78276bd481a04c29109fbbd8313701e5b814165fa4b48515ec4489ccfda93107

Analysis

max time kernel
10s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
06-12-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
Size

3KB
MD5

d0d36f169f1458806053aae482af5010
SHA1

e603944aceb5c0885a8627de12f36b159bbf2f05
SHA256

10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459
SHA512

982abe39731d8cc852c25650740ff73975c10d19027eccf610401260e2f508334f1de656f8dd332fa698dccc9f7d3bda610c8b9e84d276036a6e9408d826229a

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
732	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/71/stat	ps
File opened for reading	/proc/245/stat	ps
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/711/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/376/stat	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/70/stat	ps
File opened for reading	/proc/78/stat	ps
File opened for reading	/proc/335/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/728/status	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/165/stat	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/713/status	ps
File opened for reading	/proc/70/stat	ps
File opened for reading	/proc/465/stat	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/335/stat	ps
File opened for reading	/proc/337/stat	ps
File opened for reading	/proc/512/stat	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/70/status	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/75/status	ps
File opened for reading	/proc/77/status	ps
File opened for reading	/proc/338/status	ps
File opened for reading	/proc/72/stat	ps
File opened for reading	/proc/713/stat	ps
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/82/status	ps
File opened for reading	/proc/688/stat	ps
File opened for reading	/proc/714/stat	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/37/status	ps
File opened for reading	/proc/689/stat	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/675/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/375/stat	ps
File opened for reading	/proc/479/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/73/stat	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/74/stat	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/16/status	ps

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
717	10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
755	rm
757	rm

/tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
/tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
1⤵
- System Network Configuration Discovery
PID:717
- /bin/grep
  grep "Config File"
  2⤵
  PID:722
- /usr/bin/awk
  awk "{print \$3}"
  2⤵
  PID:724
- /bin/ps
  ps
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:728
- /bin/grep
  grep vmx
  2⤵
  PID:729
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:730
- /bin/chmod
  chmod +x /tmp//encrypt
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /bin/grep
  grep /vmfs/volumes/
  2⤵
  PID:735
- /usr/bin/awk
  awk "-F " "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:736
- /usr/bin/find
  find /usr/lib/vmware -type f -name index.html
  2⤵
  - Reads runtime system information
  PID:737
- /bin/mv
  mv /etc/motd /etc/motd1
  2⤵
  PID:739
- /bin/cp
  cp /tmp//motd /etc/motd
  2⤵
  PID:740
- /bin/find
  /bin/find / -name "*.log" -exec /bin/rm -rf "{}" ";"
  2⤵
  PID:741
- /bin/ps
  /bin/ps
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:743
- /bin/grep
  /bin/grep encrypt
  2⤵
  PID:744
- /bin/grep
  /bin/grep -v grep
  2⤵
  PID:745
- /bin/wc
  /bin/wc -l
  2⤵
  PID:746
- /bin/vmware
  /bin/vmware -l
  2⤵
  PID:748
- /bin/grep
  /bin/grep " 7."
  2⤵
  PID:749
- /bin/wc
  /bin/wc -l
  2⤵
  PID:750
- /bin/rm
  /bin/rm -f /store/packages/vmtools.py
  2⤵
  PID:751
- /bin/touch
  /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf
  2⤵
  PID:752
- /bin/touch
  /bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh
  2⤵
  PID:753
- /bin/touch
  /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh
  2⤵
  PID:754
- /bin/rm
  /bin/rm -f /tmp/encrypt /tmp/nohup.out /tmp/index.html /tmp/motd /tmp/public.pem /tmp/archieve.zip
  2⤵
  - System Network Configuration Discovery
  PID:755
- /bin/sh
  /bin/sh /bin/auto-backup.sh
  2⤵
  PID:756
- /bin/rm
  /bin/rm -- /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
  2⤵
  - System Network Configuration Discovery
  PID:757
- /etc/init.d/SSH
  /etc/init.d/SSH start
  2⤵
  PID:758

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads