9ebc0aa8b917cb4f775dce6a81d79623c812f9392397f1b5a63b7a9d9ab87ef0

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09-04-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3546bba3b8b9b0b1efde6cfde42c2c3e.elf
Size

5.0MB
MD5

3546bba3b8b9b0b1efde6cfde42c2c3e
SHA1

d2a30cfa814167f8b418ef5c4d6b961892b25c8d
SHA256

9ebc0aa8b917cb4f775dce6a81d79623c812f9392397f1b5a63b7a9d9ab87ef0
SHA512

de2547dfa4196c4ee25c21963a1e6a1b52fd93b22d826c67332c23750fc3303c9328f1986e16304a8ff898c99249d91836442c6c1dcc27267961956029e15bf8
SSDEEP

49152:94hW9DuzBB1Lf5bQN4m9Dk3Lkmopv1ktVI1h:94hW9mB1Lf5T6kc

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

ioc	pid	Process
/etc/32675	669	32675
/etc/opt.services.cfg	843	opt.services.cfg
/etc/opt.services.cfg	847	opt.services.cfg
/etc/opt.services.cfg	875	opt.services.cfg
/etc/opt.services.cfg	879	opt.services.cfg

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	Process not Found
File opened for modification	/dev/watchdog	3546bba3b8b9b0b1efde6cfde42c2c3e.elf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/crontab	sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/etc/profile.d/bash_cfg	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for modification	/etc/profile.d/bash_cfg.sh	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for modification	/etc/profile.d/gateway.sh	Process not Found

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 1 TTPs 17 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/alsa-utils	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for modification	/etc/init.d/auditd	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for modification	/etc/init.d/console-setup.sh	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for modification	/etc/init.d/dbus	Process not Found
File opened for modification	/etc/init.d/networking	Process not Found
File opened for modification	/etc/init.d/sudo	Process not Found
File opened for modification	/etc/init.d/exim4	Process not Found
File opened for modification	/etc/init.d/procps	Process not Found
File opened for modification	/etc/init.d/ssh	Process not Found
File opened for modification	/etc/init.d/cron	Process not Found
File opened for modification	/etc/init.d/hwclock.sh	Process not Found
File opened for modification	/etc/init.d/keyboard-setup.sh	Process not Found
File opened for modification	/etc/init.d/selinux-autorelabel	Process not Found
File opened for modification	/etc/init.d/x11-common	Process not Found
File opened for modification	/etc/init.d/kmod	Process not Found
File opened for modification	/etc/init.d/rsyslog	Process not Found
File opened for modification	/etc/init.d/udev	Process not Found

Write file to user bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc
File opened for modification	/usr/bin/include/find
File opened for modification	/usr/bin/find

Modifies Bash startup script 1 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/profile.d/bash_cfg.sh	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for modification	/etc/profile.d/gateway.sh	Process not Found
File opened for modification	/etc/profile.d/bash_cfg	3546bba3b8b9b0b1efde6cfde42c2c3e.elf

Enumerates kernel/hardware configuration 1 TTPs 37 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	opt.services.cfg
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/580/stat	Process not Found
File opened for reading	/proc/22/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/645/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/12/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/853/stat	Process not Found
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/6/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/842/stat	Process not Found
File opened for reading	/proc/8/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/598/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/686/stat	Process not Found
File opened for reading	/proc/651/stat	Process not Found
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/10/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/14/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/18/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/596/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/601/stat	Process not Found
File opened for reading	/proc/29/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/653/stat	Process not Found
File opened for reading	/proc/27/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/641/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/644/stat	Process not Found
File opened for reading	/proc/639/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/291/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/600/stat	Process not Found
File opened for reading	/proc/645/stat	Process not Found
File opened for reading	/proc/76/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/601/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/344/stat	Process not Found
File opened for reading	/proc/9/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/137/stat	3546bba3b8b9b0b1efde6cfde42c2c3e.elf
File opened for reading	/proc/cmdline	systemctl

/tmp/3546bba3b8b9b0b1efde6cfde42c2c3e.elf
/tmp/3546bba3b8b9b0b1efde6cfde42c2c3e.elf
1⤵
- Enumerates kernel/hardware configuration
PID:646
- /tmp/3546bba3b8b9b0b1efde6cfde42c2c3e.elf
  /tmp/3546bba3b8b9b0b1efde6cfde42c2c3e.elf " "
  2⤵
  - Modifies Watchdog functionality
  - Creates/modifies environment variables
  - Modifies init.d
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:651
- - /bin/sh
    /bin/sh -c "/etc/32675&"
    3⤵
    PID:667
  - - /etc/32675
      /etc/32675
      4⤵
      Executes dropped EXE
      PID:669
    - - /bin/sleep
        
        sleep 60
        5⤵
        
        PID:673
    - - /etc/opt.services.cfg
        
        /etc/opt.services.cfg
        5⤵
        Executes dropped EXE
        Enumerates kernel/hardware configuration
        
        PID:843
      - /etc/opt.services.cfg
        
        /etc/opt.services.cfg " "
        6⤵
        Executes dropped EXE
        Enumerates kernel/hardware configuration
        
        PID:847
    - - /bin/sleep
        
        sleep 60
        5⤵
        
        PID:848
    - - /etc/opt.services.cfg
        
        /etc/opt.services.cfg
        5⤵
        Executes dropped EXE
        Enumerates kernel/hardware configuration
        
        PID:875
      - /etc/opt.services.cfg
        
        /etc/opt.services.cfg " "
        6⤵
        Executes dropped EXE
        Enumerates kernel/hardware configuration
        
        PID:879
    - - /bin/sleep
        
        sleep 60
        5⤵
        
        PID:880
- - /usr/sbin/service
    service crond start
    3⤵
    PID:671
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:674
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:676
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:679
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:691
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:693
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:694
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Enumerates kernel/hardware configuration
      PID:696
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:697
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:698
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:699
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:700
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:701
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:702
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:703
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:704
- - /usr/local/sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:671
- - /usr/local/bin/systemctl
    systemctl start crond.service
    3⤵
    PID:671
- - /usr/sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:671
- - /usr/bin/systemctl
    systemctl start crond.service
    3⤵
    PID:671
- - /sbin/systemctl
    systemctl start crond.service
    3⤵
    PID:671
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:671
- - /bin/sh
    /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
    3⤵
    - Creates/modifies Cron job
    PID:709

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:683

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:682

/usr/bin/renice
renice -20 651
1⤵
PID:716

/bin/mount
mount -o bind /tmp/ /proc/651
1⤵
PID:717

/usr/sbin/service
service cron start
1⤵
PID:719
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:720
- /usr/bin/basename
  basename /usr/sbin/service
  2⤵
  PID:722
- /bin/systemctl
  systemctl --quiet is-active multi-user.target
  2⤵
  - Enumerates kernel/hardware configuration
  PID:723
- /bin/systemctl
  systemctl -p Triggers show dbus.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:731
- /bin/systemctl
  systemctl -p Triggers show ssh.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:734
- /bin/systemctl
  systemctl -p Triggers show syslog.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:736
- /bin/systemctl
  systemctl -p Triggers show systemd-fsckd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:738
- /bin/systemctl
  systemctl -p Triggers show systemd-initctl.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:740
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-audit.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:742
- /bin/systemctl
  systemctl -p Triggers show systemd-journald-dev-log.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:745
- /bin/systemctl
  systemctl -p Triggers show systemd-journald.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:747
- /bin/systemctl
  systemctl -p Triggers show systemd-networkd.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:749
- /bin/systemctl
  systemctl -p Triggers show systemd-rfkill.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:752
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-control.socket
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:757
- /bin/systemctl
  systemctl -p Triggers show systemd-udevd-kernel.socket
  2⤵
  - Enumerates kernel/hardware configuration
  PID:760

/bin/systemctl
systemctl list-unit-files --full "--type=socket"
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:726

/bin/sed
sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
1⤵
PID:727

/usr/local/sbin/systemctl
systemctl start cron.service
1⤵
PID:719

/usr/local/bin/systemctl
systemctl start cron.service
1⤵
PID:719

/usr/sbin/systemctl
systemctl start cron.service
1⤵
PID:719

/usr/bin/systemctl
systemctl start cron.service
1⤵
PID:719

/sbin/systemctl
systemctl start cron.service
1⤵
PID:719

/bin/systemctl
systemctl start cron.service
1⤵
- Enumerates kernel/hardware configuration
PID:719

/bin/systemctl
systemctl start crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:765

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/.mod

Filesize
34B

MD5
f5a3713282e43c200f30342f5ff5e2ea

SHA1
2b2ce1a207e2b691a074c6f78f71c4785aae426a

SHA256
6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511

SHA512
5bcb8cd360409147a486755f90e0cdd97183af02ce8de5135b7c6a8a010deb9ef12dcd5ee9a2a8fd2e159347f68e72d6b7fd75e943b4fcd928d7a74b97476013

Download Submit
/etc/.walk

Filesize
41B

MD5
a60859215268c6eeae99ac368c9ae433

SHA1
e3f4d8680648322248f462b4974c13720133928d

SHA256
e72326f7fca3bb9ea85b6e1ed6b65f4c0db8bebc52edde76de0882c57d86a15f

SHA512
4c96474a40faa7929d8842cc61a9911c1d1a096307c9419769f309218df617b3a36694532239a97d034d2ea1af024120b22bec1de8cc737e37076f8a43bf0791

Download Submit
/etc/.walk

Filesize
90B

MD5
99b57ec6c36e430e71ba79f857d692a2

SHA1
1625ab712276a81d7f7522e23fd1d9a38cdf6da2

SHA256
1a68c592689c103268d0714f1b57d036c5c64baeda03680c01e2f76683838860

SHA512
ebc8264bef9561a2cac70f9f25bb88fe4d739a8f579466be4475ea81c9838551cb2ed4035b32e89fdf47bdfade35a8d02f8cb4d7c0fc7ae8ae8787cb39a40183

Download Submit
/etc/32675

Filesize
61B

MD5
47684525bfdf26f49fd1cf742b17c015

SHA1
c4ab14ba22420ff9acadfc698a38d0cd99e9fbfa

SHA256
b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b

SHA512
948f9c519ae9afe1c821c5d58da2e584e50356dabef597ccd408853a9038560b9fb1c5894900e2725b48977ffd49d18a439436bb4946e2164ac9fcf2a8637621

Download Submit
/etc/opt.services.cfg

Filesize
5.0MB

MD5
3546bba3b8b9b0b1efde6cfde42c2c3e

SHA1
d2a30cfa814167f8b418ef5c4d6b961892b25c8d

SHA256
9ebc0aa8b917cb4f775dce6a81d79623c812f9392397f1b5a63b7a9d9ab87ef0

SHA512
de2547dfa4196c4ee25c21963a1e6a1b52fd93b22d826c67332c23750fc3303c9328f1986e16304a8ff898c99249d91836442c6c1dcc27267961956029e15bf8

Download Submit
/etc/profile.d/gateway.sh

Filesize
937B

MD5
abd4a8e1669eea8a5e9cf6ebc87dd2ea

SHA1
07bcc0c0dcb09278cf35eda79c87e19438749ec7

SHA256
096428c390883747d39ab503eac3da4bfd87ede3e12edee20200ad2c12302381

SHA512
7e2ebc470fb4886fd02853225de51ffb96cc1195cff5fffb88b636053333178232c683465819530ded96723791efc80d05785aecabf7e0a1d9f2f04d106b6d77

Download Submit
/usr/bin/include/find

Filesize
134KB

MD5
138a27d6fe52fa1132760a4fa48922e0

SHA1
e0250e4d7bf33a5a1064344224148b889cb15138

SHA256
81a10dad907b23521461bd3fc83c2cedb2218933a328d9a05e3c9f6a9a1d42aa

SHA512
ee0078afad63fc2aaffdebb7127d1c7d4459287fee75358f57c82d397c39b7bf64338fb6996dfb1747cd9a896d714b3c76f0948727be91550f1affa1c0298a9e

Download Submit
memory/696-1-0xb6b80000-0xb6b91044-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads