Analysis
-
max time kernel
29s -
max time network
43s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
14-08-2024 00:23
Static task
static1
Behavioral task
behavioral1
Sample
bin.sh
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral2
Sample
bin.sh
Resource
debian12-mipsel-20240729-en
Behavioral task
behavioral3
Sample
bin.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral4
Sample
bin.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral5
Sample
bin.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral6
Sample
bin.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral7
Sample
bin.sh
Resource
ubuntu2004-amd64-20240729-en
Behavioral task
behavioral8
Sample
bin.sh
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral9
Sample
bin.sh
Resource
ubuntu2404-amd64-20240729-en
General
-
Target
bin.sh
-
Size
300KB
-
MD5
eec5c6c219535fba3a0492ea8118b397
-
SHA1
292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21
-
SHA256
12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
-
SHA512
3482c8324a18302f0f37b6e23ed85f24fff9f50bb568d8fd7461bf57f077a7c592f7a88bb2e1c398699958946d87bb93ab744d13a0003f9b879c15e6471f7400
-
SSDEEP
6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT
Malware Config
Signatures
-
Contacts a large (3111) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog bin.sh File opened for modification /dev/misc/watchdog bin.sh -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp bin.sh -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/S95baby.sh bin.sh -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route bin.sh -
Write file to user bin folder 1 TTPs 1 IoCs
description ioc Process File opened for modification /usr/bin/gvmap.sh bin.sh -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /sbin/watchdog bin.sh File opened for modification /bin/watchdog bin.sh -
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself dropbear 715 -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp bin.sh File opened for reading /proc/net/raw bin.sh File opened for reading /proc/net/route bin.sh -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/36 killall File opened for reading /proc/57 killall File opened for reading /proc/712 killall File opened for reading /proc/23/stat killall File opened for reading /proc/31 killall File opened for reading /proc/322/stat killall File opened for reading /proc/332 killall File opened for reading /proc/654/stat killall File opened for reading /proc/702 killall File opened for reading /proc/24 killall File opened for reading /proc/46 killall File opened for reading /proc/143 killall File opened for reading /proc/702/stat killall File opened for reading /proc/mounts bin.sh File opened for reading /proc/7 killall File opened for reading /proc/32 killall File opened for reading /proc/716/stat killall File opened for reading /proc/2/stat killall File opened for reading /proc/15/stat killall File opened for reading /proc/18 killall File opened for reading /proc/22/stat killall File opened for reading /proc/46/stat killall File opened for reading /proc/51/stat killall File opened for reading /proc/73/stat killall File opened for reading /proc/341 killall File opened for reading /proc/639/stat killall File opened for reading /proc/56 killall File opened for reading /proc/214/stat killall File opened for reading /proc/665/stat killall File opened for reading /proc/3/stat killall File opened for reading /proc/16 killall File opened for reading /proc/320 killall File opened for reading /proc/187/stat killall File opened for reading /proc/187/cmdline killall File opened for reading /proc/654 killall File opened for reading /proc/22 killall File opened for reading /proc/260/stat killall File opened for reading /proc/322 killall File opened for reading /proc/715 killall File opened for reading /proc/1/stat killall File opened for reading /proc/4 killall File opened for reading /proc/35 killall File opened for reading /proc/320/stat killall File opened for reading /proc/51 killall File opened for reading /proc/638/stat killall File opened for reading /proc/2 killall File opened for reading /proc/7/stat killall File opened for reading /proc/32/stat killall File opened for reading /proc/45 killall File opened for reading /proc/332/stat killall File opened for reading /proc/339 killall File opened for reading /proc/665 killall File opened for reading /proc/26 killall File opened for reading /proc/26/stat killall File opened for reading /proc/29/stat killall File opened for reading /proc/33/stat killall File opened for reading /proc/344 killall File opened for reading /proc/347/stat killall File opened for reading /proc/5 killall File opened for reading /proc/29 killall File opened for reading /proc/638 killall File opened for reading /proc/6/stat killall File opened for reading /proc/15 killall File opened for reading /proc/314/stat killall -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.ips bin.sh
Processes
-
/tmp/bin.sh/tmp/bin.sh1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Writes file to system bin folder
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:710 -
/bin/sh/bin/sh -c "killall -9 telnetd utelnetd scfgmgr"2⤵PID:716
-
/usr/bin/killallkillall -9 telnetd utelnetd scfgmgr3⤵
- Reads runtime system information
PID:718
-
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --destination-port 41633 -j ACCEPT"2⤵PID:768
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --source-port 41633 -j ACCEPT"2⤵PID:769
-
-
/bin/sh/bin/sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 41633 -j ACCEPT"2⤵PID:770
-
-
/bin/sh/bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 41633 -j ACCEPT"2⤵PID:771
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --dport 41633 -j ACCEPT"2⤵PID:772
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --sport 41633 -j ACCEPT"2⤵PID:773
-
-
/bin/sh/bin/sh -c "iptables -I PREROUTING -t nat -p tcp --dport 41633 -j ACCEPT"2⤵PID:774
-
-
/bin/sh/bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --sport 41633 -j ACCEPT"2⤵PID:775
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"2⤵PID:776
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"2⤵PID:777
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"2⤵PID:778
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"2⤵PID:779
-
-
/bin/sh/bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""2⤵PID:780
-
-
/bin/sh/bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""2⤵PID:781
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"2⤵PID:782
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"2⤵PID:783
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"2⤵PID:784
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"2⤵PID:785
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"2⤵PID:786
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"2⤵PID:787
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"2⤵PID:788
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"2⤵PID:789
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"2⤵PID:790
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"2⤵PID:791
-
-
/bin/sh/bin/sh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"2⤵PID:792
-
-
/bin/sh/bin/sh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"2⤵PID:793
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD51b3235ba10fc04836c941d3d27301956
SHA18909655763143702430b8c58b3ae3b04cfd3a29c
SHA25601ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a
SHA51298bdb5c266222ccbd63b6f80c87e501c8033dc53b0513d300b8da50e39a207a0b69f8cd3ecc4a128dec340a1186779fedd1049c9b0a70e90d2cb3ae6ebfa4c4d
-
Filesize
300KB
MD5eec5c6c219535fba3a0492ea8118b397
SHA1292559e94f1c04b7d0c65d4a01bbbc5dc1ff6f21
SHA25612013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
SHA5123482c8324a18302f0f37b6e23ed85f24fff9f50bb568d8fd7461bf57f077a7c592f7a88bb2e1c398699958946d87bb93ab744d13a0003f9b879c15e6471f7400