ./xrx
  2⤵
  PID:2482

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads