Analysis
-
max time kernel
0s -
max time network
120s -
platform
linux_mips -
resource
debian9-mipsbe-en-20211208 -
resource tags
arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
25-11-2022 19:35
Static task
static1
Behavioral task
behavioral1
Sample
6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral2
Sample
6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral3
Sample
6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral4
Sample
6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
Resource
debian9-mipsel-20221111-en
General
-
Target
6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
-
Size
1KB
-
MD5
6acfc27bf16bf39d7cd6618fc2b57137
-
SHA1
3a3759c509e8ca578c504f162d2e1ee336193f3c
-
SHA256
6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
-
SHA512
4d4ce060047d41364fd0a7a4c6e615af6657c46347abafe6e93bf8363dfa2648185c229699525397938c77ca4b802893cbffe39b572f534ddb5f7b9402f34bda
Malware Config
Signatures
-
Modifies rc script 1 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
grepdescription ioc process /etc/rc.local /etc/rc.local grep -
Reads CPU attributes 1 TTPs 2 IoCs
Processes:
pspsdescription ioc process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspsdescription ioc process /proc/8/status /proc/8/status ps /proc/1/cmdline /proc/1/cmdline ps /proc/stat /proc/stat ps /proc/9/stat /proc/9/stat ps /proc/10/status /proc/10/status ps /proc/320/cmdline /proc/320/cmdline ps /proc/321/status /proc/321/status ps /proc/21/status /proc/21/status ps /proc/23/stat /proc/23/stat ps /proc/75/cmdline /proc/75/cmdline ps /proc/219/status /proc/219/status ps /proc/sys/kernel/osrelease /proc/sys/kernel/osrelease ps /proc/9/cmdline /proc/9/cmdline ps /proc/6/cmdline /proc/6/cmdline ps /proc/17/status /proc/17/status ps /proc/37/cmdline /proc/37/cmdline ps /proc/15/stat /proc/15/stat ps /proc/17/stat /proc/17/stat ps /proc/71/status /proc/71/status ps /proc/332/cmdline /proc/332/cmdline ps /proc/11/status /proc/11/status ps /proc/329/stat /proc/329/stat ps /proc/16/stat /proc/16/stat ps /proc/7/cmdline /proc/7/cmdline ps /proc/10/cmdline /proc/10/cmdline ps /proc/102/cmdline /proc/102/cmdline ps /proc/247/stat /proc/247/stat ps /proc/tty/drivers /proc/tty/drivers ps /proc/294/status /proc/294/status ps /proc/321/stat /proc/321/stat ps /proc/37/stat /proc/37/stat ps /proc/318/status /proc/318/status ps /proc/74/stat /proc/74/stat ps /proc/filesystems /proc/filesystems ps /proc/1/cmdline /proc/1/cmdline ps /proc/4/cmdline /proc/4/cmdline ps /proc/37/status /proc/37/status ps /proc/236/stat /proc/236/stat ps /proc/248/stat /proc/248/stat ps /proc/320/cmdline /proc/320/cmdline ps /proc/329/status /proc/329/status ps /proc/13/status /proc/13/status ps /proc/18/stat /proc/18/stat ps /proc/71/stat /proc/71/stat ps /proc/135/status /proc/135/status ps /proc/247/status /proc/247/status ps /proc/321/cmdline /proc/321/cmdline ps /proc/23/cmdline /proc/23/cmdline ps /proc/143/stat /proc/143/stat ps /proc/8/status /proc/8/status ps /proc/20/cmdline /proc/20/cmdline ps /proc/135/stat /proc/135/stat ps /proc/13/stat /proc/13/stat ps /proc/113/cmdline /proc/113/cmdline ps /proc/217/status /proc/217/status ps /proc/219/cmdline /proc/219/cmdline ps /proc/282/status /proc/282/status ps /proc/320/stat /proc/320/stat ps /proc/15/stat /proc/15/stat ps /proc/72/cmdline /proc/72/cmdline ps /proc/11/cmdline /proc/11/cmdline ps /proc/16/stat /proc/16/stat ps /proc/37/cmdline /proc/37/cmdline ps /proc/81/stat /proc/81/stat ps -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556edescription ioc process /tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e /tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e 6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e
Processes
-
/tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e/tmp/6637f76dce8486449059e817169f96e81992bd88ef686e094154036754d9556e1⤵
- Writes file to tmp directory
PID:320 -
/bin/cpcp -f /tmp/combinebmp.sh /apps/bzw/bin/kit/2⤵PID:323
-
/bin/rmrm -rf /apps/www/htdocs/nm/xDown.sh2⤵PID:337
-
/bin/rmrm -rf /apps/www/htdocs/nm/xDown_mon.sh2⤵PID:338
-
/bin/mkdirmkdir -p /apps/www/htdocs/nm2⤵PID:339
-
/bin/cpcp -f /tmp/xDown.sh /apps/www/htdocs/nm2⤵PID:341
-
/bin/cpcp -f /tmp/xDown_mon.sh /apps/www/htdocs/nm2⤵PID:343
-
/bin/chmodchmod +x /apps/www/htdocs/nm/xDown.sh2⤵PID:344
-
/bin/chmodchmod +x /apps/www/htdocs/nm/xDown_mon.sh2⤵PID:345
-
/bin/grepgrep -c /apps/www/htdocs/nm/xDown_mon.sh /etc/rc.local2⤵
- Modifies rc script
PID:346 -
/apps/www/htdocs/nm/xDown_mon.sh/apps/www/htdocs/nm/xDown_mon.sh2⤵PID:347
-
/bin/psps aux1⤵
- Reads CPU attributes
- Reads runtime system information
PID:328
-
/bin/grepgrep xDown_mon.sh1⤵PID:329
-
/bin/grepgrep -v grep1⤵PID:330
-
/usr/bin/awkawk "{print \$2}"1⤵PID:331
-
/bin/psps aux1⤵
- Reads CPU attributes
- Reads runtime system information
PID:333
-
/bin/grepgrep xDown.sh1⤵PID:334
-
/bin/grepgrep -v grep1⤵PID:335
-
/usr/bin/awkawk "{print \$2}"1⤵PID:336