Overview

overview

8

Static

static

1

preparar.sh

ubuntu-18.04-amd64

8

preparar.sh

debian-9-armhf

8

preparar.sh

debian-9-mips

8

preparar.sh

debian-9-mipsel

8

Analysis

  • max time kernel
    140s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    18/08/2026, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    preparar.sh
  • Size 5KB
  • Sample260818-pphmjasdjc
  • SHA256 488667a02eaf88aa7ce155eb0eaee42424e92e888ac39cb19efd826c3756a377
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    persistenceprivilege_escalation
  • Modifies sudoers policy 1 TTPs 1 IoCs

    Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.

  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 10 IoCs

    Abuse sudo or cached sudo credentials to execute code.

    privilege_escalationdefense_evasion
  • Reads runtime system information 29 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/preparar.sh
    /tmp/preparar.sh
    1⤵
    • Adds new SSH keys
    PID:1500
    • /usr/bin/sudo
      sudo -v
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1501
    • /usr/bin/sudo
      sudo tee /etc/sudoers.d/nobox-migracao
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1503
      • /usr/bin/tee
        tee /etc/sudoers.d/nobox-migracao
        3⤵
        • Modifies sudoers policy
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        PID:1504
    • /usr/bin/sudo
      sudo chmod 440 /etc/sudoers.d/nobox-migracao
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1505
    • /usr/bin/sudo
      sudo systemsetup -setremotelogin on
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1506
    • /usr/bin/sudo
      sudo scutil --set HostName nobox-m1
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1507
    • /usr/bin/sudo
      sudo scutil --set LocalHostName nobox-m1
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1508
    • /usr/bin/sudo
      sudo scutil --set ComputerName "Nobox M1 (producao)"
      2⤵
      • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
      • Reads runtime system information
      PID:1511
    • /bin/mkdir
      mkdir -p /root/.ssh
      2⤵
      • Reads runtime system information
      PID:1512
    • /bin/grep
      grep -q "claude-comando@macbook-principal" /root/.ssh/authorized_keys
      2⤵
      • System Network Configuration Discovery
      PID:1514
    • /bin/chmod
      chmod 700 /root/.ssh
      2⤵
        PID:1515
      • /bin/chmod
        chmod 600 /root/.ssh/authorized_keys
        2⤵
          PID:1516
        • /usr/bin/sudo
          sudo pmset -a sleep 0 displaysleep 10 womp 1
          2⤵
          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
          • Reads runtime system information
          PID:1517
        • /usr/bin/sudo
          sudo systemsetup -setrestartpowerfailure on
          2⤵
          • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
          • Reads runtime system information
          PID:1518
        • /bin/sleep
          sleep 20
          2⤵
            PID:1522
          • /bin/sleep
            sleep 20
            2⤵
              PID:1529
            • /bin/sleep
              sleep 20
              2⤵
                PID:1533
              • /bin/sleep
                sleep 20
                2⤵
                  PID:1535
                • /bin/sleep
                  sleep 20
                  2⤵
                    PID:1537
                  • /bin/sleep
                    sleep 20
                    2⤵
                      PID:1539
                    • /bin/sleep
                      sleep 20
                      2⤵
                        PID:1541
                      • /bin/sleep
                        sleep 20
                        2⤵
                          PID:1543

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            nobox-migracao
                            • Path /etc/sudoers.d/nobox-migracao
                            • Size 25B
                            • SHA256 913c6467a4abf3a2bd0ae2af3e0326bb490368890709f8a52eeec9926ce61da0
                            • MD5 SHA1 SHA512
                            Submit Download

                            authorized_keys
                            • Path /root/.ssh/authorized_keys
                            • Size 114B
                            • SHA256 914d0d21e796b6d963be76a2b75fdb5b12c2dff43e112d4a9217d3d969a12387
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download