165fb59360683122125271d668cfb28c3ad9502d559e491856005178fb22a254

Resubmissions

29-04-2024 17:56

240429-wjgllsgg29 10

17-04-2024 14:59

240417-sc15wsef8y 10

16-04-2024 14:20

240416-rnxq6sdg3t 10

Analysis

max time kernel
1800s
max time network
1799s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29-04-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
Size

8.7MB
MD5

0263de27fd997a4904ee4a92f91ac733
SHA1

da090fd76b2d92320cf7e55666bb5bd8f50796c9
SHA256

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
SHA512

09ef02532eb7c3a968c1d04bf1f3aa9a4bf400f8485d3be596d7db3aed5f705fc1f85a1f6218397a70830ad747aa03c61b9c5b1cca24c2620cdbb3e5361db194
SSDEEP

98304:bKwGam/zeDrZCDcryHlc5Qp+FLk0h6u9SrS2D8t7Xk:bKwGam/z4C3FKQ8FLTh6u9S4

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

Processes:

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

Deletes itself 1 IoCs

Processes:

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

pid	Process
1563	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

description	ioc	Process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

Processes:

cat

description	ioc	Process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

uptimeuptimeuptimefreefreefreeuptimeuptimeuptimefreeuptimefreefreefreefreefreeuptimefreeuptimefreefreeuptimeuptimefreefreefreefreeuptimeuptimefreeuptimeuptimefreeuptimeuptimeuptimefreeuptimeuptimefreefreefreefreeuptimeuptimefreeuptimeuptimefreefreefreefreefreefreeuptimefreefreeuptimefreefreefreeuptimefreeuptime

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

uptimeuptimefreeuptimeuptimefreeuptimeuptimefree0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732uptimefreefreeuptimefreefreeuptimeuptimeuptimeuptimefreeuptimeuptimeuptimefreeuptimefreeuptimeuptimefreefreeuptimeuptimeuptimeuptimeuptimeuptimeuptimeuptimefreefreefree

description	ioc	Process
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1132/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/674/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1170/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/1139/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/1861/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/492/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1207/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/1105/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/484/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1164/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/651/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1320/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/613/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/32/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/98/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/476/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1147/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/1253/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/536/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	free

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
- Reads runtime system information
PID:1563
- /bin/uname
  uname -a
  2⤵
  PID:1574
- /bin/cat
  cat /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:1575
- /bin/cat
  cat /etc/issue
  2⤵
  PID:1576
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1577
- /usr/bin/uptime
  uptime
  2⤵
  PID:1578
- /bin/journalctl
  journalctl -S "@0" -u sshd
  2⤵
  PID:1583
- /bin/cat
  cat "/var/log/auth*"
  2⤵
  PID:1584
- /bin/zcat
  zcat "/var/log/auth*"
  2⤵
  PID:1585
- /bin/gzip
  gzip -cd "/var/log/auth*"
  2⤵
  PID:1585
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1586
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1587
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1588
- /usr/bin/uptime
  uptime
  2⤵
  PID:1589
- /usr/bin/free
  free -m
  2⤵
  PID:1592
- /usr/bin/uptime
  uptime
  2⤵
  PID:1593
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1594
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1595
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1596
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1597
- /usr/bin/free
  free -m
  2⤵
  PID:1598
- /usr/bin/uptime
  uptime
  2⤵
  PID:1599
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1600
- /usr/bin/uptime
  uptime
  2⤵
  PID:1601
- /usr/bin/free
  free -m
  2⤵
  PID:1602
- /usr/bin/uptime
  uptime
  2⤵
  PID:1603
- /usr/bin/free
  free -m
  2⤵
  PID:1604
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1605
- /usr/bin/free
  free -m
  2⤵
  PID:1606
- /usr/bin/uptime
  uptime
  2⤵
  PID:1607
- /usr/bin/free
  free -m
  2⤵
  PID:1608
- /usr/bin/uptime
  uptime
  2⤵
  PID:1609
- /usr/bin/free
  free -m
  2⤵
  PID:1610
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1611
- /usr/bin/free
  free -m
  2⤵
  PID:1612
- /usr/bin/uptime
  uptime
  2⤵
  PID:1613
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1614
- /usr/bin/uptime
  uptime
  2⤵
  PID:1615
- /usr/bin/free
  free -m
  2⤵
  PID:1616
- /usr/bin/uptime
  uptime
  2⤵
  PID:1617
- /usr/bin/free
  free -m
  2⤵
  PID:1618
- /usr/bin/uptime
  uptime
  2⤵
  PID:1619
- /usr/bin/free
  free -m
  2⤵
  PID:1620
- /usr/bin/uptime
  uptime
  2⤵
  PID:1621
- /usr/bin/free
  free -m
  2⤵
  PID:1624
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1625
- /usr/bin/free
  free -m
  2⤵
  PID:1626
- /usr/bin/uptime
  uptime
  2⤵
  PID:1627
- /usr/bin/free
  free -m
  2⤵
  PID:1628
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1629
- /usr/bin/free
  free -m
  2⤵
  PID:1630
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1631
- /usr/bin/free
  free -m
  2⤵
  PID:1632
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1633
- /usr/bin/free
  free -m
  2⤵
  PID:1634
- /usr/bin/uptime
  uptime
  2⤵
  PID:1635
- /usr/bin/free
  free -m
  2⤵
  PID:1636
- /usr/bin/uptime
  uptime
  2⤵
  PID:1637
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1638
- /usr/bin/uptime
  uptime
  2⤵
  PID:1639
- /usr/bin/free
  free -m
  2⤵
  PID:1640
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1641
- /usr/bin/free
  free -m
  2⤵
  PID:1642
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1643
- /usr/bin/free
  free -m
  2⤵
  PID:1644
- /usr/bin/uptime
  uptime
  2⤵
  PID:1645
- /usr/bin/free
  free -m
  2⤵
  PID:1646
- /usr/bin/uptime
  uptime
  2⤵
  PID:1647
- /usr/bin/free
  free -m
  2⤵
  PID:1648
- /usr/bin/uptime
  uptime
  2⤵
  PID:1649
- /usr/bin/free
  free -m
  2⤵
  PID:1650
- /usr/bin/uptime
  uptime
  2⤵
  PID:1651
- /usr/bin/free
  free -m
  2⤵
  PID:1652
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1653
- /usr/bin/free
  free -m
  2⤵
  PID:1655
- /usr/bin/uptime
  uptime
  2⤵
  PID:1656
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1657
- /usr/bin/uptime
  uptime
  2⤵
  PID:1658
- /usr/bin/free
  free -m
  2⤵
  PID:1659
- /usr/bin/uptime
  uptime
  2⤵
  PID:1660
- /usr/bin/free
  free -m
  2⤵
  PID:1661
- /usr/bin/uptime
  uptime
  2⤵
  PID:1662
- /usr/bin/free
  free -m
  2⤵
  PID:1663
- /usr/bin/uptime
  uptime
  2⤵
  PID:1664
- /usr/bin/free
  free -m
  2⤵
  PID:1665
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1666
- /usr/bin/free
  free -m
  2⤵
  PID:1667
- /usr/bin/uptime
  uptime
  2⤵
  PID:1668
- /usr/bin/free
  free -m
  2⤵
  PID:1669
- /usr/bin/uptime
  uptime
  2⤵
  PID:1670
- /usr/bin/free
  free -m
  2⤵
  PID:1671
- /usr/bin/uptime
  uptime
  2⤵
  PID:1672
- /usr/bin/free
  free -m
  2⤵
  PID:1673
- /usr/bin/uptime
  uptime
  2⤵
  PID:1674
- /usr/bin/free
  free -m
  2⤵
  PID:1675
- /usr/bin/uptime
  uptime
  2⤵
  PID:1676
- /usr/bin/free
  free -m
  2⤵
  PID:1677
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1678
- /usr/bin/free
  free -m
  2⤵
  PID:1679
- /usr/bin/uptime
  uptime
  2⤵
  PID:1680
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1681
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1682
- /usr/bin/free
  free -m
  2⤵
  PID:1683
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1684
- /usr/bin/free
  free -m
  2⤵
  PID:1705
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1706
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1707
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1708
- /usr/bin/free
  free -m
  2⤵
  PID:1709
- /usr/bin/uptime
  uptime
  2⤵
  PID:1710
- /usr/bin/free
  free -m
  2⤵
  PID:1711
- /usr/bin/uptime
  uptime
  2⤵
  PID:1712
- /usr/bin/free
  free -m
  2⤵
  PID:1713
- /usr/bin/uptime
  uptime
  2⤵
  PID:1714
- /usr/bin/free
  free -m
  2⤵
  PID:1715
- /usr/bin/uptime
  uptime
  2⤵
  PID:1716
- /usr/bin/free
  free -m
  2⤵
  PID:1717
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1718
- /usr/bin/free
  free -m
  2⤵
  PID:1719
- /usr/bin/uptime
  uptime
  2⤵
  PID:1720
- /usr/bin/free
  free -m
  2⤵
  PID:1721
- /usr/bin/uptime
  uptime
  2⤵
  PID:1722
- /usr/bin/free
  free -m
  2⤵
  PID:1723
- /usr/bin/uptime
  uptime
  2⤵
  PID:1724
- /usr/bin/free
  free -m
  2⤵
  PID:1725
- /usr/bin/uptime
  uptime
  2⤵
  PID:1726
- /usr/bin/free
  free -m
  2⤵
  PID:1727
- /usr/bin/uptime
  uptime
  2⤵
  PID:1728
- /usr/bin/free
  free -m
  2⤵
  PID:1729
- /usr/bin/uptime
  uptime
  2⤵
  PID:1730
- /usr/bin/free
  free -m
  2⤵
  PID:1731
- /usr/bin/uptime
  uptime
  2⤵
  PID:1732
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1733
- /usr/bin/uptime
  uptime
  2⤵
  PID:1734
- /usr/bin/free
  free -m
  2⤵
  PID:1735
- /usr/bin/uptime
  uptime
  2⤵
  PID:1736
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1737
- /usr/bin/uptime
  uptime
  2⤵
  PID:1738
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1739
- /usr/bin/uptime
  uptime
  2⤵
  PID:1740
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1741
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1742
- /usr/bin/free
  free -m
  2⤵
  PID:1743
- /usr/bin/uptime
  uptime
  2⤵
  PID:1744
- /usr/bin/free
  free -m
  2⤵
  PID:1745
- /usr/bin/uptime
  uptime
  2⤵
  PID:1746
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1747
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1748
- /usr/bin/free
  free -m
  2⤵
  PID:1749
- /usr/bin/uptime
  uptime
  2⤵
  PID:1750
- /usr/bin/free
  free -m
  2⤵
  PID:1751
- /usr/bin/uptime
  uptime
  2⤵
  PID:1752
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1753
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1754
- /usr/bin/free
  free -m
  2⤵
  PID:1755
- /usr/bin/uptime
  uptime
  2⤵
  PID:1756
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1757
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1758
- /usr/bin/free
  free -m
  2⤵
  PID:1759
- /usr/bin/uptime
  uptime
  2⤵
  PID:1760
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1761
- /usr/bin/uptime
  uptime
  2⤵
  PID:1762
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1763
- /usr/bin/uptime
  uptime
  2⤵
  PID:1764
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1768
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1769
- /usr/bin/free
  free -m
  2⤵
  PID:1770
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1771
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1772
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1773
- /usr/bin/free
  free -m
  2⤵
  PID:1774
- /usr/bin/uptime
  uptime
  2⤵
  PID:1775
- /usr/bin/free
  free -m
  2⤵
  PID:1776
- /usr/bin/uptime
  uptime
  2⤵
  PID:1777
- /usr/bin/free
  free -m
  2⤵
  PID:1778
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1779
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1780
- /usr/bin/uptime
  uptime
  2⤵
  PID:1781
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1782
- /usr/bin/uptime
  uptime
  2⤵
  PID:1783
- /usr/bin/free
  free -m
  2⤵
  PID:1784
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1785
- /usr/bin/free
  free -m
  2⤵
  PID:1786
- /usr/bin/uptime
  uptime
  2⤵
  PID:1787
- /usr/bin/free
  free -m
  2⤵
  PID:1788
- /usr/bin/uptime
  uptime
  2⤵
  PID:1789
- /usr/bin/free
  free -m
  2⤵
  PID:1790
- /usr/bin/uptime
  uptime
  2⤵
  PID:1791
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1792
- /usr/bin/uptime
  uptime
  2⤵
  PID:1793
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1794
- /usr/bin/uptime
  uptime
  2⤵
  PID:1795
- /usr/bin/free
  free -m
  2⤵
  PID:1796
- /usr/bin/uptime
  uptime
  2⤵
  PID:1797
- /usr/bin/free
  free -m
  2⤵
  PID:1798
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1799
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1800
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1801
- /usr/bin/free
  free -m
  2⤵
  PID:1802
- /usr/bin/uptime
  uptime
  2⤵
  PID:1803
- /usr/bin/free
  free -m
  2⤵
  PID:1804
- /usr/bin/uptime
  uptime
  2⤵
  PID:1805
- /usr/bin/free
  free -m
  2⤵
  PID:1806
- /usr/bin/uptime
  uptime
  2⤵
  PID:1807
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1808
- /usr/bin/uptime
  uptime
  2⤵
  PID:1809
- /usr/bin/free
  free -m
  2⤵
  PID:1810
- /usr/bin/uptime
  uptime
  2⤵
  PID:1811
- /usr/bin/free
  free -m
  2⤵
  PID:1812
- /usr/bin/uptime
  uptime
  2⤵
  PID:1813
- /usr/bin/free
  free -m
  2⤵
  PID:1814
- /usr/bin/uptime
  uptime
  2⤵
  PID:1815
- /usr/bin/free
  free -m
  2⤵
  PID:1816
- /usr/bin/uptime
  uptime
  2⤵
  PID:1817
- /usr/bin/free
  free -m
  2⤵
  PID:1818
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1819
- /usr/bin/free
  free -m
  2⤵
  PID:1820
- /usr/bin/uptime
  uptime
  2⤵
  PID:1821
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1822
- /usr/bin/uptime
  uptime
  2⤵
  PID:1823
- /usr/bin/free
  free -m
  2⤵
  PID:1824
- /usr/bin/uptime
  uptime
  2⤵
  PID:1825
- /usr/bin/free
  free -m
  2⤵
  PID:1826
- /usr/bin/uptime
  uptime
  2⤵
  PID:1827
- /usr/bin/free
  free -m
  2⤵
  PID:1831
- /usr/bin/uptime
  uptime
  2⤵
  PID:1832
- /usr/bin/free
  free -m
  2⤵
  PID:1833
- /usr/bin/uptime
  uptime
  2⤵
  PID:1834
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1835
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1836
- /usr/bin/free
  free -m
  2⤵
  PID:1837
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1838
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1839
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1840
- /usr/bin/free
  free -m
  2⤵
  PID:1841
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1842
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1843
- /usr/bin/uptime
  uptime
  2⤵
  PID:1844
- /usr/bin/free
  free -m
  2⤵
  PID:1845
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1846
- /usr/bin/free
  free -m
  2⤵
  PID:1847
- /usr/bin/uptime
  uptime
  2⤵
  PID:1848
- /usr/bin/free
  free -m
  2⤵
  PID:1849
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1850
- /usr/bin/free
  free -m
  2⤵
  PID:1851
- /usr/bin/uptime
  uptime
  2⤵
  PID:1852
- /usr/bin/free
  free -m
  2⤵
  PID:1853
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1854
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1855
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1856
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1857
- /usr/bin/uptime
  uptime
  2⤵
  PID:1858
- /usr/bin/free
  free -m
  2⤵
  PID:1859
- /usr/bin/uptime
  uptime
  2⤵
  PID:1860
- /usr/bin/free
  free -m
  2⤵
  PID:1862
- /usr/bin/uptime
  uptime
  2⤵
  PID:1863
- /usr/bin/free
  free -m
  2⤵
  PID:1864
- /usr/bin/uptime
  uptime
  2⤵
  PID:1865
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1866
- /usr/bin/uptime
  uptime
  2⤵
  PID:1867
- /usr/bin/free
  free -m
  2⤵
  PID:1868
- /usr/bin/uptime
  uptime
  2⤵
  PID:1869
- /usr/bin/free
  free -m
  2⤵
  PID:1870
- /usr/bin/uptime
  uptime
  2⤵
  PID:1871
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1872
- /usr/bin/uptime
  uptime
  2⤵
  PID:1873
- /usr/bin/free
  free -m
  2⤵
  PID:1874
- /usr/bin/uptime
  uptime
  2⤵
  PID:1875
- /usr/bin/free
  free -m
  2⤵
  PID:1876
- /usr/bin/uptime
  uptime
  2⤵
  PID:1877
- /usr/bin/free
  free -m
  2⤵
  PID:1878
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1879
- /usr/bin/free
  free -m
  2⤵
  PID:1880
- /usr/bin/uptime
  uptime
  2⤵
  PID:1881
- /usr/bin/free
  free -m
  2⤵
  PID:1882
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1883
- /usr/bin/free
  free -m
  2⤵
  PID:1884
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1885
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1886
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1887
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1888
- /usr/bin/uptime
  uptime
  2⤵
  PID:1889
- /usr/bin/free
  free -m
  2⤵
  PID:1890
- /usr/bin/uptime
  uptime
  2⤵
  PID:1891
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1893
- /usr/bin/uptime
  uptime
  2⤵
  PID:1894
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1895
- /usr/bin/uptime
  uptime
  2⤵
  PID:1896
- /usr/bin/free
  free -m
  2⤵
  PID:1897
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1898
- /usr/bin/free
  free -m
  2⤵
  PID:1899
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1900
- /usr/bin/free
  free -m
  2⤵
  PID:1901
- /usr/bin/uptime
  uptime
  2⤵
  PID:1902
- /usr/bin/free
  free -m
  2⤵
  PID:1903
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1904
- /usr/bin/free
  free -m
  2⤵
  PID:1905
- /usr/bin/uptime
  uptime
  2⤵
  PID:1906
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1907
- /usr/bin/uptime
  uptime
  2⤵
  PID:1908
- /usr/bin/free
  free -m
  2⤵
  PID:1909
- /usr/bin/uptime
  uptime
  2⤵
  PID:1910
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1911
- /usr/bin/uptime
  uptime
  2⤵
  PID:1912
- /usr/bin/free
  free -m
  2⤵
  PID:1913
- /usr/bin/uptime
  uptime
  2⤵
  PID:1914
- /usr/bin/free
  free -m
  2⤵
  PID:1915
- /usr/bin/uptime
  uptime
  2⤵
  PID:1916
- /usr/bin/free
  free -m
  2⤵
  PID:1917
- /usr/bin/uptime
  uptime
  2⤵
  PID:1918
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1919
- /usr/bin/uptime
  uptime
  2⤵
  PID:1920
- /usr/bin/free
  free -m
  2⤵
  PID:1921
- /usr/bin/uptime
  uptime
  2⤵
  PID:1922
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1923
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1924
- /usr/bin/free
  free -m
  2⤵
  PID:1925
- /usr/bin/uptime
  uptime
  2⤵
  PID:1926
- /usr/bin/free
  free -m
  2⤵
  PID:1927
- /usr/bin/uptime
  uptime
  2⤵
  PID:1928
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1929
- /usr/bin/uptime
  uptime
  2⤵
  PID:1930
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1931
- /usr/bin/uptime
  uptime
  2⤵
  PID:1932
- /usr/bin/free
  free -m
  2⤵
  PID:1933
- /usr/bin/uptime
  uptime
  2⤵
  PID:1934
- /usr/bin/free
  free -m
  2⤵
  PID:1936
- /usr/bin/uptime
  uptime
  2⤵
  PID:1937
- /usr/bin/free
  free -m
  2⤵
  PID:1938
- /usr/bin/uptime
  uptime
  2⤵
  PID:1939
- /usr/bin/free
  free -m
  2⤵
  PID:1940
- /usr/bin/uptime
  uptime
  2⤵
  PID:1941
- /usr/bin/free
  free -m
  2⤵
  PID:1942
- /usr/bin/uptime
  uptime
  2⤵
  - Reads CPU attributes
  PID:1943
- /usr/bin/free
  free -m
  2⤵
  PID:1944
- /usr/bin/uptime
  uptime
  2⤵
  PID:1945
- /usr/bin/free
  free -m
  2⤵
  PID:1946
- /usr/bin/uptime
  uptime
  2⤵
  PID:1947
- /usr/bin/free
  free -m
  2⤵
  PID:1948
- /usr/bin/uptime
  uptime
  2⤵
  PID:1949
- /usr/bin/free
  free -m
  2⤵
  PID:1950
- /usr/bin/uptime
  uptime
  2⤵
  PID:1951
- /usr/bin/free
  free -m
  2⤵
  PID:1952
- /usr/bin/uptime
  uptime
  2⤵
  PID:1953
- /usr/bin/free
  free -m
  2⤵
  - Reads runtime system information
  PID:1956
- /usr/bin/uptime
  uptime
  2⤵
  PID:1957
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1958
- /usr/bin/uptime
  uptime
  2⤵
  PID:1959
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1960
- /usr/bin/uptime
  uptime
  2⤵
  - Reads runtime system information
  PID:1961
- /usr/bin/free
  free -m
  2⤵
  PID:1962
- /usr/bin/uptime
  uptime
  2⤵
  PID:1963
- /usr/bin/free
  free -m
  2⤵
  PID:1964
- /usr/bin/uptime
  uptime
  2⤵
  PID:1965
- /usr/bin/free
  free -m
  2⤵
  PID:1966
- /usr/bin/uptime
  uptime
  2⤵
  PID:1967
- /usr/bin/free
  free -m
  2⤵
  - Reads CPU attributes
  PID:1968
- /usr/bin/uptime
  uptime
  2⤵
  PID:1969
- /usr/bin/free
  free -m
  2⤵
  PID:1970
- /usr/bin/uptime
  uptime
  2⤵
  PID:1971
- /usr/bin/free
  free -m
  2⤵
  PID:1972
- /usr/bin/uptime
  uptime
  2⤵
  PID:1973
- /usr/bin/free
  free -m
  2⤵
  PID:1974
- /usr/bin/uptime
  uptime
  2⤵
  PID:1975
- /usr/bin/free
  free -m
  2⤵
  PID:1976
- /usr/bin/uptime
  uptime
  2⤵
  PID:1977
- /usr/bin/free
  free -m
  2⤵
  PID:1978
- /usr/bin/uptime
  uptime
  2⤵
  PID:1979

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys

Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit