Overview

overview

10

Static

static

1

script_mal...6c1.sh

ubuntu-18.04-amd64

9

script_mal...6c1.sh

debian-9-armhf

9

script_mal...6c1.sh

debian-9-mips

9

script_mal...6c1.sh

debian-9-mipsel

9

script_malware/1.sh

ubuntu-18.04-amd64

10

script_malware/1.sh

debian-9-armhf

7

script_malware/1.sh

debian-9-mips

7

script_malware/1.sh

debian-9-mipsel

7

script_mal...459.sh

ubuntu-18.04-amd64

7

script_mal...459.sh

debian-9-armhf

7

script_mal...459.sh

debian-9-mips

7

script_mal...459.sh

debian-9-mipsel

7

script_mal...ux.elf

ubuntu-22.04-amd64

3

script_mal...da.elf

ubuntu-22.04-amd64

3

script_malware/23.sh

ubuntu-18.04-amd64

3

script_malware/23.sh

debian-9-armhf

3

script_malware/23.sh

debian-9-mips

3

script_malware/23.sh

debian-9-mipsel

3

script_malware/404

ubuntu-18.04-amd64

script_malware/404

debian-9-armhf

script_malware/404

debian-9-mips

script_malware/404

debian-9-mipsel

script_mal...c5b.py

windows7-x64

3

script_mal...c5b.py

windows10-2004-x64

3

script_mal...006.sh

ubuntu-18.04-amd64

10

script_mal...006.sh

debian-9-armhf

7

script_mal...006.sh

debian-9-mips

7

script_mal...006.sh

debian-9-mipsel

7

script_mal...oPy.sh

ubuntu-18.04-amd64

7

script_mal...oPy.sh

debian-9-armhf

7

script_mal...oPy.sh

debian-9-mips

7

script_mal...oPy.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    0s
  • max time network
    134s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    06-12-2024 14:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh

  • Size

    3KB

  • MD5

    d0d36f169f1458806053aae482af5010

  • SHA1

    e603944aceb5c0885a8627de12f36b159bbf2f05

  • SHA256

    10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459

  • SHA512

    982abe39731d8cc852c25650740ff73975c10d19027eccf610401260e2f508334f1de656f8dd332fa698dccc9f7d3bda610c8b9e84d276036a6e9408d826229a

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
    /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
    1⤵
    • System Network Configuration Discovery
    PID:1505
    • /bin/grep
      grep "Config File"
      2⤵
        PID:1510
      • /usr/bin/awk
        awk "{print \$3}"
        2⤵
          PID:1511
        • /usr/bin/awk
          awk "{print \$2}"
          2⤵
            PID:1515
          • /bin/grep
            grep vmx
            2⤵
              PID:1514
            • /bin/ps
              ps
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:1513
            • /bin/chmod
              chmod +x /tmp//encrypt
              2⤵
              • File and Directory Permissions Modification
              PID:1516
            • /usr/bin/awk
              awk "-F " "{print \$2}"
              2⤵
                PID:1520
              • /bin/grep
                grep /vmfs/volumes/
                2⤵
                  PID:1519
                • /usr/bin/find
                  find /usr/lib/vmware -type f -name index.html
                  2⤵
                    PID:1521
                  • /bin/mv
                    mv /etc/motd /etc/motd1
                    2⤵
                    • Reads runtime system information
                    PID:1522
                  • /bin/find
                    /bin/find / -name "*.log" -exec /bin/rm -rf "{}" ";"
                    2⤵
                      PID:1523
                    • /bin/wc
                      /bin/wc -l
                      2⤵
                        PID:1528
                      • /bin/grep
                        /bin/grep -v grep
                        2⤵
                          PID:1527
                        • /bin/grep
                          /bin/grep encrypt
                          2⤵
                            PID:1526
                          • /bin/ps
                            /bin/ps
                            2⤵
                            • Reads CPU attributes
                            • Reads runtime system information
                            PID:1525
                          • /bin/wc
                            /bin/wc -l
                            2⤵
                              PID:1532
                            • /bin/grep
                              /bin/grep " 7."
                              2⤵
                                PID:1531
                              • /bin/vmware
                                /bin/vmware -l
                                2⤵
                                  PID:1530
                                • /bin/rm
                                  /bin/rm -f /store/packages/vmtools.py
                                  2⤵
                                    PID:1533
                                  • /bin/touch
                                    /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf
                                    2⤵
                                      PID:1534
                                    • /bin/touch
                                      /bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh
                                      2⤵
                                        PID:1535
                                      • /bin/touch
                                        /bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh
                                        2⤵
                                          PID:1536
                                        • /bin/rm
                                          /bin/rm -f /tmp/encrypt /tmp/nohup.out /tmp/index.html /tmp/motd /tmp/public.pem /tmp/archieve.zip
                                          2⤵
                                          • System Network Configuration Discovery
                                          PID:1537
                                        • /bin/sh
                                          /bin/sh /bin/auto-backup.sh
                                          2⤵
                                            PID:1538
                                          • /bin/rm
                                            /bin/rm -- /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
                                            2⤵
                                            • System Network Configuration Discovery
                                            PID:1539
                                          • /etc/init.d/SSH
                                            /etc/init.d/SSH start
                                            2⤵
                                              PID:1540

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads