05724d24487493904a39633fec07cc0110ee3c1cfe47d0cd1508a3ff68edf322

Analysis

max time kernel
19s
platform
debian-9_mipsel
resource
debian9-mipsel-20231215-en
resource tags

arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22-12-2023 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gosh/scam
Size

4KB
MD5

5c878c64f37185a368eac850e748ca28
SHA1

67179b79b85ea4c8a68b3fa5989fa0586ba59cb3
SHA256

65f7062a00c89eab78d87087af9f6fcf89a781af717d449731b0c104ee1d5652
SHA512

f803b78b5a028068b6e67123abea53daa007fbbd5f08c34ccd63e1ac782797535c44262c1b212498bf38511bacc89216e69a2820cebdf523ede7bc404155305f
SSDEEP

96:XWtsfqymUyp8zW9wnqoZpIo2baUrKhI/uVcTR6bEkIev45CC5MDmNA36Rnw9Wz8V:TfqGeHbmf

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	uptime

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/324/stat	killall
File opened for reading	/proc/575/stat	killall
File opened for reading	/proc/703/stat	killall
File opened for reading	/proc/filesystems	uptime
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/699/stat	killall
File opened for reading	/proc/680/stat	killall
File opened for reading	/proc/695/cmdline	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/372/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/536/stat	killall
File opened for reading	/proc/695/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/521/stat	killall
File opened for reading	/proc/703/cmdline	killall
File opened for reading	/proc/719/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/992/stat	killall
File opened for reading	/proc/315/stat	killall
File opened for reading	/proc/317/stat	killall
File opened for reading	/proc/694/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/149/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/382/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/574/stat	killall
File opened for reading	/proc/697/stat	killall
File opened for reading	/proc/700/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/115/cmdline	killall
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/399/stat	killall
File opened for reading	/proc/104/stat	killall
File opened for reading	/proc/115/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/145/stat	killall
File opened for reading	/proc/226/stat	killall
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/69/stat	killall

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/gosh/info2	scam
File opened for modification	/tmp/gosh/info2	Process not Found

/tmp/gosh/scam
/tmp/gosh/scam
1⤵
- Writes file to tmp directory
PID:719
- /sbin/ifconfig
  /sbin/ifconfig -a
  2⤵
  PID:723
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:727
- /bin/uname
  uname -a
  2⤵
  PID:729
- /bin/cat
  cat /etc/issue
  2⤵
  PID:730
- /bin/cat
  cat /etc/passwd
  2⤵
  PID:731
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:733
- /bin/df
  df -h
  2⤵
  PID:734
- /bin/rm
  rm -rf info2
  2⤵
  PID:735
- /usr/bin/clear
  clear
  2⤵
  PID:736
- /tmp/gosh/a
  ./a .0
  2⤵
  PID:737
- /tmp/gosh/a
  ./a .1
  2⤵
  PID:739
- /tmp/gosh/a
  ./a .2
  2⤵
  PID:740
- /tmp/gosh/a
  ./a .3
  2⤵
  PID:741
- /tmp/gosh/a
  ./a .4
  2⤵
  PID:742
- /tmp/gosh/a
  ./a .5
  2⤵
  PID:743
- /tmp/gosh/a
  ./a .6
  2⤵
  PID:744
- /tmp/gosh/a
  ./a .7
  2⤵
  PID:745
- /tmp/gosh/a
  ./a .8
  2⤵
  PID:746
- /tmp/gosh/a
  ./a .9
  2⤵
  PID:747
- /tmp/gosh/a
  ./a .10
  2⤵
  PID:748
- /tmp/gosh/a
  ./a .11
  2⤵
  PID:749
- /tmp/gosh/a
  ./a .12
  2⤵
  PID:750
- /tmp/gosh/a
  ./a .13
  2⤵
  PID:751
- /tmp/gosh/a
  ./a .14
  2⤵
  PID:752
- /tmp/gosh/a
  ./a .15
  2⤵
  PID:753
- /tmp/gosh/a
  ./a .16
  2⤵
  PID:754
- /tmp/gosh/a
  ./a .17
  2⤵
  PID:755
- /tmp/gosh/a
  ./a .18
  2⤵
  PID:756
- /tmp/gosh/a
  ./a .19
  2⤵
  PID:757
- /tmp/gosh/a
  ./a .20
  2⤵
  PID:758
- /tmp/gosh/a
  ./a .21
  2⤵
  PID:759
- /tmp/gosh/a
  ./a .22
  2⤵
  PID:760
- /tmp/gosh/a
  ./a .23
  2⤵
  PID:761
- /tmp/gosh/a
  ./a .24
  2⤵
  PID:762
- /tmp/gosh/a
  ./a .25
  2⤵
  PID:763
- /tmp/gosh/a
  ./a .26
  2⤵
  PID:764
- /tmp/gosh/a
  ./a .27
  2⤵
  PID:765
- /tmp/gosh/a
  ./a .28
  2⤵
  PID:766
- /tmp/gosh/a
  ./a .29
  2⤵
  PID:767
- /tmp/gosh/a
  ./a .30
  2⤵
  PID:768
- /tmp/gosh/a
  ./a .31
  2⤵
  PID:769
- /tmp/gosh/a
  ./a .32
  2⤵
  PID:770
- /tmp/gosh/a
  ./a .33
  2⤵
  PID:771
- /tmp/gosh/a
  ./a .34
  2⤵
  PID:772
- /tmp/gosh/a
  ./a .35
  2⤵
  PID:773
- /tmp/gosh/a
  ./a .36
  2⤵
  PID:774
- /tmp/gosh/a
  ./a .37
  2⤵
  PID:775
- /tmp/gosh/a
  ./a .38
  2⤵
  PID:776
- /tmp/gosh/a
  ./a .39
  2⤵
  PID:777
- /tmp/gosh/a
  ./a .40
  2⤵
  PID:778
- /tmp/gosh/a
  ./a .41
  2⤵
  PID:779
- /tmp/gosh/a
  ./a .42
  2⤵
  PID:780
- /tmp/gosh/a
  ./a .43
  2⤵
  PID:781
- /tmp/gosh/a
  ./a .44
  2⤵
  PID:782
- /tmp/gosh/a
  ./a .45
  2⤵
  PID:783
- /tmp/gosh/a
  ./a .46
  2⤵
  PID:784
- /tmp/gosh/a
  ./a .47
  2⤵
  PID:785
- /tmp/gosh/a
  ./a .48
  2⤵
  PID:786
- /tmp/gosh/a
  ./a .49
  2⤵
  PID:787
- /tmp/gosh/a
  ./a .50
  2⤵
  PID:788
- /tmp/gosh/a
  ./a .51
  2⤵
  PID:789
- /tmp/gosh/a
  ./a .52
  2⤵
  PID:790
- /tmp/gosh/a
  ./a .53
  2⤵
  PID:791
- /tmp/gosh/a
  ./a .54
  2⤵
  PID:792
- /tmp/gosh/a
  ./a .55
  2⤵
  PID:793
- /tmp/gosh/a
  ./a .56
  2⤵
  PID:794
- /tmp/gosh/a
  ./a .57
  2⤵
  PID:795
- /tmp/gosh/a
  ./a .58
  2⤵
  PID:796
- /tmp/gosh/a
  ./a .59
  2⤵
  PID:797
- /tmp/gosh/a
  ./a .60
  2⤵
  PID:798
- /tmp/gosh/a
  ./a .61
  2⤵
  PID:799
- /tmp/gosh/a
  ./a .62
  2⤵
  PID:800
- /tmp/gosh/a
  ./a .63
  2⤵
  PID:801
- /tmp/gosh/a
  ./a .64
  2⤵
  PID:802
- /tmp/gosh/a
  ./a .65
  2⤵
  PID:803
- /tmp/gosh/a
  ./a .66
  2⤵
  PID:804
- /tmp/gosh/a
  ./a .67
  2⤵
  PID:805
- /tmp/gosh/a
  ./a .68
  2⤵
  PID:806
- /tmp/gosh/a
  ./a .69
  2⤵
  PID:807
- /tmp/gosh/a
  ./a .70
  2⤵
  PID:808
- /tmp/gosh/a
  ./a .71
  2⤵
  PID:809
- /tmp/gosh/a
  ./a .72
  2⤵
  PID:810
- /tmp/gosh/a
  ./a .73
  2⤵
  PID:811
- /tmp/gosh/a
  ./a .74
  2⤵
  PID:812
- /tmp/gosh/a
  ./a .75
  2⤵
  PID:813
- /tmp/gosh/a
  ./a .76
  2⤵
  PID:814
- /tmp/gosh/a
  ./a .77
  2⤵
  PID:815
- /tmp/gosh/a
  ./a .78
  2⤵
  PID:816
- /tmp/gosh/a
  ./a .79
  2⤵
  PID:817
- /tmp/gosh/a
  ./a .80
  2⤵
  PID:818
- /tmp/gosh/a
  ./a .81
  2⤵
  PID:819
- /tmp/gosh/a
  ./a .82
  2⤵
  PID:820
- /tmp/gosh/a
  ./a .83
  2⤵
  PID:821
- /tmp/gosh/a
  ./a .84
  2⤵
  PID:822
- /tmp/gosh/a
  ./a .85
  2⤵
  PID:823
- /tmp/gosh/a
  ./a .86
  2⤵
  PID:824
- /tmp/gosh/a
  ./a .87
  2⤵
  PID:825
- /tmp/gosh/a
  ./a .88
  2⤵
  PID:826
- /tmp/gosh/a
  ./a .89
  2⤵
  PID:827
- /tmp/gosh/a
  ./a .90
  2⤵
  PID:828
- /tmp/gosh/a
  ./a .91
  2⤵
  PID:829
- /tmp/gosh/a
  ./a .92
  2⤵
  PID:830
- /tmp/gosh/a
  ./a .93
  2⤵
  PID:831
- /tmp/gosh/a
  ./a .94
  2⤵
  PID:832
- /tmp/gosh/a
  ./a .95
  2⤵
  PID:833
- /tmp/gosh/a
  ./a .96
  2⤵
  PID:834
- /tmp/gosh/a
  ./a .97
  2⤵
  PID:835
- /tmp/gosh/a
  ./a .98
  2⤵
  PID:836
- /tmp/gosh/a
  ./a .99
  2⤵
  PID:837
- /tmp/gosh/a
  ./a .100
  2⤵
  PID:838
- /tmp/gosh/a
  ./a .101
  2⤵
  PID:839
- /tmp/gosh/a
  ./a .102
  2⤵
  PID:840
- /tmp/gosh/a
  ./a .103
  2⤵
  PID:841
- /tmp/gosh/a
  ./a .104
  2⤵
  PID:842
- /tmp/gosh/a
  ./a .105
  2⤵
  PID:843
- /tmp/gosh/a
  ./a .106
  2⤵
  PID:844
- /tmp/gosh/a
  ./a .107
  2⤵
  PID:845
- /tmp/gosh/a
  ./a .108
  2⤵
  PID:846
- /tmp/gosh/a
  ./a .109
  2⤵
  PID:847
- /tmp/gosh/a
  ./a .110
  2⤵
  PID:848
- /tmp/gosh/a
  ./a .111
  2⤵
  PID:849
- /tmp/gosh/a
  ./a .112
  2⤵
  PID:850
- /tmp/gosh/a
  ./a .113
  2⤵
  PID:851
- /tmp/gosh/a
  ./a .114
  2⤵
  PID:852
- /tmp/gosh/a
  ./a .115
  2⤵
  PID:853
- /tmp/gosh/a
  ./a .116
  2⤵
  PID:854
- /tmp/gosh/a
  ./a .117
  2⤵
  PID:855
- /tmp/gosh/a
  ./a .118
  2⤵
  PID:856
- /tmp/gosh/a
  ./a .119
  2⤵
  PID:857
- /tmp/gosh/a
  ./a .120
  2⤵
  PID:858
- /tmp/gosh/a
  ./a .121
  2⤵
  PID:859
- /tmp/gosh/a
  ./a .122
  2⤵
  PID:860
- /tmp/gosh/a
  ./a .123
  2⤵
  PID:861
- /tmp/gosh/a
  ./a .124
  2⤵
  PID:862
- /tmp/gosh/a
  ./a .125
  2⤵
  PID:863
- /tmp/gosh/a
  ./a .126
  2⤵
  PID:864
- /tmp/gosh/a
  ./a .127
  2⤵
  PID:865
- /tmp/gosh/a
  ./a .128
  2⤵
  PID:866
- /tmp/gosh/a
  ./a .129
  2⤵
  PID:867
- /tmp/gosh/a
  ./a .13
  2⤵
  PID:868
- /tmp/gosh/a
  ./a .131
  2⤵
  PID:869
- /tmp/gosh/a
  ./a .132
  2⤵
  PID:870
- /tmp/gosh/a
  ./a .133
  2⤵
  PID:871
- /tmp/gosh/a
  ./a .134
  2⤵
  PID:872
- /tmp/gosh/a
  ./a .135
  2⤵
  PID:873
- /tmp/gosh/a
  ./a .136
  2⤵
  PID:874
- /tmp/gosh/a
  ./a .137
  2⤵
  PID:875
- /tmp/gosh/a
  ./a .138
  2⤵
  PID:876
- /tmp/gosh/a
  ./a .139
  2⤵
  PID:877
- /tmp/gosh/a
  ./a .140
  2⤵
  PID:878
- /tmp/gosh/a
  ./a .141
  2⤵
  PID:879
- /tmp/gosh/a
  ./a .142
  2⤵
  PID:880
- /tmp/gosh/a
  ./a .143
  2⤵
  PID:881
- /tmp/gosh/a
  ./a .144
  2⤵
  PID:882
- /tmp/gosh/a
  ./a .145
  2⤵
  PID:883
- /tmp/gosh/a
  ./a .146
  2⤵
  PID:884
- /tmp/gosh/a
  ./a .147
  2⤵
  PID:885
- /tmp/gosh/a
  ./a .148
  2⤵
  PID:886
- /tmp/gosh/a
  ./a .149
  2⤵
  PID:887
- /tmp/gosh/a
  ./a .150
  2⤵
  PID:888
- /tmp/gosh/a
  ./a .151
  2⤵
  PID:889
- /tmp/gosh/a
  ./a .152
  2⤵
  PID:890
- /tmp/gosh/a
  ./a .153
  2⤵
  PID:891
- /tmp/gosh/a
  ./a .154
  2⤵
  PID:892
- /tmp/gosh/a
  ./a .155
  2⤵
  PID:893
- /tmp/gosh/a
  ./a .156
  2⤵
  PID:894
- /tmp/gosh/a
  ./a .157
  2⤵
  PID:895
- /tmp/gosh/a
  ./a .158
  2⤵
  PID:896
- /tmp/gosh/a
  ./a .159
  2⤵
  PID:897
- /tmp/gosh/a
  ./a .160
  2⤵
  PID:898
- /tmp/gosh/a
  ./a .161
  2⤵
  PID:899
- /tmp/gosh/a
  ./a .162
  2⤵
  PID:900
- /tmp/gosh/a
  ./a .163
  2⤵
  PID:901
- /tmp/gosh/a
  ./a .164
  2⤵
  PID:902
- /tmp/gosh/a
  ./a .165
  2⤵
  PID:903
- /tmp/gosh/a
  ./a .166
  2⤵
  PID:904
- /tmp/gosh/a
  ./a .167
  2⤵
  PID:905
- /tmp/gosh/a
  ./a .168
  2⤵
  PID:906
- /tmp/gosh/a
  ./a .169
  2⤵
  PID:907
- /tmp/gosh/a
  ./a .170
  2⤵
  PID:908
- /tmp/gosh/a
  ./a .171
  2⤵
  PID:909
- /tmp/gosh/a
  ./a .172
  2⤵
  PID:910
- /tmp/gosh/a
  ./a .173
  2⤵
  PID:911
- /tmp/gosh/a
  ./a .174
  2⤵
  PID:912
- /tmp/gosh/a
  ./a .175
  2⤵
  PID:913
- /tmp/gosh/a
  ./a .176
  2⤵
  PID:914
- /tmp/gosh/a
  ./a .177
  2⤵
  PID:915
- /tmp/gosh/a
  ./a .178
  2⤵
  PID:916
- /tmp/gosh/a
  ./a .179
  2⤵
  PID:917
- /tmp/gosh/a
  ./a .180
  2⤵
  PID:918
- /tmp/gosh/a
  ./a .181
  2⤵
  PID:919
- /tmp/gosh/a
  ./a .182
  2⤵
  PID:920
- /tmp/gosh/a
  ./a .183
  2⤵
  PID:921
- /tmp/gosh/a
  ./a .184
  2⤵
  PID:922
- /tmp/gosh/a
  ./a .185
  2⤵
  PID:923
- /tmp/gosh/a
  ./a .186
  2⤵
  PID:924
- /tmp/gosh/a
  ./a .187
  2⤵
  PID:925
- /tmp/gosh/a
  ./a .188
  2⤵
  PID:926
- /tmp/gosh/a
  ./a .189
  2⤵
  PID:927
- /tmp/gosh/a
  ./a .190
  2⤵
  PID:928
- /tmp/gosh/a
  ./a .191
  2⤵
  PID:929
- /tmp/gosh/a
  ./a .192
  2⤵
  PID:930
- /tmp/gosh/a
  ./a .193
  2⤵
  PID:931
- /tmp/gosh/a
  ./a .194
  2⤵
  PID:932
- /tmp/gosh/a
  ./a .195
  2⤵
  PID:933
- /tmp/gosh/a
  ./a .196
  2⤵
  PID:934
- /tmp/gosh/a
  ./a .197
  2⤵
  PID:935
- /tmp/gosh/a
  ./a .198
  2⤵
  PID:936
- /tmp/gosh/a
  ./a .199
  2⤵
  PID:937
- /tmp/gosh/a
  ./a .200
  2⤵
  PID:938
- /tmp/gosh/a
  ./a .201
  2⤵
  PID:939
- /tmp/gosh/a
  ./a .202
  2⤵
  PID:940
- /tmp/gosh/a
  ./a .203
  2⤵
  PID:941
- /tmp/gosh/a
  ./a .204
  2⤵
  PID:942
- /tmp/gosh/a
  ./a .205
  2⤵
  PID:943
- /tmp/gosh/a
  ./a .206
  2⤵
  PID:944
- /tmp/gosh/a
  ./a .207
  2⤵
  PID:945
- /tmp/gosh/a
  ./a .208
  2⤵
  PID:946
- /tmp/gosh/a
  ./a .209
  2⤵
  PID:947
- /tmp/gosh/a
  ./a .210
  2⤵
  PID:948
- /tmp/gosh/a
  ./a .211
  2⤵
  PID:949
- /tmp/gosh/a
  ./a .212
  2⤵
  PID:950
- /tmp/gosh/a
  ./a .213
  2⤵
  PID:951
- /tmp/gosh/a
  ./a .214
  2⤵
  PID:952
- /tmp/gosh/a
  ./a .215
  2⤵
  PID:953
- /tmp/gosh/a
  ./a .216
  2⤵
  PID:954
- /tmp/gosh/a
  ./a .217
  2⤵
  PID:955
- /tmp/gosh/a
  ./a .218
  2⤵
  PID:956
- /tmp/gosh/a
  ./a .219
  2⤵
  PID:957
- /tmp/gosh/a
  ./a .220
  2⤵
  PID:958
- /tmp/gosh/a
  ./a .221
  2⤵
  PID:959
- /tmp/gosh/a
  ./a .222
  2⤵
  PID:960
- /tmp/gosh/a
  ./a .223
  2⤵
  PID:961
- /tmp/gosh/a
  ./a .224
  2⤵
  PID:962
- /tmp/gosh/a
  ./a .225
  2⤵
  PID:963
- /tmp/gosh/a
  ./a .226
  2⤵
  PID:964
- /tmp/gosh/a
  ./a .227
  2⤵
  PID:965
- /tmp/gosh/a
  ./a .228
  2⤵
  PID:966
- /tmp/gosh/a
  ./a .229
  2⤵
  PID:967
- /tmp/gosh/a
  ./a .230
  2⤵
  PID:968
- /tmp/gosh/a
  ./a .231
  2⤵
  PID:969
- /tmp/gosh/a
  ./a .232
  2⤵
  PID:970
- /tmp/gosh/a
  ./a .233
  2⤵
  PID:972
- /tmp/gosh/a
  ./a .234
  2⤵
  PID:973
- /tmp/gosh/a
  ./a .235
  2⤵
  PID:974
- /tmp/gosh/a
  ./a .236
  2⤵
  PID:976
- /tmp/gosh/a
  ./a .237
  2⤵
  PID:977
- /tmp/gosh/a
  ./a .238
  2⤵
  PID:978
- /tmp/gosh/a
  ./a .239
  2⤵
  PID:979
- /tmp/gosh/a
  ./a .240
  2⤵
  PID:980
- /tmp/gosh/a
  ./a .241
  2⤵
  PID:981
- /tmp/gosh/a
  ./a .242
  2⤵
  PID:982
- /tmp/gosh/a
  ./a .243
  2⤵
  PID:983
- /tmp/gosh/a
  ./a .244
  2⤵
  PID:984
- /tmp/gosh/a
  ./a .245
  2⤵
  PID:985
- /tmp/gosh/a
  ./a .246
  2⤵
  PID:987
- /tmp/gosh/a
  ./a .247
  2⤵
  PID:988
- /tmp/gosh/a
  ./a .248
  2⤵
  PID:989
- /tmp/gosh/a
  ./a .249
  2⤵
  PID:990
- /tmp/gosh/a
  ./a .250
  2⤵
  PID:991
- /tmp/gosh/a
  ./a .251
  2⤵
  PID:993
- /tmp/gosh/a
  ./a .252
  2⤵
  PID:994
- /tmp/gosh/a
  ./a .253
  2⤵
  PID:995
- /tmp/gosh/a
  ./a .254
  2⤵
  PID:996
- /tmp/gosh/a
  ./a .255
  2⤵
  PID:997
- /usr/bin/killall
  killall -9 a
  2⤵
  - Reads runtime system information
  PID:998

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/gosh/info2

Filesize
27B

MD5
210e3691abde94aba36fd981c007118b

SHA1
fbed82767e1e597632436aa2b4d5aed2c2585ac2

SHA256
a9913f505a1275a5c00a630ae232b04a982bb19efa5b00d5e22ca14e414b84c9

SHA512
65a8f42b99268ba4bc17f51f0e2e17d530b344c80bc483c510014bbf2920715517f5be0f770e30f55e1f2603f203fd4af9295bd979a82897e15b1593f08e1580

Download Submit
/tmp/gosh/info2

Filesize
54B

MD5
a2709419d80ba6b7fb126a5ed3cbebf1

SHA1
2400112d846a896b8bfee9d8c1791718ef0695b8

SHA256
24259785df747f8a38f250211b544b5885e937254a0a3d17658696f8515ca20a

SHA512
2f897325d3791ab80619d52978907900e0431518ae44906d06ccfe0dcae412c3d46a034f40da724bd4045d9c33258478bb6c96d33ea0f6c649ac81b7d4a62e8d

Download Submit
/tmp/gosh/info2

Filesize
85B

MD5
68e6530a51c4c7bf17dcf7051a6be710

SHA1
81380900211b5eca427f5632ff97cfd91eaaf7eb

SHA256
0b17dee730444d635adf2892a570927015e1bac71bf869df56bf25d104b1f529

SHA512
a103bbcdee57bafed8aa53eb08723aa1653e6e426e66ab6a1aca2e43f94200a2efd9288b0f51f67cc350beb08eb9648432e05feaca95f80179d6701c95b577e0

Download Submit
/tmp/gosh/info2

Filesize
147B

MD5
33ca4325696a8b920e8292cdbdca1ac0

SHA1
805dd22eeff10a70b7ddc8c36896f5e1ed8b7dea

SHA256
659f7b4ada5ed2e6c7193998adcf7334601a9a9c156d52f3eb9d399fce15add3

SHA512
f8a8468aaf5ef099cf41ae7c0a60fd549a83994550aab55332fabdcb0dfaa8644e95e295c9ccc19fa49b40a1bb02eeb40079249d2c772478862bde3fb950d4ca

Download Submit
/tmp/gosh/info2

Filesize
180B

MD5
e31d491cc4c83e5f407008a2d080c84f

SHA1
28ff8dba1656ef1bda435ef5fdd5f5f34cd14664

SHA256
5f500cd7ea55b190d73d49fe0f01ec129b70464642b7232eea7c768063db4ff6

SHA512
a334839f6965ff76bfc6da5094adb8980b6d6d01455ec2acf1b6d303e0d03599ccdc74cc17366a43988defa00239293a9f7aa07747e2b01cfe2b4b61aedbf129

Download Submit
/tmp/gosh/info2

Filesize
2KB

MD5
fa3a357938e47a8eabc00d863218659b

SHA1
191eb38b2eafd050d75949be9d83ebc9e892b964

SHA256
7737522c14b90494a4cb020f24f2152b35a16cce7d59c1da15d731dbd2d65fe8

SHA512
8b7bfd35478bec11a8d817494ee827f027070eabc2cdf48d030e23210f769e7e6756a2d3c8475f43a9f4b4a7d1c50fc74d5348cd0243a6255585c03fc27f07f2

Download Submit