Analysis

  • max time kernel
    4800s
  • max time network
    125s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20221111-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    06/01/2023, 07:34

General

  • Target

    .rsync/c/go

  • Size

    398B

  • MD5

    1553384ee57751af771a9389b7393b93

  • SHA1

    e33a67fde9cf13c077da652fbdec07957fff2372

  • SHA256

    98dffdabf9caf512c8c9090e8c9b77a04d6ce31bbd13afe4f09668a4f2eacc2f

  • SHA512

    d406796ebae8bf724f7c18371ba6d86ef491ad0745dd64d0eaaffee9daca3954d9429c8c4e87c404338b839b47a30a6791ef25663239e4a5f0ea5113fa9b6b49

Score
5/10

Malware Config

Signatures

  • Writes file to tmp directory 12 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.rsync/c/go
    /tmp/.rsync/c/go
    1⤵
    • Writes file to tmp directory
    PID:327
    • /bin/uname
      uname -m
      2⤵
        PID:329
      • /usr/bin/touch
        touch v
        2⤵
          PID:331
        • /bin/rm
          rm -rf p
          2⤵
            PID:335
          • /bin/rm
            rm -rf ip
            2⤵
              PID:336
            • /bin/rm
              rm -rf "xtr*"
              2⤵
                PID:337
              • /bin/rm
                rm -rf a "a.*"
                2⤵
                  PID:338
                • /bin/rm
                  rm -rf b "b.*"
                  2⤵
                    PID:339
                  • /bin/sleep
                    sleep 5s
                    2⤵
                      PID:340
                    • /usr/bin/timeout
                      timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                      2⤵
                        PID:341
                        • ./tsm
                          ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                          3⤵
                            PID:342
                        • /bin/sleep
                          sleep 3
                          2⤵
                            PID:343
                          • /bin/rm
                            rm -rf "xtr*"
                            2⤵
                              PID:344
                            • /bin/rm
                              rm -rf ip
                              2⤵
                                PID:345
                              • /bin/rm
                                rm -rf p
                                2⤵
                                  PID:346
                                • /bin/rm
                                  rm -rf .out
                                  2⤵
                                    PID:347
                                  • /bin/rm
                                    rm -rf "/tmp/t*"
                                    2⤵
                                    • Writes file to tmp directory
                                    PID:348
                                  • /usr/bin/touch
                                    touch v
                                    2⤵
                                      PID:349
                                    • /bin/rm
                                      rm -rf p
                                      2⤵
                                        PID:350
                                      • /bin/rm
                                        rm -rf ip
                                        2⤵
                                          PID:351
                                        • /bin/rm
                                          rm -rf "xtr*"
                                          2⤵
                                            PID:352
                                          • /bin/rm
                                            rm -rf a "a.*"
                                            2⤵
                                              PID:353
                                            • /bin/rm
                                              rm -rf b "b.*"
                                              2⤵
                                                PID:354
                                              • /bin/sleep
                                                sleep 13s
                                                2⤵
                                                  PID:355
                                                • /usr/bin/timeout
                                                  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                  2⤵
                                                    PID:356
                                                    • ./tsm
                                                      ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                      3⤵
                                                        PID:357
                                                    • /bin/sleep
                                                      sleep 3
                                                      2⤵
                                                        PID:358
                                                      • /bin/rm
                                                        rm -rf "xtr*"
                                                        2⤵
                                                          PID:359
                                                        • /bin/rm
                                                          rm -rf ip
                                                          2⤵
                                                            PID:360
                                                          • /bin/rm
                                                            rm -rf p
                                                            2⤵
                                                              PID:361
                                                            • /bin/rm
                                                              rm -rf .out
                                                              2⤵
                                                                PID:362
                                                              • /bin/rm
                                                                rm -rf "/tmp/t*"
                                                                2⤵
                                                                • Writes file to tmp directory
                                                                PID:363
                                                              • /usr/bin/touch
                                                                touch v
                                                                2⤵
                                                                  PID:364
                                                                • /bin/rm
                                                                  rm -rf p
                                                                  2⤵
                                                                    PID:365
                                                                  • /bin/rm
                                                                    rm -rf ip
                                                                    2⤵
                                                                      PID:366
                                                                    • /bin/rm
                                                                      rm -rf "xtr*"
                                                                      2⤵
                                                                        PID:367
                                                                      • /bin/rm
                                                                        rm -rf a "a.*"
                                                                        2⤵
                                                                          PID:368
                                                                        • /bin/rm
                                                                          rm -rf b "b.*"
                                                                          2⤵
                                                                            PID:369
                                                                          • /bin/sleep
                                                                            sleep 5s
                                                                            2⤵
                                                                              PID:370
                                                                            • /usr/bin/timeout
                                                                              timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                              2⤵
                                                                                PID:371
                                                                                • ./tsm
                                                                                  ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                  3⤵
                                                                                    PID:372
                                                                                • /bin/sleep
                                                                                  sleep 3
                                                                                  2⤵
                                                                                    PID:373
                                                                                  • /bin/rm
                                                                                    rm -rf "xtr*"
                                                                                    2⤵
                                                                                      PID:374
                                                                                    • /bin/rm
                                                                                      rm -rf ip
                                                                                      2⤵
                                                                                        PID:375
                                                                                      • /bin/rm
                                                                                        rm -rf p
                                                                                        2⤵
                                                                                          PID:376
                                                                                        • /bin/rm
                                                                                          rm -rf .out
                                                                                          2⤵
                                                                                            PID:377
                                                                                          • /bin/rm
                                                                                            rm -rf "/tmp/t*"
                                                                                            2⤵
                                                                                            • Writes file to tmp directory
                                                                                            PID:378
                                                                                          • /usr/bin/touch
                                                                                            touch v
                                                                                            2⤵
                                                                                              PID:379
                                                                                            • /bin/rm
                                                                                              rm -rf p
                                                                                              2⤵
                                                                                                PID:380
                                                                                              • /bin/rm
                                                                                                rm -rf ip
                                                                                                2⤵
                                                                                                  PID:381
                                                                                                • /bin/rm
                                                                                                  rm -rf "xtr*"
                                                                                                  2⤵
                                                                                                    PID:382
                                                                                                  • /bin/rm
                                                                                                    rm -rf a "a.*"
                                                                                                    2⤵
                                                                                                      PID:383
                                                                                                    • /bin/rm
                                                                                                      rm -rf b "b.*"
                                                                                                      2⤵
                                                                                                        PID:384
                                                                                                      • /bin/sleep
                                                                                                        sleep 17s
                                                                                                        2⤵
                                                                                                          PID:385
                                                                                                        • /usr/bin/timeout
                                                                                                          timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                          2⤵
                                                                                                            PID:386
                                                                                                            • ./tsm
                                                                                                              ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                              3⤵
                                                                                                                PID:387
                                                                                                            • /bin/sleep
                                                                                                              sleep 3
                                                                                                              2⤵
                                                                                                                PID:388
                                                                                                              • /bin/rm
                                                                                                                rm -rf "xtr*"
                                                                                                                2⤵
                                                                                                                  PID:389
                                                                                                                • /bin/rm
                                                                                                                  rm -rf ip
                                                                                                                  2⤵
                                                                                                                    PID:390
                                                                                                                  • /bin/rm
                                                                                                                    rm -rf p
                                                                                                                    2⤵
                                                                                                                      PID:391
                                                                                                                    • /bin/rm
                                                                                                                      rm -rf .out
                                                                                                                      2⤵
                                                                                                                        PID:392
                                                                                                                      • /bin/rm
                                                                                                                        rm -rf "/tmp/t*"
                                                                                                                        2⤵
                                                                                                                        • Writes file to tmp directory
                                                                                                                        PID:393
                                                                                                                      • /usr/bin/touch
                                                                                                                        touch v
                                                                                                                        2⤵
                                                                                                                          PID:394
                                                                                                                        • /bin/rm
                                                                                                                          rm -rf p
                                                                                                                          2⤵
                                                                                                                            PID:395
                                                                                                                          • /bin/rm
                                                                                                                            rm -rf ip
                                                                                                                            2⤵
                                                                                                                              PID:396
                                                                                                                            • /bin/rm
                                                                                                                              rm -rf "xtr*"
                                                                                                                              2⤵
                                                                                                                                PID:397
                                                                                                                              • /bin/rm
                                                                                                                                rm -rf a "a.*"
                                                                                                                                2⤵
                                                                                                                                  PID:398
                                                                                                                                • /bin/rm
                                                                                                                                  rm -rf b "b.*"
                                                                                                                                  2⤵
                                                                                                                                    PID:399
                                                                                                                                  • /bin/sleep
                                                                                                                                    sleep 2s
                                                                                                                                    2⤵
                                                                                                                                      PID:400
                                                                                                                                    • /usr/bin/timeout
                                                                                                                                      timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                      2⤵
                                                                                                                                        PID:401
                                                                                                                                        • ./tsm
                                                                                                                                          ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                          3⤵
                                                                                                                                            PID:402
                                                                                                                                        • /bin/sleep
                                                                                                                                          sleep 3
                                                                                                                                          2⤵
                                                                                                                                            PID:403
                                                                                                                                          • /bin/rm
                                                                                                                                            rm -rf "xtr*"
                                                                                                                                            2⤵
                                                                                                                                              PID:404
                                                                                                                                            • /bin/rm
                                                                                                                                              rm -rf ip
                                                                                                                                              2⤵
                                                                                                                                                PID:405
                                                                                                                                              • /bin/rm
                                                                                                                                                rm -rf p
                                                                                                                                                2⤵
                                                                                                                                                  PID:406
                                                                                                                                                • /bin/rm
                                                                                                                                                  rm -rf .out
                                                                                                                                                  2⤵
                                                                                                                                                    PID:407
                                                                                                                                                  • /bin/rm
                                                                                                                                                    rm -rf "/tmp/t*"
                                                                                                                                                    2⤵
                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                    PID:408
                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                    touch v
                                                                                                                                                    2⤵
                                                                                                                                                      PID:409
                                                                                                                                                    • /bin/rm
                                                                                                                                                      rm -rf p
                                                                                                                                                      2⤵
                                                                                                                                                        PID:410
                                                                                                                                                      • /bin/rm
                                                                                                                                                        rm -rf ip
                                                                                                                                                        2⤵
                                                                                                                                                          PID:411
                                                                                                                                                        • /bin/rm
                                                                                                                                                          rm -rf "xtr*"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:412
                                                                                                                                                          • /bin/rm
                                                                                                                                                            rm -rf a "a.*"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:413
                                                                                                                                                            • /bin/rm
                                                                                                                                                              rm -rf b "b.*"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:414
                                                                                                                                                              • /bin/sleep
                                                                                                                                                                sleep 12s
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:415
                                                                                                                                                                • /usr/bin/timeout
                                                                                                                                                                  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:416
                                                                                                                                                                    • ./tsm
                                                                                                                                                                      ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:417
                                                                                                                                                                    • /bin/sleep
                                                                                                                                                                      sleep 3
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:418
                                                                                                                                                                      • /bin/rm
                                                                                                                                                                        rm -rf "xtr*"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:419
                                                                                                                                                                        • /bin/rm
                                                                                                                                                                          rm -rf ip
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:420
                                                                                                                                                                          • /bin/rm
                                                                                                                                                                            rm -rf p
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:421
                                                                                                                                                                            • /bin/rm
                                                                                                                                                                              rm -rf .out
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:422
                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                rm -rf "/tmp/t*"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                                                PID:423
                                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                                touch v
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:424
                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                  rm -rf p
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:425
                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                    rm -rf ip
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:426
                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                      rm -rf "xtr*"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:427
                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                        rm -rf a "a.*"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:428
                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                          rm -rf b "b.*"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:429
                                                                                                                                                                                          • /bin/sleep
                                                                                                                                                                                            sleep 7s
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:430
                                                                                                                                                                                            • /usr/bin/timeout
                                                                                                                                                                                              timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:431
                                                                                                                                                                                                • ./tsm
                                                                                                                                                                                                  ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:432
                                                                                                                                                                                                • /bin/sleep
                                                                                                                                                                                                  sleep 3
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:433
                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                    rm -rf "xtr*"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:434
                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                      rm -rf ip
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:435
                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                        rm -rf p
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                          rm -rf .out
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:437
                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                            rm -rf "/tmp/t*"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                            PID:438
                                                                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                                                                            touch v
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:439
                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                              rm -rf p
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:440
                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                rm -rf ip
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:441
                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                  rm -rf "xtr*"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:442
                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                    rm -rf a "a.*"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:443
                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                      rm -rf b "b.*"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:444
                                                                                                                                                                                                                      • /bin/sleep
                                                                                                                                                                                                                        sleep 4s
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:445
                                                                                                                                                                                                                        • /usr/bin/timeout
                                                                                                                                                                                                                          timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:446
                                                                                                                                                                                                                            • ./tsm
                                                                                                                                                                                                                              ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:447
                                                                                                                                                                                                                            • /bin/sleep
                                                                                                                                                                                                                              sleep 3
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:448
                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                rm -rf "xtr*"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:449
                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                  rm -rf ip
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:450
                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                    rm -rf p
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:451
                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                      rm -rf .out
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:452
                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                        rm -rf "/tmp/t*"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Writes file to tmp directory
                                                                                                                                                                                                                                        PID:453
                                                                                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                                                                                        touch v
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:454
                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                          rm -rf p
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:455
                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                            rm -rf ip
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:456
                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                              rm -rf "xtr*"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:457
                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                rm -rf a "a.*"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:458
                                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                                  rm -rf b "b.*"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:459
                                                                                                                                                                                                                                                  • /bin/sleep
                                                                                                                                                                                                                                                    sleep 3s
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:460
                                                                                                                                                                                                                                                    • /usr/bin/timeout
                                                                                                                                                                                                                                                      timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:461
                                                                                                                                                                                                                                                        • ./tsm
                                                                                                                                                                                                                                                          ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:462
                                                                                                                                                                                                                                                        • /bin/sleep
                                                                                                                                                                                                                                                          sleep 3
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:463
                                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                                            rm -rf "xtr*"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                                              rm -rf ip
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:465
                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                rm -rf p
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:466
                                                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                                                  rm -rf .out
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:467
                                                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                                                    rm -rf "/tmp/t*"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                                                                                                                    touch v
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:469
                                                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                                                      rm -rf p
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:470
                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                        rm -rf ip
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:471
                                                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                                                          rm -rf "xtr*"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:472
                                                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                                                            rm -rf a "a.*"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:473
                                                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                                                              rm -rf b "b.*"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:474
                                                                                                                                                                                                                                                                              • /bin/sleep
                                                                                                                                                                                                                                                                                sleep 22s
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:475
                                                                                                                                                                                                                                                                                • /usr/bin/timeout
                                                                                                                                                                                                                                                                                  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:502
                                                                                                                                                                                                                                                                                    • ./tsm
                                                                                                                                                                                                                                                                                      ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:503
                                                                                                                                                                                                                                                                                    • /bin/sleep
                                                                                                                                                                                                                                                                                      sleep 3
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:504
                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                        rm -rf "xtr*"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:505
                                                                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                                                                          rm -rf ip
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:506
                                                                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                                                                            rm -rf p
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:507
                                                                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                                                                              rm -rf .out
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:508
                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                rm -rf "/tmp/t*"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                PID:509
                                                                                                                                                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                                                                                                                                                touch v
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:510
                                                                                                                                                                                                                                                                                                • /bin/rm
                                                                                                                                                                                                                                                                                                  rm -rf p
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:511
                                                                                                                                                                                                                                                                                                  • /bin/rm
                                                                                                                                                                                                                                                                                                    rm -rf ip
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:512
                                                                                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                                                                                      rm -rf "xtr*"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:513
                                                                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                                                                        rm -rf a "a.*"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:514
                                                                                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                                                                                          rm -rf b "b.*"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:515

                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Matrix

                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                        Downloads