Overview

overview

10

Static

static

1

script_mal...6c1.sh

ubuntu-18.04-amd64

9

script_mal...6c1.sh

debian-9-armhf

9

script_mal...6c1.sh

debian-9-mips

9

script_mal...6c1.sh

debian-9-mipsel

9

script_malware/1.sh

ubuntu-18.04-amd64

10

script_malware/1.sh

debian-9-armhf

7

script_malware/1.sh

debian-9-mips

7

script_malware/1.sh

debian-9-mipsel

7

script_mal...459.sh

ubuntu-18.04-amd64

7

script_mal...459.sh

debian-9-armhf

7

script_mal...459.sh

debian-9-mips

7

script_mal...459.sh

debian-9-mipsel

7

script_mal...ux.elf

ubuntu-22.04-amd64

3

script_mal...da.elf

ubuntu-22.04-amd64

3

script_malware/23.sh

ubuntu-18.04-amd64

3

script_malware/23.sh

debian-9-armhf

3

script_malware/23.sh

debian-9-mips

3

script_malware/23.sh

debian-9-mipsel

3

script_malware/404

ubuntu-18.04-amd64

script_malware/404

debian-9-armhf

script_malware/404

debian-9-mips

script_malware/404

debian-9-mipsel

script_mal...c5b.py

windows7-x64

3

script_mal...c5b.py

windows10-2004-x64

3

script_mal...006.sh

ubuntu-18.04-amd64

10

script_mal...006.sh

debian-9-armhf

7

script_mal...006.sh

debian-9-mips

7

script_mal...006.sh

debian-9-mipsel

7

script_mal...oPy.sh

ubuntu-18.04-amd64

7

script_mal...oPy.sh

debian-9-armhf

7

script_mal...oPy.sh

debian-9-mips

7

script_mal...oPy.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    9s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    06-12-2024 14:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh

  • Size

    3KB

  • MD5

    d0d36f169f1458806053aae482af5010

  • SHA1

    e603944aceb5c0885a8627de12f36b159bbf2f05

  • SHA256

    10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459

  • SHA512

    982abe39731d8cc852c25650740ff73975c10d19027eccf610401260e2f508334f1de656f8dd332fa698dccc9f7d3bda610c8b9e84d276036a6e9408d826229a

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
    /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
    1⤵
    • System Network Configuration Discovery
    PID:714
    • /bin/grep
      grep "Config File"
      2⤵
        PID:722
      • /usr/bin/awk
        awk "{print \$3}"
        2⤵
          PID:723
        • /bin/ps
          ps
          2⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:731
        • /bin/grep
          grep vmx
          2⤵
            PID:732
          • /usr/bin/awk
            awk "{print \$2}"
            2⤵
            • Reads runtime system information
            PID:733
          • /bin/chmod
            chmod +x /tmp//encrypt
            2⤵
            • File and Directory Permissions Modification
            PID:738
          • /bin/grep
            grep /vmfs/volumes/
            2⤵
              PID:743
            • /usr/bin/awk
              awk "-F " "{print \$2}"
              2⤵
                PID:744
              • /usr/bin/find
                find /usr/lib/vmware -type f -name index.html
                2⤵
                  PID:747
                • /bin/mv
                  mv /etc/motd /etc/motd1
                  2⤵
                    PID:750
                  • /bin/cp
                    cp /tmp//motd /etc/motd
                    2⤵
                      PID:752
                    • /bin/find
                      /bin/find / -name "*.log" -exec /bin/rm -rf "{}" ";"
                      2⤵
                        PID:753
                      • /bin/ps
                        /bin/ps
                        2⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:757
                      • /bin/grep
                        /bin/grep encrypt
                        2⤵
                          PID:758
                        • /bin/grep
                          /bin/grep -v grep
                          2⤵
                            PID:759
                          • /bin/wc
                            /bin/wc -l
                            2⤵
                              PID:760
                            • /bin/wc
                              /bin/wc -l
                              2⤵
                                PID:766
                              • /bin/vmware
                                /bin/vmware -l
                                2⤵
                                  PID:764
                                • /bin/grep
                                  /bin/grep " 7."
                                  2⤵
                                    PID:765
                                  • /bin/rm
                                    /bin/rm -f /store/packages/vmtools.py
                                    2⤵
                                      PID:769
                                    • /bin/touch
                                      /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf
                                      2⤵
                                        PID:771
                                      • /bin/touch
                                        /bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh
                                        2⤵
                                          PID:772
                                        • /bin/touch
                                          /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh
                                          2⤵
                                            PID:773
                                          • /bin/rm
                                            /bin/rm -f /tmp/encrypt /tmp/nohup.out /tmp/index.html /tmp/motd /tmp/public.pem /tmp/archieve.zip
                                            2⤵
                                            • System Network Configuration Discovery
                                            PID:774
                                          • /bin/sh
                                            /bin/sh /bin/auto-backup.sh
                                            2⤵
                                              PID:775
                                            • /bin/rm
                                              /bin/rm -- /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
                                              2⤵
                                              • System Network Configuration Discovery
                                              PID:776
                                            • /etc/init.d/SSH
                                              /etc/init.d/SSH start
                                              2⤵
                                                PID:777

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads