Resubmissions
26-08-2024 15:34
240826-sztdka1emb 826-08-2024 15:33
240826-sza7zsseqp 826-08-2024 15:32
240826-syxdtssepn 8Analysis
-
max time kernel
6s -
max time network
9s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
26-08-2024 15:34
Behavioral task
behavioral1
Sample
bin.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
9 signatures
150 seconds
General
-
Target
bin.sh
-
Size
132KB
-
MD5
59ce0baba11893f90527fc951ac69912
-
SHA1
5857a7dd621c4c3ebb0b5a3bec915d409f70d39f
-
SHA256
4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7
-
SHA512
c5b12797b477e5e5964a78766bb40b1c0d9fdfb8eef1f9aee3df451e3441a40c61d325bf400ba51048811b68e1c70a95f15e4166b7a65a4eca0c624864328647
-
SSDEEP
3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog bin.sh File opened for modification /dev/misc/watchdog bin.sh -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp bin.sh -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route bin.sh -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /sbin/watchdog bin.sh File opened for modification /bin/watchdog bin.sh -
Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself sshd 716 -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp bin.sh File opened for reading /proc/net/raw bin.sh File opened for reading /proc/net/route bin.sh -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/36/stat killall File opened for reading /proc/161/stat killall File opened for reading /proc/376/stat killall File opened for reading /proc/690/stat killall File opened for reading /proc/703/stat killall File opened for reading /proc/3/stat killall File opened for reading /proc/10/stat killall File opened for reading /proc/343/stat killall File opened for reading /proc/722/stat killall File opened for reading /proc/17/stat killall File opened for reading /proc/72/stat killall File opened for reading /proc/80/stat killall File opened for reading /proc/714/stat killall File opened for reading /proc/714/cmdline killall File opened for reading /proc/716/stat killall File opened for reading /proc/126/stat killall File opened for reading /proc/16/stat killall File opened for reading /proc/70/stat killall File opened for reading /proc/127/cmdline killall File opened for reading /proc/337/stat killall File opened for reading /proc/392/stat killall File opened for reading /proc/709/stat killall File opened for reading /proc/self/exe bin.sh File opened for reading /proc/8/stat killall File opened for reading /proc/74/stat killall File opened for reading /proc/127/stat killall File opened for reading /proc/418/stat killall File opened for reading /proc/710/stat killall File opened for reading /proc/339/stat killall File opened for reading /proc/13/stat killall File opened for reading /proc/18/stat killall File opened for reading /proc/156/cmdline killall File opened for reading /proc/670/stat killall File opened for reading /proc/704/cmdline killall File opened for reading /proc/721/stat killall File opened for reading /proc/6/stat killall File opened for reading /proc/9/stat killall File opened for reading /proc/23/stat killall File opened for reading /proc/76/stat killall File opened for reading /proc/82/stat killall File opened for reading /proc/341/stat killall File opened for reading /proc/5/stat killall File opened for reading /proc/14/stat killall File opened for reading /proc/75/stat killall File opened for reading /proc/238/stat killall File opened for reading /proc/708/stat killall File opened for reading /proc/filesystems killall File opened for reading /proc/1/stat killall File opened for reading /proc/15/stat killall File opened for reading /proc/679/stat killall File opened for reading /proc/703/cmdline killall File opened for reading /proc/717/stat killall File opened for reading /proc/251/stat killall File opened for reading /proc/383/stat killall File opened for reading /proc/21/stat killall File opened for reading /proc/22/stat killall File opened for reading /proc/24/stat killall File opened for reading /proc/73/stat killall File opened for reading /proc/77/stat killall File opened for reading /proc/116/stat killall File opened for reading /proc/4/stat killall File opened for reading /proc/7/stat killall File opened for reading /proc/12/stat killall File opened for reading /proc/674/stat killall -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.ips bin.sh
Processes
-
/tmp/bin.sh/tmp/bin.sh1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Reads system routing table
- Writes file to system bin folder
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:713 -
/bin/shsh -c "killall -9 telnetd utelnetd scfgmgr"2⤵PID:717
-
/usr/bin/killallkillall -9 telnetd utelnetd scfgmgr3⤵
- Reads runtime system information
PID:720
-
-