54989e433d8324c1005c0b561a8c656a98a015d1d36456c545db15e6e44e3e92

Analysis

max time kernel
157s
platform
debian-9_mips
resource
debian9-mipsbe-20231215-en
resource tags

arch:mipsimage:debian9-mipsbe-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19/12/2023, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/c/go
Size

362B
MD5

4faceceaf1d7b32055d19330e199b155
SHA1

2c6aabe2e1c2411f5c906298fc0289134b7662b2
SHA256

7979f1cc7f09d88d182069e0ca8b726772e18e81de69f2b48d7f3330e054b666
SHA512

c68630f428cf21f71924e6f8ad793d54e875faaf95b78b69916acf6a8a505030edaadc4f06572f0c14eee975d8c4a76d36996aa4494ae790f79283616f325cc9

Score

3^/10

Malware Config

Signatures

Writes file to tmp directory 38 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch
File opened for modification	/tmp/.rsync/c/v	touch

/tmp/.rsync/c/go
/tmp/.rsync/c/go
1⤵
PID:725
- /bin/uname
  uname -m
  2⤵
  PID:730
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:731
- /bin/rm
  rm -rf p
  2⤵
  PID:732
- /bin/rm
  rm -rf ip
  2⤵
  PID:734
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:735
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:736
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:737
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:738
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:739
- /bin/sleep
  sleep 3
  2⤵
  PID:740
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:741
- /bin/rm
  rm -rf ip
  2⤵
  PID:742
- /bin/rm
  rm -rf p
  2⤵
  PID:743
- /bin/rm
  rm -rf .out
  2⤵
  PID:744
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:745
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/rm
  rm -rf p
  2⤵
  PID:747
- /bin/rm
  rm -rf ip
  2⤵
  PID:748
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:749
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:750
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:751
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:752
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:753
- /bin/sleep
  sleep 3
  2⤵
  PID:754
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:759
- /bin/rm
  rm -rf ip
  2⤵
  PID:760
- /bin/rm
  rm -rf p
  2⤵
  PID:761
- /bin/rm
  rm -rf .out
  2⤵
  PID:763
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:764
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/rm
  rm -rf p
  2⤵
  PID:767
- /bin/rm
  rm -rf ip
  2⤵
  PID:768
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:769
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:771
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:772
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:774
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:775
- /bin/sleep
  sleep 3
  2⤵
  PID:776
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:797
- /bin/rm
  rm -rf ip
  2⤵
  PID:798
- /bin/rm
  rm -rf p
  2⤵
  PID:799
- /bin/rm
  rm -rf .out
  2⤵
  PID:801
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:802
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:803
- /bin/rm
  rm -rf p
  2⤵
  PID:806
- /bin/rm
  rm -rf ip
  2⤵
  PID:808
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:809
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:810
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:811
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:813
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:814
- /bin/sleep
  sleep 3
  2⤵
  PID:815
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:828
- /bin/rm
  rm -rf ip
  2⤵
  PID:829
- /bin/rm
  rm -rf p
  2⤵
  PID:830
- /bin/rm
  rm -rf .out
  2⤵
  PID:831
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:832
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:833
- /bin/rm
  rm -rf p
  2⤵
  PID:834
- /bin/rm
  rm -rf ip
  2⤵
  PID:835
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:836
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:837
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:841
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:842
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:843
- /bin/sleep
  sleep 3
  2⤵
  PID:844
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:845
- /bin/rm
  rm -rf ip
  2⤵
  PID:846
- /bin/rm
  rm -rf p
  2⤵
  PID:847
- /bin/rm
  rm -rf .out
  2⤵
  PID:848
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:849
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:850
- /bin/rm
  rm -rf p
  2⤵
  PID:851
- /bin/rm
  rm -rf ip
  2⤵
  PID:853
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:855
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:856
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:857
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:858
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:860
- /bin/sleep
  sleep 3
  2⤵
  PID:861
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:882
- /bin/rm
  rm -rf ip
  2⤵
  PID:883
- /bin/rm
  rm -rf p
  2⤵
  PID:885
- /bin/rm
  rm -rf .out
  2⤵
  PID:886
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:887
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:888
- /bin/rm
  rm -rf p
  2⤵
  PID:890
- /bin/rm
  rm -rf ip
  2⤵
  PID:891
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:893
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:894
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:895
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:896
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:898
- /bin/sleep
  sleep 3
  2⤵
  PID:899
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:903
- /bin/rm
  rm -rf ip
  2⤵
  PID:904
- /bin/rm
  rm -rf p
  2⤵
  PID:905
- /bin/rm
  rm -rf .out
  2⤵
  PID:906
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:907
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:908
- /bin/rm
  rm -rf p
  2⤵
  PID:909
- /bin/rm
  rm -rf ip
  2⤵
  PID:910
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:911
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:912
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:913
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:914
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:915
- /bin/sleep
  sleep 3
  2⤵
  PID:916
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:917
- /bin/rm
  rm -rf ip
  2⤵
  PID:918
- /bin/rm
  rm -rf p
  2⤵
  PID:919
- /bin/rm
  rm -rf .out
  2⤵
  PID:920
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:921
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:922
- /bin/rm
  rm -rf p
  2⤵
  PID:923
- /bin/rm
  rm -rf ip
  2⤵
  PID:924
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:925
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:926
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:927
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:928
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:929
- /bin/sleep
  sleep 3
  2⤵
  PID:930
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:931
- /bin/rm
  rm -rf ip
  2⤵
  PID:932
- /bin/rm
  rm -rf p
  2⤵
  PID:933
- /bin/rm
  rm -rf .out
  2⤵
  PID:934
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:935
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:936
- /bin/rm
  rm -rf p
  2⤵
  PID:937
- /bin/rm
  rm -rf ip
  2⤵
  PID:938
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:939
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:940
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:941
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:942
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:943
- /bin/sleep
  sleep 3
  2⤵
  PID:944
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:945
- /bin/rm
  rm -rf ip
  2⤵
  PID:946
- /bin/rm
  rm -rf p
  2⤵
  PID:947
- /bin/rm
  rm -rf .out
  2⤵
  PID:948
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:949
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:950
- /bin/rm
  rm -rf p
  2⤵
  PID:951
- /bin/rm
  rm -rf ip
  2⤵
  PID:952
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:953
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:954
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:955
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:956
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:957
- /bin/sleep
  sleep 3
  2⤵
  PID:958
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:959
- /bin/rm
  rm -rf ip
  2⤵
  PID:960
- /bin/rm
  rm -rf p
  2⤵
  PID:961
- /bin/rm
  rm -rf .out
  2⤵
  PID:962
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:963
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:964
- /bin/rm
  rm -rf p
  2⤵
  PID:965
- /bin/rm
  rm -rf ip
  2⤵
  PID:966
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:967
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:968
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:969
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:970
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:971
- /bin/sleep
  sleep 3
  2⤵
  PID:972
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:973
- /bin/rm
  rm -rf ip
  2⤵
  PID:974
- /bin/rm
  rm -rf p
  2⤵
  PID:975
- /bin/rm
  rm -rf .out
  2⤵
  PID:976
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:977
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:978
- /bin/rm
  rm -rf p
  2⤵
  PID:979
- /bin/rm
  rm -rf ip
  2⤵
  PID:980
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:981
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:982
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:983
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:984
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:985
- /bin/sleep
  sleep 3
  2⤵
  PID:986
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:987
- /bin/rm
  rm -rf ip
  2⤵
  PID:988
- /bin/rm
  rm -rf p
  2⤵
  PID:989
- /bin/rm
  rm -rf .out
  2⤵
  PID:990
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:991
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:992
- /bin/rm
  rm -rf p
  2⤵
  PID:993
- /bin/rm
  rm -rf ip
  2⤵
  PID:994
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:995
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:996
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:997
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:998
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:999
- /bin/sleep
  sleep 3
  2⤵
  PID:1000
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1001
- /bin/rm
  rm -rf ip
  2⤵
  PID:1002
- /bin/rm
  rm -rf p
  2⤵
  PID:1003
- /bin/rm
  rm -rf .out
  2⤵
  PID:1004
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1005
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1006
- /bin/rm
  rm -rf p
  2⤵
  PID:1007
- /bin/rm
  rm -rf ip
  2⤵
  PID:1008
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1009
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1010
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1011
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1012
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1013
- /bin/sleep
  sleep 3
  2⤵
  PID:1014
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1015
- /bin/rm
  rm -rf ip
  2⤵
  PID:1016
- /bin/rm
  rm -rf p
  2⤵
  PID:1017
- /bin/rm
  rm -rf .out
  2⤵
  PID:1018
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1019
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1020
- /bin/rm
  rm -rf p
  2⤵
  PID:1021
- /bin/rm
  rm -rf ip
  2⤵
  PID:1022
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1023
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1024
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1025
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1026
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1027
- /bin/sleep
  sleep 3
  2⤵
  PID:1028
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1029
- /bin/rm
  rm -rf ip
  2⤵
  PID:1030
- /bin/rm
  rm -rf p
  2⤵
  PID:1031
- /bin/rm
  rm -rf .out
  2⤵
  PID:1032
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1033
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1034
- /bin/rm
  rm -rf p
  2⤵
  PID:1035
- /bin/rm
  rm -rf ip
  2⤵
  PID:1036
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1037
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1038
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1039
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1040
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1041
- /bin/sleep
  sleep 3
  2⤵
  PID:1042
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1043
- /bin/rm
  rm -rf ip
  2⤵
  PID:1044
- /bin/rm
  rm -rf p
  2⤵
  PID:1045
- /bin/rm
  rm -rf .out
  2⤵
  PID:1046
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1047
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1048
- /bin/rm
  rm -rf p
  2⤵
  PID:1049
- /bin/rm
  rm -rf ip
  2⤵
  PID:1050
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1051
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1052
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1053
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1054
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1055
- /bin/sleep
  sleep 3
  2⤵
  PID:1056
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1057
- /bin/rm
  rm -rf ip
  2⤵
  PID:1058
- /bin/rm
  rm -rf p
  2⤵
  PID:1059
- /bin/rm
  rm -rf .out
  2⤵
  PID:1060
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1061
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1062
- /bin/rm
  rm -rf p
  2⤵
  PID:1063
- /bin/rm
  rm -rf ip
  2⤵
  PID:1064
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1065
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1066
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1067
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1068
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1069
- /bin/sleep
  sleep 3
  2⤵
  PID:1070
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1071
- /bin/rm
  rm -rf ip
  2⤵
  PID:1072
- /bin/rm
  rm -rf p
  2⤵
  PID:1073
- /bin/rm
  rm -rf .out
  2⤵
  PID:1074
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1075
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1076
- /bin/rm
  rm -rf p
  2⤵
  PID:1077
- /bin/rm
  rm -rf ip
  2⤵
  PID:1078
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1079
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1080
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1081
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1082
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1083
- /bin/sleep
  sleep 3
  2⤵
  PID:1084
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1085
- /bin/rm
  rm -rf ip
  2⤵
  PID:1086
- /bin/rm
  rm -rf p
  2⤵
  PID:1087
- /bin/rm
  rm -rf .out
  2⤵
  PID:1088
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1089
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1090
- /bin/rm
  rm -rf p
  2⤵
  PID:1091
- /bin/rm
  rm -rf ip
  2⤵
  PID:1092
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1093
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1094
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1095
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1096
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1097
- /bin/sleep
  sleep 3
  2⤵
  PID:1098
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1099
- /bin/rm
  rm -rf ip
  2⤵
  PID:1100
- /bin/rm
  rm -rf p
  2⤵
  PID:1101
- /bin/rm
  rm -rf .out
  2⤵
  PID:1102
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1103
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1104
- /bin/rm
  rm -rf p
  2⤵
  PID:1105
- /bin/rm
  rm -rf ip
  2⤵
  PID:1106
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1107
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1108
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1109
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1110
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1111
- /bin/sleep
  sleep 3
  2⤵
  PID:1112
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1113
- /bin/rm
  rm -rf ip
  2⤵
  PID:1114
- /bin/rm
  rm -rf p
  2⤵
  PID:1115
- /bin/rm
  rm -rf .out
  2⤵
  PID:1116
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1117
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1118
- /bin/rm
  rm -rf p
  2⤵
  PID:1119
- /bin/rm
  rm -rf ip
  2⤵
  PID:1120
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1121
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1122
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1123
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1124
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1125
- /bin/sleep
  sleep 3
  2⤵
  PID:1126
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1127
- /bin/rm
  rm -rf ip
  2⤵
  PID:1128
- /bin/rm
  rm -rf p
  2⤵
  PID:1129
- /bin/rm
  rm -rf .out
  2⤵
  PID:1130
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1131
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1132
- /bin/rm
  rm -rf p
  2⤵
  PID:1133
- /bin/rm
  rm -rf ip
  2⤵
  PID:1134
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1135
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1136
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1137
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1138
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1139
- /bin/sleep
  sleep 3
  2⤵
  PID:1140
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1141
- /bin/rm
  rm -rf ip
  2⤵
  PID:1142
- /bin/rm
  rm -rf p
  2⤵
  PID:1143
- /bin/rm
  rm -rf .out
  2⤵
  PID:1144
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1145
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1146
- /bin/rm
  rm -rf p
  2⤵
  PID:1147
- /bin/rm
  rm -rf ip
  2⤵
  PID:1148
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1149
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1150
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1151
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1152
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1153
- /bin/sleep
  sleep 3
  2⤵
  PID:1154
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1155
- /bin/rm
  rm -rf ip
  2⤵
  PID:1156
- /bin/rm
  rm -rf p
  2⤵
  PID:1157
- /bin/rm
  rm -rf .out
  2⤵
  PID:1158
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1159
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1160
- /bin/rm
  rm -rf p
  2⤵
  PID:1161
- /bin/rm
  rm -rf ip
  2⤵
  PID:1162
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1163
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1164
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1165
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1166
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1167
- /bin/sleep
  sleep 3
  2⤵
  PID:1168
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1169
- /bin/rm
  rm -rf ip
  2⤵
  PID:1170
- /bin/rm
  rm -rf p
  2⤵
  PID:1171
- /bin/rm
  rm -rf .out
  2⤵
  PID:1172
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1173
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1174
- /bin/rm
  rm -rf p
  2⤵
  PID:1175
- /bin/rm
  rm -rf ip
  2⤵
  PID:1176
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1177
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1178
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1179
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1180
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1181
- /bin/sleep
  sleep 3
  2⤵
  PID:1182
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1183
- /bin/rm
  rm -rf ip
  2⤵
  PID:1184
- /bin/rm
  rm -rf p
  2⤵
  PID:1185
- /bin/rm
  rm -rf .out
  2⤵
  PID:1186
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1187
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1188
- /bin/rm
  rm -rf p
  2⤵
  PID:1189
- /bin/rm
  rm -rf ip
  2⤵
  PID:1190
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1191
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1192
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1193
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1194
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1195
- /bin/sleep
  sleep 3
  2⤵
  PID:1196
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1197
- /bin/rm
  rm -rf ip
  2⤵
  PID:1198
- /bin/rm
  rm -rf p
  2⤵
  PID:1199
- /bin/rm
  rm -rf .out
  2⤵
  PID:1200
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1201
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1202
- /bin/rm
  rm -rf p
  2⤵
  PID:1203
- /bin/rm
  rm -rf ip
  2⤵
  PID:1204
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1205
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1206
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1207
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1208
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1209
- /bin/sleep
  sleep 3
  2⤵
  PID:1210
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1211
- /bin/rm
  rm -rf ip
  2⤵
  PID:1212
- /bin/rm
  rm -rf p
  2⤵
  PID:1213
- /bin/rm
  rm -rf .out
  2⤵
  PID:1214
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1215
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1216
- /bin/rm
  rm -rf p
  2⤵
  PID:1217
- /bin/rm
  rm -rf ip
  2⤵
  PID:1218
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1219
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1220
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1221
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1222
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1223
- /bin/sleep
  sleep 3
  2⤵
  PID:1224
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1225
- /bin/rm
  rm -rf ip
  2⤵
  PID:1226
- /bin/rm
  rm -rf p
  2⤵
  PID:1227
- /bin/rm
  rm -rf .out
  2⤵
  PID:1228
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1229
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1230
- /bin/rm
  rm -rf p
  2⤵
  PID:1231
- /bin/rm
  rm -rf ip
  2⤵
  PID:1232
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1233
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1234
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1235
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1236
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1237
- /bin/sleep
  sleep 3
  2⤵
  PID:1238
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1239
- /bin/rm
  rm -rf ip
  2⤵
  PID:1240
- /bin/rm
  rm -rf p
  2⤵
  PID:1241
- /bin/rm
  rm -rf .out
  2⤵
  PID:1242
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1243
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1244
- /bin/rm
  rm -rf p
  2⤵
  PID:1245
- /bin/rm
  rm -rf ip
  2⤵
  PID:1246
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1247
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1248
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1249
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1250
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1251
- /bin/sleep
  sleep 3
  2⤵
  PID:1252
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1253
- /bin/rm
  rm -rf ip
  2⤵
  PID:1254
- /bin/rm
  rm -rf p
  2⤵
  PID:1255
- /bin/rm
  rm -rf .out
  2⤵
  PID:1256
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1257
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1258
- /bin/rm
  rm -rf p
  2⤵
  PID:1259
- /bin/rm
  rm -rf ip
  2⤵
  PID:1260
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1261
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1262
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1263
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1264
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1265
- /bin/sleep
  sleep 3
  2⤵
  PID:1266
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1267
- /bin/rm
  rm -rf ip
  2⤵
  PID:1268
- /bin/rm
  rm -rf p
  2⤵
  PID:1269
- /bin/rm
  rm -rf .out
  2⤵
  PID:1270
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1271
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1272
- /bin/rm
  rm -rf p
  2⤵
  PID:1273
- /bin/rm
  rm -rf ip
  2⤵
  PID:1274
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1275
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1276
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1277
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1278
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1279
- /bin/sleep
  sleep 3
  2⤵
  PID:1280
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1281
- /bin/rm
  rm -rf ip
  2⤵
  PID:1282
- /bin/rm
  rm -rf p
  2⤵
  PID:1283
- /bin/rm
  rm -rf .out
  2⤵
  PID:1284
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1285
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1286
- /bin/rm
  rm -rf p
  2⤵
  PID:1287
- /bin/rm
  rm -rf ip
  2⤵
  PID:1288
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1289
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1290
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1291
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1292
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1293
- /bin/sleep
  sleep 3
  2⤵
  PID:1294
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1295
- /bin/rm
  rm -rf ip
  2⤵
  PID:1296
- /bin/rm
  rm -rf p
  2⤵
  PID:1297
- /bin/rm
  rm -rf .out
  2⤵
  PID:1298
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1299
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1300
- /bin/rm
  rm -rf p
  2⤵
  PID:1301
- /bin/rm
  rm -rf ip
  2⤵
  PID:1302
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1303
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1304
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1305
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1306
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1307
- /bin/sleep
  sleep 3
  2⤵
  PID:1308
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1309
- /bin/rm
  rm -rf ip
  2⤵
  PID:1310
- /bin/rm
  rm -rf p
  2⤵
  PID:1311
- /bin/rm
  rm -rf .out
  2⤵
  PID:1312
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1313
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1314
- /bin/rm
  rm -rf p
  2⤵
  PID:1315
- /bin/rm
  rm -rf ip
  2⤵
  PID:1316
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1317
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1318
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1319
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1320
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1321
- /bin/sleep
  sleep 3
  2⤵
  PID:1322
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1323
- /bin/rm
  rm -rf ip
  2⤵
  PID:1324
- /bin/rm
  rm -rf p
  2⤵
  PID:1325
- /bin/rm
  rm -rf .out
  2⤵
  PID:1326
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  PID:1327
- /usr/bin/touch
  touch v
  2⤵
  - Writes file to tmp directory
  PID:1328
- /bin/rm
  rm -rf p
  2⤵
  PID:1329
- /bin/rm
  rm -rf ip
  2⤵
  PID:1330
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:1331
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:1332
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:1333
- /usr/bin/timeout
  timeout 6h ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
  2⤵
  PID:1334
- - /tmp/.rsync/c/tsm
    ./tsm -t 301 -f 1 -s 12 -S 12 -p 0 -d 1 p ip
    3⤵
    PID:1335
- /bin/sleep
  sleep 3
  2⤵
  PID:1336

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads