4861dc86e0eef13b546d4a6e69e1f9ada2a81ee13bf4c2a4f55f381e6c4a2c72

Analysis

max time kernel
11s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
25-11-2024 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

platforms/aix/local/4232.sh
Size

635B
MD5

a3546946df48b2c8403d47b61e0c329f
SHA1

6f631ee5481c1d31041b72a4fb8dbca1788419c0
SHA256

6dd9464a2091f42438f09c9aa668fa0133837ec281e576db9778a23b0cb9018f
SHA512

0b83d1409ecfd3013dbe652b8d5b15a52602096e1fd71701c2d64179dbddb8eccc50002fc76acb759f57e173431e2a16a2b5f12dbce768017ccf6f826afac7c3

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
754	as
754	as
754	as
754	as

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccQ7AYXe.s	cc1
File opened for modification	/tmp/ccAdh6lN.c	collect2
File opened for modification	/tmp/ccGslp1p.o	collect2
File opened for modification	/tmp/cckpNxQ1.ld	collect2
File opened for modification	/tmp/platforms/aix/local/piolib	ld
File opened for modification	/tmp/platforms/aix/local/piolib.c	4232.sh
File opened for modification	/tmp/ccngxSgd.o	gcc
File opened for modification	/tmp/ccngxSgd.o	as
File opened for modification	/tmp/cclqIehB.res	gcc
File opened for modification	/tmp/cc8we6zH.le	collect2
File opened for modification	/tmp/ccQ7AYXe.s	gcc

/tmp/platforms/aix/local/4232.sh
/tmp/platforms/aix/local/4232.sh
1⤵
- Writes file to tmp directory
PID:735
- /bin/cat
  cat
  2⤵
  PID:736
- /usr/bin/gcc
  gcc piolib.c -o piolib -shared -fPIC
  2⤵
  - Writes file to tmp directory
  PID:738
- - /usr/lib/gcc/mips-linux-gnu/6/cc1
    /usr/lib/gcc/mips-linux-gnu/6/cc1 -quiet -imultiarch mips-linux-gnu piolib.c -meb -quiet -dumpbase piolib.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mips32r2 "-mabi=32" -auxbase piolib -fPIC -o /tmp/ccQ7AYXe.s
    3⤵
    - Writes file to tmp directory
    PID:743
- - /usr/local/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccngxSgd.o /tmp/ccQ7AYXe.s
    3⤵
    - System Network Configuration Discovery
    PID:754
- - /usr/local/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccngxSgd.o /tmp/ccQ7AYXe.s
    3⤵
    - System Network Configuration Discovery
    PID:754
- - /usr/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccngxSgd.o /tmp/ccQ7AYXe.s
    3⤵
    - System Network Configuration Discovery
    PID:754
- - /usr/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccngxSgd.o /tmp/ccQ7AYXe.s
    3⤵
    - System Network Configuration Discovery
    - Writes file to tmp directory
    PID:754
- - /usr/lib/gcc/mips-linux-gnu/6/collect2
    /usr/lib/gcc/mips-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cclqIehB.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -shared -melf32btsmip -o piolib /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccngxSgd.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:756
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cclqIehB.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -shared -melf32btsmip -o piolib /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccngxSgd.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
      4⤵
      Writes file to tmp directory
      PID:758
- /usr/lpd/pio/etc/pioout
  /usr/lpd/pio/etc/pioout -R ./piolib
  2⤵
  PID:764
- /bin/rm
  rm -f piolib.c piolib
  2⤵
  PID:765

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/ccQ7AYXe.s

Filesize
1KB

MD5
0525d7a2f4a193325fc83ec21613a45c

SHA1
69e4b9364cb6b25ec4a15a0efc9d97d29a444ec8

SHA256
c784e7ba262e78b7e0353402be7fb1b76d2bbc9aed1892df0e7adfa21609fd2e

SHA512
8016d9265ac5b8b495d0697f14f4ee2929add0362f7edeb2fd59a9fbc08908067cfb62d6aa750819e2aba494fb195c4b9152e42ec237d455472a9104d1308944

Download Submit
/tmp/ccngxSgd.o

Filesize
2KB

MD5
cdcf8b872b4c59b1f1d640fee80e1a37

SHA1
fd6c0b302f1f4bead9593cef3abff0ba1bb8e66d

SHA256
30d1b62fe6eb0347196033931d359344f60595fc18c0070394880bdc284b9f3e

SHA512
dc3141ad8437edd6b463041ba9f4723fbb50cf835ed5145a37f2a3227f2dcf0b3c06ac34719828ccd088e487b3b738a1372a2687bab28b014bc1546080890b9e

Download Submit
/tmp/platforms/aix/local/piolib

Filesize
5KB

MD5
f4319b199434a9561962c66b96f8a732

SHA1
75f83a37ba68c3b60a7d3dd72dabbcafc242ee0a

SHA256
20e927cc604423a6ab9559b588db2e0c8c396122567a51904f444d43698f95da

SHA512
636f9939b491dd8f587de43e0b7716706969ff1af0cb6c22015c8ea122e112adedf9c0a6529e2b63449f80e41d03dcc196f59e56ac96ce65483ae5de4f9d2f78

Download Submit
/tmp/platforms/aix/local/piolib.c

Filesize
273B

MD5
7d7d2ea6cde42ce582f464e4436246b9

SHA1
e902c4c205bff6e4e03506159d35891d68edbd62

SHA256
dee8d23345dc1b1f2ab6c126a3aa9d03800164e90d8f0823be48296ba6bce036

SHA512
8539d0ca0b56e8cbcf1d3a2e71db0b9aec4ff949dc9bae54657ecc87e94eeea3eee5d9b442c4c670142c6cd1fb48c568cab65dcf4f31ff4bab4ab2e60844f4d2

Download Submit