Overview

overview

10

Static

static

10

PoshC2-mas...ker.sh

ubuntu-18.04-amd64

6

PoshC2-mas...ker.sh

debian-9-armhf

6

PoshC2-mas...ker.sh

debian-9-mips

7

PoshC2-mas...ker.sh

debian-9-mipsel

7

PoshC2-mas...all.sh

ubuntu-18.04-amd64

7

PoshC2-mas...all.sh

debian-9-armhf

4

PoshC2-mas...all.sh

debian-9-mips

3

PoshC2-mas...all.sh

debian-9-mipsel

7

PoshC2-mas...ter.py

ubuntu-18.04-amd64

3

PoshC2-mas...ter.py

debian-9-armhf

3

PoshC2-mas...ter.py

debian-9-mips

3

PoshC2-mas...ter.py

debian-9-mipsel

3

PoshC2-mas...ils.py

windows7-x64

3

PoshC2-mas...ils.py

windows10-2004-x64

3

PoshC2-mas...t__.py

windows7-x64

3

PoshC2-mas...t__.py

windows10-2004-x64

3

PoshC2-mas...ias.py

windows7-x64

3

PoshC2-mas...ias.py

windows10-2004-x64

3

PoshC2-mas...sec.py

windows7-x64

3

PoshC2-mas...sec.py

windows10-2004-x64

3

PoshC2-mas...t__.py

ubuntu-18.04-amd64

3

PoshC2-mas...t__.py

debian-9-armhf

3

PoshC2-mas...t__.py

debian-9-mips

3

PoshC2-mas...t__.py

debian-9-mipsel

3

PoshC2-mas...tor.py

windows7-x64

3

PoshC2-mas...tor.py

windows10-2004-x64

3

PoshC2-mas...ter.py

windows7-x64

3

PoshC2-mas...ter.py

windows10-2004-x64

3

PoshC2-mas...ons.py

windows7-x64

3

PoshC2-mas...ons.py

windows10-2004-x64

3

PoshC2-mas...ags.py

windows7-x64

3

PoshC2-mas...ags.py

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    02-12-2024 18:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PoshC2-master/Install-for-Docker.sh

  • Size

    6KB

  • MD5

    e9491135cfba0744d0914440a3abea51

  • SHA1

    01d1eeaec2d63dfcff7b2d8f0b905666648284d7

  • SHA256

    df058ab09ac2a11282ae0dab69a48dbfb9be73a1abb0c9820be7281b4c78c84f

  • SHA512

    0821f0eec3e59e94e80ba372d7e159dd6a4c513b200c1b59e34bac6282a5e808a5f0b3ccc2c970a0ba6c3df72fa7e34f75aab451594035dfa20c8b777d449334

  • SSDEEP

    192:BeCRfODs6lH2ouNZLwUsp3lTLGmU6y22Xox:TyGbIx

Score
6/10
discovery

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/PoshC2-master/Install-for-Docker.sh
    /tmp/PoshC2-master/Install-for-Docker.sh
    1⤵
      PID:1493
      • /usr/bin/id
        id -u
        2⤵
        • Reads runtime system information
        PID:1494
      • /bin/rm
        rm -f /usr/local/bin/_posh-common
        2⤵
          PID:1495
        • /bin/rm
          rm -f /usr/local/bin/fpc
          2⤵
            PID:1496
          • /bin/rm
            rm -f /usr/local/bin/posh
            2⤵
              PID:1497
            • /bin/rm
              rm -f /usr/local/bin/posh-server
              2⤵
                PID:1498
              • /bin/rm
                rm -f /usr/local/bin/posh-config
                2⤵
                  PID:1499
                • /bin/rm
                  rm -f /usr/local/bin/posh-log
                  2⤵
                    PID:1500
                  • /bin/rm
                    rm -f /usr/local/bin/posh-service
                    2⤵
                      PID:1501
                    • /bin/rm
                      rm -f /usr/local/bin/posh-stop-service
                      2⤵
                        PID:1502
                      • /bin/rm
                        rm -f /usr/local/bin/posh-project
                        2⤵
                          PID:1503
                        • /bin/rm
                          rm -f /usr/local/bin/posh-docker-clean
                          2⤵
                            PID:1504
                          • /bin/rm
                            rm -f /usr/local/bin/posh-stop-server
                            2⤵
                              PID:1505
                            • /bin/rm
                              rm -f /usr/local/bin/posh-docker-debug
                              2⤵
                                PID:1506
                              • /bin/rm
                                rm -f /usr/local/bin/sharpsocks
                                2⤵
                                  PID:1507
                                • /usr/bin/curl
                                  curl https://raw.githubusercontent.com/nettitude/PoshC2/master/resources/scripts/_posh-common -o /usr/local/bin/_posh-common
                                  2⤵
                                  • System Network Configuration Discovery
                                  PID:1510

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads