05724d24487493904a39633fec07cc0110ee3c1cfe47d0cd1508a3ff68edf322

Analysis

max time kernel
24s
platform
debian-9_armhf
resource
debian9-armhf-20231215-en
resource tags

arch:armhfimage:debian9-armhf-20231215-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22-12-2023 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gosh/scam
Size

4KB
MD5

5c878c64f37185a368eac850e748ca28
SHA1

67179b79b85ea4c8a68b3fa5989fa0586ba59cb3
SHA256

65f7062a00c89eab78d87087af9f6fcf89a781af717d449731b0c104ee1d5652
SHA512

f803b78b5a028068b6e67123abea53daa007fbbd5f08c34ccd63e1ac782797535c44262c1b212498bf38511bacc89216e69a2820cebdf523ede7bc404155305f
SSDEEP

96:XWtsfqymUyp8zW9wnqoZpIo2baUrKhI/uVcTR6bEkIev45CC5MDmNA36Rnw9Wz8V:TfqGeHbmf

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	uptime

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/976/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/112/stat	killall
File opened for reading	/proc/638/stat	killall
File opened for reading	/proc/933/stat	killall
File opened for reading	/proc/633/cmdline	killall
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/102/stat	killall
File opened for reading	/proc/272/stat	killall
File opened for reading	/proc/filesystems	uptime
File opened for reading	/proc/142/stat	killall
File opened for reading	/proc/594/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/152/cmdline	killall
File opened for reading	/proc/636/stat	killall
File opened for reading	/proc/915/cmdline	killall
File opened for reading	/proc/980/stat	killall
File opened for reading	/proc/270/stat	killall
File opened for reading	/proc/633/stat	killall
File opened for reading	/proc/664/stat	killall
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/300/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/933/cmdline	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/155/stat	killall
File opened for reading	/proc/220/stat	killall
File opened for reading	/proc/311/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/143/stat	killall
File opened for reading	/proc/274/stat	killall
File opened for reading	/proc/578/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/971/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/113/cmdline	killall
File opened for reading	/proc/170/stat	killall
File opened for reading	/proc/289/stat	killall
File opened for reading	/proc/915/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/152/stat	killall
File opened for reading	/proc/317/stat	killall
File opened for reading	/proc/639/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/110/stat	killall

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/gosh/info2	scam
File opened for modification	/tmp/gosh/info2	Process not Found

/tmp/gosh/scam
/tmp/gosh/scam
1⤵
- Writes file to tmp directory
PID:661
- /sbin/ifconfig
  /sbin/ifconfig -a
  2⤵
  PID:662
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:667
- /bin/uname
  uname -a
  2⤵
  PID:670
- /bin/cat
  cat /etc/issue
  2⤵
  PID:671
- /bin/cat
  cat /etc/passwd
  2⤵
  PID:672
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:673
- /bin/df
  df -h
  2⤵
  PID:675
- /bin/rm
  rm -rf info2
  2⤵
  PID:676
- /usr/bin/clear
  clear
  2⤵
  PID:677
- /tmp/gosh/a
  ./a .0
  2⤵
  PID:678
- /tmp/gosh/a
  ./a .1
  2⤵
  PID:679
- /tmp/gosh/a
  ./a .2
  2⤵
  PID:680
- /tmp/gosh/a
  ./a .3
  2⤵
  PID:681
- /tmp/gosh/a
  ./a .4
  2⤵
  PID:682
- /tmp/gosh/a
  ./a .5
  2⤵
  PID:683
- /tmp/gosh/a
  ./a .6
  2⤵
  PID:684
- /tmp/gosh/a
  ./a .7
  2⤵
  PID:685
- /tmp/gosh/a
  ./a .8
  2⤵
  PID:686
- /tmp/gosh/a
  ./a .9
  2⤵
  PID:687
- /tmp/gosh/a
  ./a .10
  2⤵
  PID:688
- /tmp/gosh/a
  ./a .11
  2⤵
  PID:689
- /tmp/gosh/a
  ./a .12
  2⤵
  PID:690
- /tmp/gosh/a
  ./a .13
  2⤵
  PID:691
- /tmp/gosh/a
  ./a .14
  2⤵
  PID:692
- /tmp/gosh/a
  ./a .15
  2⤵
  PID:693
- /tmp/gosh/a
  ./a .16
  2⤵
  PID:694
- /tmp/gosh/a
  ./a .17
  2⤵
  PID:695
- /tmp/gosh/a
  ./a .18
  2⤵
  PID:696
- /tmp/gosh/a
  ./a .19
  2⤵
  PID:697
- /tmp/gosh/a
  ./a .20
  2⤵
  PID:698
- /tmp/gosh/a
  ./a .21
  2⤵
  PID:699
- /tmp/gosh/a
  ./a .22
  2⤵
  PID:700
- /tmp/gosh/a
  ./a .23
  2⤵
  PID:701
- /tmp/gosh/a
  ./a .24
  2⤵
  PID:702
- /tmp/gosh/a
  ./a .25
  2⤵
  PID:703
- /tmp/gosh/a
  ./a .26
  2⤵
  PID:704
- /tmp/gosh/a
  ./a .27
  2⤵
  PID:705
- /tmp/gosh/a
  ./a .28
  2⤵
  PID:706
- /tmp/gosh/a
  ./a .29
  2⤵
  PID:707
- /tmp/gosh/a
  ./a .30
  2⤵
  PID:708
- /tmp/gosh/a
  ./a .31
  2⤵
  PID:709
- /tmp/gosh/a
  ./a .32
  2⤵
  PID:710
- /tmp/gosh/a
  ./a .33
  2⤵
  PID:711
- /tmp/gosh/a
  ./a .34
  2⤵
  PID:712
- /tmp/gosh/a
  ./a .35
  2⤵
  PID:713
- /tmp/gosh/a
  ./a .36
  2⤵
  PID:714
- /tmp/gosh/a
  ./a .37
  2⤵
  PID:715
- /tmp/gosh/a
  ./a .38
  2⤵
  PID:716
- /tmp/gosh/a
  ./a .39
  2⤵
  PID:717
- /tmp/gosh/a
  ./a .40
  2⤵
  PID:718
- /tmp/gosh/a
  ./a .41
  2⤵
  PID:719
- /tmp/gosh/a
  ./a .42
  2⤵
  PID:720
- /tmp/gosh/a
  ./a .43
  2⤵
  PID:721
- /tmp/gosh/a
  ./a .44
  2⤵
  PID:722
- /tmp/gosh/a
  ./a .45
  2⤵
  PID:723
- /tmp/gosh/a
  ./a .46
  2⤵
  PID:724
- /tmp/gosh/a
  ./a .47
  2⤵
  PID:725
- /tmp/gosh/a
  ./a .48
  2⤵
  PID:726
- /tmp/gosh/a
  ./a .49
  2⤵
  PID:727
- /tmp/gosh/a
  ./a .50
  2⤵
  PID:728
- /tmp/gosh/a
  ./a .51
  2⤵
  PID:729
- /tmp/gosh/a
  ./a .52
  2⤵
  PID:730
- /tmp/gosh/a
  ./a .53
  2⤵
  PID:731
- /tmp/gosh/a
  ./a .54
  2⤵
  PID:732
- /tmp/gosh/a
  ./a .55
  2⤵
  PID:733
- /tmp/gosh/a
  ./a .56
  2⤵
  PID:734
- /tmp/gosh/a
  ./a .57
  2⤵
  PID:735
- /tmp/gosh/a
  ./a .58
  2⤵
  PID:736
- /tmp/gosh/a
  ./a .59
  2⤵
  PID:737
- /tmp/gosh/a
  ./a .60
  2⤵
  PID:739
- /tmp/gosh/a
  ./a .61
  2⤵
  PID:740
- /tmp/gosh/a
  ./a .62
  2⤵
  PID:742
- /tmp/gosh/a
  ./a .63
  2⤵
  PID:743
- /tmp/gosh/a
  ./a .64
  2⤵
  PID:744
- /tmp/gosh/a
  ./a .65
  2⤵
  PID:745
- /tmp/gosh/a
  ./a .66
  2⤵
  PID:746
- /tmp/gosh/a
  ./a .67
  2⤵
  PID:747
- /tmp/gosh/a
  ./a .68
  2⤵
  PID:748
- /tmp/gosh/a
  ./a .69
  2⤵
  PID:750
- /tmp/gosh/a
  ./a .70
  2⤵
  PID:751
- /tmp/gosh/a
  ./a .71
  2⤵
  PID:752
- /tmp/gosh/a
  ./a .72
  2⤵
  PID:753
- /tmp/gosh/a
  ./a .73
  2⤵
  PID:755
- /tmp/gosh/a
  ./a .74
  2⤵
  PID:756
- /tmp/gosh/a
  ./a .75
  2⤵
  PID:757
- /tmp/gosh/a
  ./a .76
  2⤵
  PID:758
- /tmp/gosh/a
  ./a .77
  2⤵
  PID:759
- /tmp/gosh/a
  ./a .78
  2⤵
  PID:760
- /tmp/gosh/a
  ./a .79
  2⤵
  PID:761
- /tmp/gosh/a
  ./a .80
  2⤵
  PID:763
- /tmp/gosh/a
  ./a .81
  2⤵
  PID:764
- /tmp/gosh/a
  ./a .82
  2⤵
  PID:765
- /tmp/gosh/a
  ./a .83
  2⤵
  PID:766
- /tmp/gosh/a
  ./a .84
  2⤵
  PID:768
- /tmp/gosh/a
  ./a .85
  2⤵
  PID:769
- /tmp/gosh/a
  ./a .86
  2⤵
  PID:770
- /tmp/gosh/a
  ./a .87
  2⤵
  PID:771
- /tmp/gosh/a
  ./a .88
  2⤵
  PID:772
- /tmp/gosh/a
  ./a .89
  2⤵
  PID:773
- /tmp/gosh/a
  ./a .90
  2⤵
  PID:774
- /tmp/gosh/a
  ./a .91
  2⤵
  PID:776
- /tmp/gosh/a
  ./a .92
  2⤵
  PID:777
- /tmp/gosh/a
  ./a .93
  2⤵
  PID:778
- /tmp/gosh/a
  ./a .94
  2⤵
  PID:780
- /tmp/gosh/a
  ./a .95
  2⤵
  PID:781
- /tmp/gosh/a
  ./a .96
  2⤵
  PID:782
- /tmp/gosh/a
  ./a .97
  2⤵
  PID:783
- /tmp/gosh/a
  ./a .98
  2⤵
  PID:784
- /tmp/gosh/a
  ./a .99
  2⤵
  PID:785
- /tmp/gosh/a
  ./a .100
  2⤵
  PID:786
- /tmp/gosh/a
  ./a .101
  2⤵
  PID:788
- /tmp/gosh/a
  ./a .102
  2⤵
  PID:789
- /tmp/gosh/a
  ./a .103
  2⤵
  PID:790
- /tmp/gosh/a
  ./a .104
  2⤵
  PID:791
- /tmp/gosh/a
  ./a .105
  2⤵
  PID:793
- /tmp/gosh/a
  ./a .106
  2⤵
  PID:794
- /tmp/gosh/a
  ./a .107
  2⤵
  PID:795
- /tmp/gosh/a
  ./a .108
  2⤵
  PID:796
- /tmp/gosh/a
  ./a .109
  2⤵
  PID:797
- /tmp/gosh/a
  ./a .110
  2⤵
  PID:798
- /tmp/gosh/a
  ./a .111
  2⤵
  PID:800
- /tmp/gosh/a
  ./a .112
  2⤵
  PID:801
- /tmp/gosh/a
  ./a .113
  2⤵
  PID:802
- /tmp/gosh/a
  ./a .114
  2⤵
  PID:803
- /tmp/gosh/a
  ./a .115
  2⤵
  PID:804
- /tmp/gosh/a
  ./a .116
  2⤵
  PID:806
- /tmp/gosh/a
  ./a .117
  2⤵
  PID:807
- /tmp/gosh/a
  ./a .118
  2⤵
  PID:808
- /tmp/gosh/a
  ./a .119
  2⤵
  PID:809
- /tmp/gosh/a
  ./a .120
  2⤵
  PID:810
- /tmp/gosh/a
  ./a .121
  2⤵
  PID:811
- /tmp/gosh/a
  ./a .122
  2⤵
  PID:813
- /tmp/gosh/a
  ./a .123
  2⤵
  PID:814
- /tmp/gosh/a
  ./a .124
  2⤵
  PID:815
- /tmp/gosh/a
  ./a .125
  2⤵
  PID:816
- /tmp/gosh/a
  ./a .126
  2⤵
  PID:818
- /tmp/gosh/a
  ./a .127
  2⤵
  PID:819
- /tmp/gosh/a
  ./a .128
  2⤵
  PID:820
- /tmp/gosh/a
  ./a .129
  2⤵
  PID:821
- /tmp/gosh/a
  ./a .13
  2⤵
  PID:822
- /tmp/gosh/a
  ./a .131
  2⤵
  PID:823
- /tmp/gosh/a
  ./a .132
  2⤵
  PID:824
- /tmp/gosh/a
  ./a .133
  2⤵
  PID:826
- /tmp/gosh/a
  ./a .134
  2⤵
  PID:827
- /tmp/gosh/a
  ./a .135
  2⤵
  PID:828
- /tmp/gosh/a
  ./a .136
  2⤵
  PID:829
- /tmp/gosh/a
  ./a .137
  2⤵
  PID:831
- /tmp/gosh/a
  ./a .138
  2⤵
  PID:832
- /tmp/gosh/a
  ./a .139
  2⤵
  PID:833
- /tmp/gosh/a
  ./a .140
  2⤵
  PID:834
- /tmp/gosh/a
  ./a .141
  2⤵
  PID:835
- /tmp/gosh/a
  ./a .142
  2⤵
  PID:836
- /tmp/gosh/a
  ./a .143
  2⤵
  PID:837
- /tmp/gosh/a
  ./a .144
  2⤵
  PID:839
- /tmp/gosh/a
  ./a .145
  2⤵
  PID:840
- /tmp/gosh/a
  ./a .146
  2⤵
  PID:841
- /tmp/gosh/a
  ./a .147
  2⤵
  PID:843
- /tmp/gosh/a
  ./a .148
  2⤵
  PID:844
- /tmp/gosh/a
  ./a .149
  2⤵
  PID:845
- /tmp/gosh/a
  ./a .150
  2⤵
  PID:846
- /tmp/gosh/a
  ./a .151
  2⤵
  PID:847
- /tmp/gosh/a
  ./a .152
  2⤵
  PID:848
- /tmp/gosh/a
  ./a .153
  2⤵
  PID:849
- /tmp/gosh/a
  ./a .154
  2⤵
  PID:851
- /tmp/gosh/a
  ./a .155
  2⤵
  PID:852
- /tmp/gosh/a
  ./a .156
  2⤵
  PID:853
- /tmp/gosh/a
  ./a .157
  2⤵
  PID:854
- /tmp/gosh/a
  ./a .158
  2⤵
  PID:856
- /tmp/gosh/a
  ./a .159
  2⤵
  PID:857
- /tmp/gosh/a
  ./a .160
  2⤵
  PID:858
- /tmp/gosh/a
  ./a .161
  2⤵
  PID:859
- /tmp/gosh/a
  ./a .162
  2⤵
  PID:860
- /tmp/gosh/a
  ./a .163
  2⤵
  PID:861
- /tmp/gosh/a
  ./a .164
  2⤵
  PID:862
- /tmp/gosh/a
  ./a .165
  2⤵
  PID:864
- /tmp/gosh/a
  ./a .166
  2⤵
  PID:865
- /tmp/gosh/a
  ./a .167
  2⤵
  PID:866
- /tmp/gosh/a
  ./a .168
  2⤵
  PID:868
- /tmp/gosh/a
  ./a .169
  2⤵
  PID:869
- /tmp/gosh/a
  ./a .170
  2⤵
  PID:870
- /tmp/gosh/a
  ./a .171
  2⤵
  PID:871
- /tmp/gosh/a
  ./a .172
  2⤵
  PID:872
- /tmp/gosh/a
  ./a .173
  2⤵
  PID:873
- /tmp/gosh/a
  ./a .174
  2⤵
  PID:874
- /tmp/gosh/a
  ./a .175
  2⤵
  PID:876
- /tmp/gosh/a
  ./a .176
  2⤵
  PID:877
- /tmp/gosh/a
  ./a .177
  2⤵
  PID:878
- /tmp/gosh/a
  ./a .178
  2⤵
  PID:879
- /tmp/gosh/a
  ./a .179
  2⤵
  PID:881
- /tmp/gosh/a
  ./a .180
  2⤵
  PID:882
- /tmp/gosh/a
  ./a .181
  2⤵
  PID:883
- /tmp/gosh/a
  ./a .182
  2⤵
  PID:884
- /tmp/gosh/a
  ./a .183
  2⤵
  PID:885
- /tmp/gosh/a
  ./a .184
  2⤵
  PID:886
- /tmp/gosh/a
  ./a .185
  2⤵
  PID:888
- /tmp/gosh/a
  ./a .186
  2⤵
  PID:889
- /tmp/gosh/a
  ./a .187
  2⤵
  PID:890
- /tmp/gosh/a
  ./a .188
  2⤵
  PID:892
- /tmp/gosh/a
  ./a .189
  2⤵
  PID:893
- /tmp/gosh/a
  ./a .190
  2⤵
  PID:894
- /tmp/gosh/a
  ./a .191
  2⤵
  PID:895
- /tmp/gosh/a
  ./a .192
  2⤵
  PID:896
- /tmp/gosh/a
  ./a .193
  2⤵
  PID:897
- /tmp/gosh/a
  ./a .194
  2⤵
  PID:898
- /tmp/gosh/a
  ./a .195
  2⤵
  PID:900
- /tmp/gosh/a
  ./a .196
  2⤵
  PID:901
- /tmp/gosh/a
  ./a .197
  2⤵
  PID:902
- /tmp/gosh/a
  ./a .198
  2⤵
  PID:904
- /tmp/gosh/a
  ./a .199
  2⤵
  PID:905
- /tmp/gosh/a
  ./a .200
  2⤵
  PID:906
- /tmp/gosh/a
  ./a .201
  2⤵
  PID:907
- /tmp/gosh/a
  ./a .202
  2⤵
  PID:908
- /tmp/gosh/a
  ./a .203
  2⤵
  PID:909
- /tmp/gosh/a
  ./a .204
  2⤵
  PID:911
- /tmp/gosh/a
  ./a .205
  2⤵
  PID:912
- /tmp/gosh/a
  ./a .206
  2⤵
  PID:913
- /tmp/gosh/a
  ./a .207
  2⤵
  PID:916
- /tmp/gosh/a
  ./a .208
  2⤵
  PID:917
- /tmp/gosh/a
  ./a .209
  2⤵
  PID:918
- /tmp/gosh/a
  ./a .210
  2⤵
  PID:920
- /tmp/gosh/a
  ./a .211
  2⤵
  PID:921
- /tmp/gosh/a
  ./a .212
  2⤵
  PID:922
- /tmp/gosh/a
  ./a .213
  2⤵
  PID:923
- /tmp/gosh/a
  ./a .214
  2⤵
  PID:924
- /tmp/gosh/a
  ./a .215
  2⤵
  PID:925
- /tmp/gosh/a
  ./a .216
  2⤵
  PID:927
- /tmp/gosh/a
  ./a .217
  2⤵
  PID:928
- /tmp/gosh/a
  ./a .218
  2⤵
  PID:929
- /tmp/gosh/a
  ./a .219
  2⤵
  PID:930
- /tmp/gosh/a
  ./a .220
  2⤵
  PID:932
- /tmp/gosh/a
  ./a .221
  2⤵
  PID:934
- /tmp/gosh/a
  ./a .222
  2⤵
  PID:935
- /tmp/gosh/a
  ./a .223
  2⤵
  PID:936
- /tmp/gosh/a
  ./a .224
  2⤵
  PID:938
- /tmp/gosh/a
  ./a .225
  2⤵
  PID:939
- /tmp/gosh/a
  ./a .226
  2⤵
  PID:941
- /tmp/gosh/a
  ./a .227
  2⤵
  PID:943
- /tmp/gosh/a
  ./a .228
  2⤵
  PID:944
- /tmp/gosh/a
  ./a .229
  2⤵
  PID:945
- /tmp/gosh/a
  ./a .230
  2⤵
  PID:946
- /tmp/gosh/a
  ./a .231
  2⤵
  PID:947
- /tmp/gosh/a
  ./a .232
  2⤵
  PID:948
- /tmp/gosh/a
  ./a .233
  2⤵
  PID:949
- /tmp/gosh/a
  ./a .234
  2⤵
  PID:951
- /tmp/gosh/a
  ./a .235
  2⤵
  PID:952
- /tmp/gosh/a
  ./a .236
  2⤵
  PID:953
- /tmp/gosh/a
  ./a .237
  2⤵
  PID:955
- /tmp/gosh/a
  ./a .238
  2⤵
  PID:956
- /tmp/gosh/a
  ./a .239
  2⤵
  PID:957
- /tmp/gosh/a
  ./a .240
  2⤵
  PID:958
- /tmp/gosh/a
  ./a .241
  2⤵
  PID:959
- /tmp/gosh/a
  ./a .242
  2⤵
  PID:960
- /tmp/gosh/a
  ./a .243
  2⤵
  PID:961
- /tmp/gosh/a
  ./a .244
  2⤵
  PID:963
- /tmp/gosh/a
  ./a .245
  2⤵
  PID:964
- /tmp/gosh/a
  ./a .246
  2⤵
  PID:965
- /tmp/gosh/a
  ./a .247
  2⤵
  PID:966
- /tmp/gosh/a
  ./a .248
  2⤵
  PID:967
- /tmp/gosh/a
  ./a .249
  2⤵
  PID:969
- /tmp/gosh/a
  ./a .250
  2⤵
  PID:970
- /tmp/gosh/a
  ./a .251
  2⤵
  PID:972
- /tmp/gosh/a
  ./a .252
  2⤵
  PID:973
- /tmp/gosh/a
  ./a .253
  2⤵
  PID:975
- /tmp/gosh/a
  ./a .254
  2⤵
  PID:977
- /tmp/gosh/a
  ./a .255
  2⤵
  PID:978
- /usr/bin/killall
  killall -9 a
  2⤵
  - Reads runtime system information
  PID:979

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/gosh/info2

Filesize
85B

MD5
68e6530a51c4c7bf17dcf7051a6be710

SHA1
81380900211b5eca427f5632ff97cfd91eaaf7eb

SHA256
0b17dee730444d635adf2892a570927015e1bac71bf869df56bf25d104b1f529

SHA512
a103bbcdee57bafed8aa53eb08723aa1653e6e426e66ab6a1aca2e43f94200a2efd9288b0f51f67cc350beb08eb9648432e05feaca95f80179d6701c95b577e0

Download Submit
/tmp/gosh/info2

Filesize
147B

MD5
29aabf70c5f29e0aa9cc51114f6165b2

SHA1
adc571e5a33b32081e99d0ec37117318e67c759f

SHA256
a145e536d2361bb5d08b296a6f5cc40b05e27439fe2e9f0b3c2908e089625057

SHA512
dc16919135b779046cc22f295325046c9ff320a09e2104e4d7f8a73edb8e28b5fb1b4e40a9548eae3882734ee727a5d7b712f7d6f67f5b7c7418dbf11ed9f1d3

Download Submit
/tmp/gosh/info2

Filesize
180B

MD5
106fd673630410e0bb8afc5ac8569afa

SHA1
5bf54576565ce6bde8b43501b487174e1083508c

SHA256
51f829e816e5ddee23626af8d6ea7a31e16be709c5bfaa638f1c63252e023617

SHA512
a9af06ad05d3101af3b196872bd49b043663a30112f82de8f706602331eab5a6cd150fa7cbed2283e3bbf7b8faea12f89660fcf7251dae2b48f6fbd59d90020b

Download Submit
/tmp/gosh/info2

Filesize
2KB

MD5
3d2fd9b2af6472bd6a868192fd0dca9e

SHA1
95a7791b3b55e805cb0e5fb5175212da406174e7

SHA256
5fa92525a55017954792e3416874aacbb854dbd536480491388ef4ee4f772426

SHA512
1bf7a713c047d0ea12426f535c1b4d4434c4443201756fdc7912ce58fc27598e6d62f0e0b495d058d34740a38e6a0106b64e9f39bf5bdebebfd54516857dd997

Download Submit