165fb59360683122125271d668cfb28c3ad9502d559e491856005178fb22a254

Resubmissions

29-04-2024 17:56

240429-wjgllsgg29 10

17-04-2024 14:59

240417-sc15wsef8y 10

16-04-2024 14:20

240416-rnxq6sdg3t 10

Analysis

max time kernel
1800s
max time network
1799s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29-04-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
Size

8.7MB
MD5

0263de27fd997a4904ee4a92f91ac733
SHA1

da090fd76b2d92320cf7e55666bb5bd8f50796c9
SHA256

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
SHA512

09ef02532eb7c3a968c1d04bf1f3aa9a4bf400f8485d3be596d7db3aed5f705fc1f85a1f6218397a70830ad747aa03c61b9c5b1cca24c2620cdbb3e5361db194
SSDEEP

98304:bKwGam/zeDrZCDcryHlc5Qp+FLk0h6u9SrS2D8t7Xk:bKwGam/z4C3FKQ8FLTh6u9S4

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
persistence

Processes:

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

description ioc process

File opened for modification /root/.ssh/authorized_keys 0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
Deletes itself 1 IoCs

Processes:

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

pid process

1563 0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

description	ioc	process
File opened for modification	/root/.ssh/authorized_keys	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

pid	process
1563	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

description	ioc	process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732

Enumerates running processes
Discovers information about currently running processes on the system
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

uptimeuptimeuptimefreefreefreeuptimeuptimeuptimefreeuptimefreefreefreefreefreeuptimefreeuptimefreefreeuptimeuptimefreefreefreefreeuptimeuptimefreeuptimeuptimefreeuptimeuptimeuptimefreeuptimeuptimefreefreefreefreeuptimeuptimefreeuptimeuptimefreefreefreefreefreefreeuptimefreefreeuptimefreefreefreeuptimefreeuptime

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

uptimeuptimefreeuptimeuptimefreeuptimeuptimefree0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732uptimefreefreeuptimefreefreeuptimeuptimeuptimeuptimefreeuptimeuptimeuptimefreeuptimefreeuptimeuptimefreefreeuptimeuptimeuptimeuptimeuptimeuptimeuptimeuptimefreefreefree

description	ioc	process
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1132/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/674/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1170/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/1139/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/1861/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/492/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1207/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/1105/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/484/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1164/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/651/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1320/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/613/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/32/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/98/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/476/stat	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1147/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/1253/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/536/cmdline	0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
File opened for reading	/proc/sys/kernel/osrelease	free

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
1⤵
- Adds new SSH keys
- Deletes itself
- Deletes log files
- Reads runtime system information
PID:1563

/bin/uname
uname -a
2⤵
PID:1574

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1575

/bin/cat
cat /etc/issue
2⤵
PID:1576

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1577

/usr/bin/uptime
uptime
2⤵
PID:1578

/bin/journalctl
journalctl -S "@0" -u sshd
2⤵
PID:1583

/bin/cat
cat "/var/log/auth*"
2⤵
PID:1584

/bin/zcat
zcat "/var/log/auth*"
2⤵
PID:1585

/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1585

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1586

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1587

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1588

/usr/bin/uptime
uptime
2⤵
PID:1589

/usr/bin/free
free -m
2⤵
PID:1592

/usr/bin/uptime
uptime
2⤵
PID:1593

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1594

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1595

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1596

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1597

/usr/bin/free
free -m
2⤵
PID:1598

/usr/bin/uptime
uptime
2⤵
PID:1599

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1600

/usr/bin/uptime
uptime
2⤵
PID:1601

/usr/bin/free
free -m
2⤵
PID:1602

/usr/bin/uptime
uptime
2⤵
PID:1603

/usr/bin/free
free -m
2⤵
PID:1604

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1605

/usr/bin/free
free -m
2⤵
PID:1606

/usr/bin/uptime
uptime
2⤵
PID:1607

/usr/bin/free
free -m
2⤵
PID:1608

/usr/bin/uptime
uptime
2⤵
PID:1609

/usr/bin/free
free -m
2⤵
PID:1610

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1611

/usr/bin/free
free -m
2⤵
PID:1612

/usr/bin/uptime
uptime
2⤵
PID:1613

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1614

/usr/bin/uptime
uptime
2⤵
PID:1615

/usr/bin/free
free -m
2⤵
PID:1616

/usr/bin/uptime
uptime
2⤵
PID:1617

/usr/bin/free
free -m
2⤵
PID:1618

/usr/bin/uptime
uptime
2⤵
PID:1619

/usr/bin/free
free -m
2⤵
PID:1620

/usr/bin/uptime
uptime
2⤵
PID:1621

/usr/bin/free
free -m
2⤵
PID:1624

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1625

/usr/bin/free
free -m
2⤵
PID:1626

/usr/bin/uptime
uptime
2⤵
PID:1627

/usr/bin/free
free -m
2⤵
PID:1628

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1629

/usr/bin/free
free -m
2⤵
PID:1630

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1631

/usr/bin/free
free -m
2⤵
PID:1632

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1633

/usr/bin/free
free -m
2⤵
PID:1634

/usr/bin/uptime
uptime
2⤵
PID:1635

/usr/bin/free
free -m
2⤵
PID:1636

/usr/bin/uptime
uptime
2⤵
PID:1637

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1638

/usr/bin/uptime
uptime
2⤵
PID:1639

/usr/bin/free
free -m
2⤵
PID:1640

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1641

/usr/bin/free
free -m
2⤵
PID:1642

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1643

/usr/bin/free
free -m
2⤵
PID:1644

/usr/bin/uptime
uptime
2⤵
PID:1645

/usr/bin/free
free -m
2⤵
PID:1646

/usr/bin/uptime
uptime
2⤵
PID:1647

/usr/bin/free
free -m
2⤵
PID:1648

/usr/bin/uptime
uptime
2⤵
PID:1649

/usr/bin/free
free -m
2⤵
PID:1650

/usr/bin/uptime
uptime
2⤵
PID:1651

/usr/bin/free
free -m
2⤵
PID:1652

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1653

/usr/bin/free
free -m
2⤵
PID:1655

/usr/bin/uptime
uptime
2⤵
PID:1656

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1657

/usr/bin/uptime
uptime
2⤵
PID:1658

/usr/bin/free
free -m
2⤵
PID:1659

/usr/bin/uptime
uptime
2⤵
PID:1660

/usr/bin/free
free -m
2⤵
PID:1661

/usr/bin/uptime
uptime
2⤵
PID:1662

/usr/bin/free
free -m
2⤵
PID:1663

/usr/bin/uptime
uptime
2⤵
PID:1664

/usr/bin/free
free -m
2⤵
PID:1665

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1666

/usr/bin/free
free -m
2⤵
PID:1667

/usr/bin/uptime
uptime
2⤵
PID:1668

/usr/bin/free
free -m
2⤵
PID:1669

/usr/bin/uptime
uptime
2⤵
PID:1670

/usr/bin/free
free -m
2⤵
PID:1671

/usr/bin/uptime
uptime
2⤵
PID:1672

/usr/bin/free
free -m
2⤵
PID:1673

/usr/bin/uptime
uptime
2⤵
PID:1674

/usr/bin/free
free -m
2⤵
PID:1675

/usr/bin/uptime
uptime
2⤵
PID:1676

/usr/bin/free
free -m
2⤵
PID:1677

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1678

/usr/bin/free
free -m
2⤵
PID:1679

/usr/bin/uptime
uptime
2⤵
PID:1680

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1681

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1682

/usr/bin/free
free -m
2⤵
PID:1683

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1684

/usr/bin/free
free -m
2⤵
PID:1705

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1706

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1707

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1708

/usr/bin/free
free -m
2⤵
PID:1709

/usr/bin/uptime
uptime
2⤵
PID:1710

/usr/bin/free
free -m
2⤵
PID:1711

/usr/bin/uptime
uptime
2⤵
PID:1712

/usr/bin/free
free -m
2⤵
PID:1713

/usr/bin/uptime
uptime
2⤵
PID:1714

/usr/bin/free
free -m
2⤵
PID:1715

/usr/bin/uptime
uptime
2⤵
PID:1716

/usr/bin/free
free -m
2⤵
PID:1717

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1718

/usr/bin/free
free -m
2⤵
PID:1719

/usr/bin/uptime
uptime
2⤵
PID:1720

/usr/bin/free
free -m
2⤵
PID:1721

/usr/bin/uptime
uptime
2⤵
PID:1722

/usr/bin/free
free -m
2⤵
PID:1723

/usr/bin/uptime
uptime
2⤵
PID:1724

/usr/bin/free
free -m
2⤵
PID:1725

/usr/bin/uptime
uptime
2⤵
PID:1726

/usr/bin/free
free -m
2⤵
PID:1727

/usr/bin/uptime
uptime
2⤵
PID:1728

/usr/bin/free
free -m
2⤵
PID:1729

/usr/bin/uptime
uptime
2⤵
PID:1730

/usr/bin/free
free -m
2⤵
PID:1731

/usr/bin/uptime
uptime
2⤵
PID:1732

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1733

/usr/bin/uptime
uptime
2⤵
PID:1734

/usr/bin/free
free -m
2⤵
PID:1735

/usr/bin/uptime
uptime
2⤵
PID:1736

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1737

/usr/bin/uptime
uptime
2⤵
PID:1738

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1739

/usr/bin/uptime
uptime
2⤵
PID:1740

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1741

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1742

/usr/bin/free
free -m
2⤵
PID:1743

/usr/bin/uptime
uptime
2⤵
PID:1744

/usr/bin/free
free -m
2⤵
PID:1745

/usr/bin/uptime
uptime
2⤵
PID:1746

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1747

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1748

/usr/bin/free
free -m
2⤵
PID:1749

/usr/bin/uptime
uptime
2⤵
PID:1750

/usr/bin/free
free -m
2⤵
PID:1751

/usr/bin/uptime
uptime
2⤵
PID:1752

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1753

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1754

/usr/bin/free
free -m
2⤵
PID:1755

/usr/bin/uptime
uptime
2⤵
PID:1756

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1757

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1758

/usr/bin/free
free -m
2⤵
PID:1759

/usr/bin/uptime
uptime
2⤵
PID:1760

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1761

/usr/bin/uptime
uptime
2⤵
PID:1762

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1763

/usr/bin/uptime
uptime
2⤵
PID:1764

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1768

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1769

/usr/bin/free
free -m
2⤵
PID:1770

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1771

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1772

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1773

/usr/bin/free
free -m
2⤵
PID:1774

/usr/bin/uptime
uptime
2⤵
PID:1775

/usr/bin/free
free -m
2⤵
PID:1776

/usr/bin/uptime
uptime
2⤵
PID:1777

/usr/bin/free
free -m
2⤵
PID:1778

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1779

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1780

/usr/bin/uptime
uptime
2⤵
PID:1781

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1782

/usr/bin/uptime
uptime
2⤵
PID:1783

/usr/bin/free
free -m
2⤵
PID:1784

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1785

/usr/bin/free
free -m
2⤵
PID:1786

/usr/bin/uptime
uptime
2⤵
PID:1787

/usr/bin/free
free -m
2⤵
PID:1788

/usr/bin/uptime
uptime
2⤵
PID:1789

/usr/bin/free
free -m
2⤵
PID:1790

/usr/bin/uptime
uptime
2⤵
PID:1791

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1792

/usr/bin/uptime
uptime
2⤵
PID:1793

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1794

/usr/bin/uptime
uptime
2⤵
PID:1795

/usr/bin/free
free -m
2⤵
PID:1796

/usr/bin/uptime
uptime
2⤵
PID:1797

/usr/bin/free
free -m
2⤵
PID:1798

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1799

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1800

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1801

/usr/bin/free
free -m
2⤵
PID:1802

/usr/bin/uptime
uptime
2⤵
PID:1803

/usr/bin/free
free -m
2⤵
PID:1804

/usr/bin/uptime
uptime
2⤵
PID:1805

/usr/bin/free
free -m
2⤵
PID:1806

/usr/bin/uptime
uptime
2⤵
PID:1807

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1808

/usr/bin/uptime
uptime
2⤵
PID:1809

/usr/bin/free
free -m
2⤵
PID:1810

/usr/bin/uptime
uptime
2⤵
PID:1811

/usr/bin/free
free -m
2⤵
PID:1812

/usr/bin/uptime
uptime
2⤵
PID:1813

/usr/bin/free
free -m
2⤵
PID:1814

/usr/bin/uptime
uptime
2⤵
PID:1815

/usr/bin/free
free -m
2⤵
PID:1816

/usr/bin/uptime
uptime
2⤵
PID:1817

/usr/bin/free
free -m
2⤵
PID:1818

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1819

/usr/bin/free
free -m
2⤵
PID:1820

/usr/bin/uptime
uptime
2⤵
PID:1821

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1822

/usr/bin/uptime
uptime
2⤵
PID:1823

/usr/bin/free
free -m
2⤵
PID:1824

/usr/bin/uptime
uptime
2⤵
PID:1825

/usr/bin/free
free -m
2⤵
PID:1826

/usr/bin/uptime
uptime
2⤵
PID:1827

/usr/bin/free
free -m
2⤵
PID:1831

/usr/bin/uptime
uptime
2⤵
PID:1832

/usr/bin/free
free -m
2⤵
PID:1833

/usr/bin/uptime
uptime
2⤵
PID:1834

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1835

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1836

/usr/bin/free
free -m
2⤵
PID:1837

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1838

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1839

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1840

/usr/bin/free
free -m
2⤵
PID:1841

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1842

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1843

/usr/bin/uptime
uptime
2⤵
PID:1844

/usr/bin/free
free -m
2⤵
PID:1845

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1846

/usr/bin/free
free -m
2⤵
PID:1847

/usr/bin/uptime
uptime
2⤵
PID:1848

/usr/bin/free
free -m
2⤵
PID:1849

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1850

/usr/bin/free
free -m
2⤵
PID:1851

/usr/bin/uptime
uptime
2⤵
PID:1852

/usr/bin/free
free -m
2⤵
PID:1853

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1854

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1855

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1856

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1857

/usr/bin/uptime
uptime
2⤵
PID:1858

/usr/bin/free
free -m
2⤵
PID:1859

/usr/bin/uptime
uptime
2⤵
PID:1860

/usr/bin/free
free -m
2⤵
PID:1862

/usr/bin/uptime
uptime
2⤵
PID:1863

/usr/bin/free
free -m
2⤵
PID:1864

/usr/bin/uptime
uptime
2⤵
PID:1865

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1866

/usr/bin/uptime
uptime
2⤵
PID:1867

/usr/bin/free
free -m
2⤵
PID:1868

/usr/bin/uptime
uptime
2⤵
PID:1869

/usr/bin/free
free -m
2⤵
PID:1870

/usr/bin/uptime
uptime
2⤵
PID:1871

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1872

/usr/bin/uptime
uptime
2⤵
PID:1873

/usr/bin/free
free -m
2⤵
PID:1874

/usr/bin/uptime
uptime
2⤵
PID:1875

/usr/bin/free
free -m
2⤵
PID:1876

/usr/bin/uptime
uptime
2⤵
PID:1877

/usr/bin/free
free -m
2⤵
PID:1878

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1879

/usr/bin/free
free -m
2⤵
PID:1880

/usr/bin/uptime
uptime
2⤵
PID:1881

/usr/bin/free
free -m
2⤵
PID:1882

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1883

/usr/bin/free
free -m
2⤵
PID:1884

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1885

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1886

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1887

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1888

/usr/bin/uptime
uptime
2⤵
PID:1889

/usr/bin/free
free -m
2⤵
PID:1890

/usr/bin/uptime
uptime
2⤵
PID:1891

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1893

/usr/bin/uptime
uptime
2⤵
PID:1894

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1895

/usr/bin/uptime
uptime
2⤵
PID:1896

/usr/bin/free
free -m
2⤵
PID:1897

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1898

/usr/bin/free
free -m
2⤵
PID:1899

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1900

/usr/bin/free
free -m
2⤵
PID:1901

/usr/bin/uptime
uptime
2⤵
PID:1902

/usr/bin/free
free -m
2⤵
PID:1903

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1904

/usr/bin/free
free -m
2⤵
PID:1905

/usr/bin/uptime
uptime
2⤵
PID:1906

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1907

/usr/bin/uptime
uptime
2⤵
PID:1908

/usr/bin/free
free -m
2⤵
PID:1909

/usr/bin/uptime
uptime
2⤵
PID:1910

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1911

/usr/bin/uptime
uptime
2⤵
PID:1912

/usr/bin/free
free -m
2⤵
PID:1913

/usr/bin/uptime
uptime
2⤵
PID:1914

/usr/bin/free
free -m
2⤵
PID:1915

/usr/bin/uptime
uptime
2⤵
PID:1916

/usr/bin/free
free -m
2⤵
PID:1917

/usr/bin/uptime
uptime
2⤵
PID:1918

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1919

/usr/bin/uptime
uptime
2⤵
PID:1920

/usr/bin/free
free -m
2⤵
PID:1921

/usr/bin/uptime
uptime
2⤵
PID:1922

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1923

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1924

/usr/bin/free
free -m
2⤵
PID:1925

/usr/bin/uptime
uptime
2⤵
PID:1926

/usr/bin/free
free -m
2⤵
PID:1927

/usr/bin/uptime
uptime
2⤵
PID:1928

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1929

/usr/bin/uptime
uptime
2⤵
PID:1930

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1931

/usr/bin/uptime
uptime
2⤵
PID:1932

/usr/bin/free
free -m
2⤵
PID:1933

/usr/bin/uptime
uptime
2⤵
PID:1934

/usr/bin/free
free -m
2⤵
PID:1936

/usr/bin/uptime
uptime
2⤵
PID:1937

/usr/bin/free
free -m
2⤵
PID:1938

/usr/bin/uptime
uptime
2⤵
PID:1939

/usr/bin/free
free -m
2⤵
PID:1940

/usr/bin/uptime
uptime
2⤵
PID:1941

/usr/bin/free
free -m
2⤵
PID:1942

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1943

/usr/bin/free
free -m
2⤵
PID:1944

/usr/bin/uptime
uptime
2⤵
PID:1945

/usr/bin/free
free -m
2⤵
PID:1946

/usr/bin/uptime
uptime
2⤵
PID:1947

/usr/bin/free
free -m
2⤵
PID:1948

/usr/bin/uptime
uptime
2⤵
PID:1949

/usr/bin/free
free -m
2⤵
PID:1950

/usr/bin/uptime
uptime
2⤵
PID:1951

/usr/bin/free
free -m
2⤵
PID:1952

/usr/bin/uptime
uptime
2⤵
PID:1953

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1956

/usr/bin/uptime
uptime
2⤵
PID:1957

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1958

/usr/bin/uptime
uptime
2⤵
PID:1959

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1960

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1961

/usr/bin/free
free -m
2⤵
PID:1962

/usr/bin/uptime
uptime
2⤵
PID:1963

/usr/bin/free
free -m
2⤵
PID:1964

/usr/bin/uptime
uptime
2⤵
PID:1965

/usr/bin/free
free -m
2⤵
PID:1966

/usr/bin/uptime
uptime
2⤵
PID:1967

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1968

/usr/bin/uptime
uptime
2⤵
PID:1969

/usr/bin/free
free -m
2⤵
PID:1970

/usr/bin/uptime
uptime
2⤵
PID:1971

/usr/bin/free
free -m
2⤵
PID:1972

/usr/bin/uptime
uptime
2⤵
PID:1973

/usr/bin/free
free -m
2⤵
PID:1974

/usr/bin/uptime
uptime
2⤵
PID:1975

/usr/bin/free
free -m
2⤵
PID:1976

/usr/bin/uptime
uptime
2⤵
PID:1977

/usr/bin/free
free -m
2⤵
PID:1978

/usr/bin/uptime
uptime
2⤵
PID:1979

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys
Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit