6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e

Analysis

max time kernel
0s
max time network
124s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25-11-2022 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
Size

1KB
MD5

6acfc27bf16bf39d7cd6618fc2b57137
SHA1

3a3759c509e8ca578c504f162d2e1ee336193f3c
SHA256

6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
SHA512

4d4ce060047d41364fd0a7a4c6e615af6657c46347abafe6e93bf8363dfa2648185c229699525397938c77ca4b802893cbffe39b572f534ddb5f7b9402f34bda

Score

7^/10

persistence

Malware Config

Signatures

Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

grep

description ioc process

/etc/rc.local /etc/rc.local grep
Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery
T1082

Processes:

psps

description ioc process

/sys/devices/system/cpu/online /sys/devices/system/cpu/online ps
/sys/devices/system/cpu/online /sys/devices/system/cpu/online ps

description	ioc	process
/etc/rc.local	/etc/rc.local	grep

description	ioc	process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pspsmkdircp

description	ioc	process
/proc/104/cmdline	/proc/104/cmdline	ps
/proc/320/stat	/proc/320/stat	ps
/proc/17/cmdline	/proc/17/cmdline	ps
/proc/208/status	/proc/208/status	ps
/proc/322/stat	/proc/322/stat	ps
/proc/370/stat	/proc/370/stat	ps
/proc/370/cmdline	/proc/370/cmdline	ps
/proc/2/status	/proc/2/status	ps
/proc/278/cmdline	/proc/278/cmdline	ps
/proc/106/status	/proc/106/status	ps
/proc/320/cmdline	/proc/320/cmdline	ps
/proc/363/status	/proc/363/status	ps
/proc/28/status	/proc/28/status	ps
/proc/42/cmdline	/proc/42/cmdline	ps
/proc/362/cmdline	/proc/362/cmdline	ps
/proc/320/status	/proc/320/status	ps
/proc/360/cmdline	/proc/360/cmdline	ps
/proc/15/stat	/proc/15/stat	ps
/proc/269/cmdline	/proc/269/cmdline	ps
/proc/360/stat	/proc/360/stat	ps
/proc/131/cmdline	/proc/131/cmdline	ps
/proc/161/stat	/proc/161/stat	ps
/proc/13/cmdline	/proc/13/cmdline	ps
/proc/23/stat	/proc/23/stat	ps
/proc/226/stat	/proc/226/stat	ps
/proc/226/cmdline	/proc/226/cmdline	ps
/proc/13/status	/proc/13/status	ps
/proc/226/status	/proc/226/status	ps
/proc/369/status	/proc/369/status	ps
/proc/27/cmdline	/proc/27/cmdline	ps
/proc/323/stat	/proc/323/stat	ps
/proc/278/status	/proc/278/status	ps
/proc/363/stat	/proc/363/stat	ps
/proc/stat	/proc/stat	ps
/proc/8/stat	/proc/8/stat	ps
/proc/12/status	/proc/12/status	ps
/proc/95/stat	/proc/95/stat	ps
/proc/135/status	/proc/135/status	ps
/proc/226/stat	/proc/226/stat	ps
/proc/29/cmdline	/proc/29/cmdline	ps
/proc/375/stat	/proc/375/stat	ps
/proc/filesystems	/proc/filesystems	mkdir
/proc/41/status	/proc/41/status	ps
/proc/139/status	/proc/139/status	ps
/proc/145/cmdline	/proc/145/cmdline	ps
/proc/2/cmdline	/proc/2/cmdline	ps
/proc/7/status	/proc/7/status	ps
/proc/27/stat	/proc/27/stat	ps
/proc/27/status	/proc/27/status	ps
/proc/29/cmdline	/proc/29/cmdline	ps
/proc/226/cmdline	/proc/226/cmdline	ps
/proc/363/cmdline	/proc/363/cmdline	ps
/proc/10/stat	/proc/10/stat	ps
/proc/95/status	/proc/95/status	ps
/proc/287/status	/proc/287/status	ps
/proc/3/status	/proc/3/status	ps
/proc/14/cmdline	/proc/14/cmdline	ps
/proc/236/cmdline	/proc/236/cmdline	ps
/proc/17/stat	/proc/17/stat	ps
/proc/24/cmdline	/proc/24/cmdline	ps
/proc/322/status	/proc/322/status	ps
/proc/filesystems	/proc/filesystems	cp
/proc/7/stat	/proc/7/stat	ps
/proc/25/stat	/proc/25/stat	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e

description	ioc	process
/tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e	/tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e	6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e

/tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
/tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
1⤵
- Writes file to tmp directory
PID:363

/bin/cp
cp -f /tmp/combinebmp.sh /apps/bzw/bin/kit/
2⤵
PID:366

/bin/rm
rm -rf /apps/www/htdocs/nm/xDown.sh
2⤵
PID:379

/bin/rm
rm -rf /apps/www/htdocs/nm/xDown_mon.sh
2⤵
PID:380

/bin/mkdir
mkdir -p /apps/www/htdocs/nm
2⤵
- Reads runtime system information
PID:381

/bin/cp
cp -f /tmp/xDown.sh /apps/www/htdocs/nm
2⤵
- Reads runtime system information
PID:383

/bin/cp
cp -f /tmp/xDown_mon.sh /apps/www/htdocs/nm
2⤵
PID:385

/bin/chmod
chmod +x /apps/www/htdocs/nm/xDown.sh
2⤵
PID:386

/bin/chmod
chmod +x /apps/www/htdocs/nm/xDown_mon.sh
2⤵
PID:387

/bin/grep
grep -c /apps/www/htdocs/nm/xDown_mon.sh /etc/rc.local
2⤵
- Modifies rc script
PID:388

/apps/www/htdocs/nm/xDown_mon.sh
/apps/www/htdocs/nm/xDown_mon.sh
2⤵
PID:389

/bin/ps
ps aux
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:370

/bin/grep
grep xDown_mon.sh
1⤵
PID:371

/bin/grep
grep -v grep
1⤵
PID:372

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:373

/bin/ps
ps aux
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:375

/bin/grep
grep xDown.sh
1⤵
PID:376

/bin/grep
grep -v grep
1⤵
PID:377

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:378

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads