165fb59360683122125271d668cfb28c3ad9502d559e491856005178fb22a254

Resubmissions

29-04-2024 17:56

240429-wjgllsgg29 10

17-04-2024 14:59

240417-sc15wsef8y 10

16-04-2024 14:20

240416-rnxq6sdg3t 10

Analysis

max time kernel
1799s
max time network
1798s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240418-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240418-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29-04-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
Size

8.7MB
MD5

3fe7b88a9ba6c5acee4faae760642b78
SHA1

bae245bc98c516604838c6ce5a233f066de44a50
SHA256

6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
SHA512

02abc8d4fe280306a9ac6a25d28cf174a8d51a43d98b6837bc129701d8c0ab486eebaeef11062b58c455627d4de7c8782b3828aa02891fe439ca1ca617038f95
SSDEEP

98304:g4K0/V2eKEDj+VK61qXXiQqwMwUa/f0OstejSUVv7Xk:g4K0/V2eKM+D4SQbMwX/f0Oskz

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
persistence

Processes:

6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c

description ioc process

File opened for modification /root/.ssh/authorized_keys 6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
Deletes itself 1 IoCs

Processes:

pid

1545

description	ioc	process
File opened for modification	/root/.ssh/authorized_keys	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c

pid
1545

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c

description	ioc	process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c

Enumerates running processes
Discovers information about currently running processes on the system
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

uptimefreeuptimefreeuptimeuptimeuptimefreefreeuptimeuptimeuptimefreefreeuptimefreefreeuptimeuptimefreeuptimefreeuptimeuptimefreefreeuptimefreefreeuptimeuptimefreefreefreefreefreeuptimeuptimefreeuptimeuptimeuptimeuptimefreefreeuptimefreeuptimefreefreefreeuptimefreeuptimefreefreeuptimefreeuptimeuptimeuptimeuptimefreefree

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69cfreefreefreeuptimeuptimefreeuptimeuptimeuptimeuptimefreeuptimefreeuptimejournalctluptimeuptimeuptimeuptimeuptimefreeuptimefreeuptimefreefreefreeuptimeuptimefreeuptimefreeuptimeuptimefreeuptimeuptime

description	ioc	process
File opened for reading	/proc/542/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/net/core/somaxconn	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/162/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/98/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1996/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/1082/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1883/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/1997/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/1999/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/973/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/311/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/81/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/609/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1814/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/1119/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/self/stat	journalctl
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/25/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/1/environ	journalctl
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1472/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/203/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/23/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/19/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/30/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1079/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/167/stat	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/4/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/646/cmdline	6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/loadavg	uptime

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/6fe6808b9cfe654f526108ec61cb5211bb6601d28e192cadf06102073b54f69c
1⤵
- Adds new SSH keys
- Deletes log files
- Reads runtime system information
PID:1543

/bin/uname
uname -a
2⤵
PID:1555

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1560

/bin/cat
cat /etc/issue
2⤵
PID:1561

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1562

/usr/bin/uptime
uptime
2⤵
PID:1563

/bin/journalctl
journalctl -S "@0" -u sshd
2⤵
- Reads runtime system information
PID:1564

/bin/cat
cat "/var/log/auth*"
2⤵
PID:1565

/bin/zcat
zcat "/var/log/auth*"
2⤵
PID:1566

/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1566

/usr/bin/free
free -m
2⤵
PID:1567

/usr/bin/uptime
uptime
2⤵
PID:1568

/usr/bin/free
free -m
2⤵
PID:1569

/usr/bin/uptime
uptime
2⤵
PID:1570

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1573

/usr/bin/uptime
uptime
2⤵
PID:1574

/usr/bin/free
free -m
2⤵
PID:1575

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1576

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1577

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1578

/usr/bin/free
free -m
2⤵
PID:1579

/usr/bin/uptime
uptime
2⤵
PID:1580

/usr/bin/free
free -m
2⤵
PID:1581

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1582

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1583

/usr/bin/uptime
uptime
2⤵
PID:1584

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1585

/usr/bin/uptime
uptime
2⤵
PID:1586

/usr/bin/free
free -m
2⤵
PID:1587

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1588

/usr/bin/free
free -m
2⤵
PID:1589

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1590

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1591

/usr/bin/uptime
uptime
2⤵
PID:1592

/usr/bin/free
free -m
2⤵
PID:1593

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1594

/usr/bin/free
free -m
2⤵
PID:1595

/usr/bin/uptime
uptime
2⤵
PID:1596

/usr/bin/free
free -m
2⤵
PID:1597

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1598

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1599

/usr/bin/uptime
uptime
2⤵
PID:1600

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1601

/usr/bin/uptime
uptime
2⤵
PID:1602

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1605

/usr/bin/uptime
uptime
2⤵
PID:1606

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1607

/usr/bin/uptime
uptime
2⤵
PID:1608

/usr/bin/free
free -m
2⤵
PID:1609

/usr/bin/uptime
uptime
2⤵
PID:1610

/usr/bin/free
free -m
2⤵
PID:1611

/usr/bin/uptime
uptime
2⤵
PID:1612

/usr/bin/free
free -m
2⤵
PID:1613

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1614

/usr/bin/free
free -m
2⤵
PID:1615

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1616

/usr/bin/free
free -m
2⤵
PID:1617

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1618

/usr/bin/free
free -m
2⤵
PID:1619

/usr/bin/uptime
uptime
2⤵
PID:1620

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1621

/usr/bin/uptime
uptime
2⤵
PID:1622

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1623

/usr/bin/uptime
uptime
2⤵
PID:1624

/usr/bin/free
free -m
2⤵
PID:1625

/usr/bin/uptime
uptime
2⤵
PID:1626

/usr/bin/free
free -m
2⤵
PID:1627

/usr/bin/uptime
uptime
2⤵
PID:1628

/usr/bin/free
free -m
2⤵
PID:1629

/usr/bin/uptime
uptime
2⤵
PID:1630

/usr/bin/free
free -m
2⤵
PID:1631

/usr/bin/uptime
uptime
2⤵
PID:1632

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1633

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1634

/usr/bin/free
free -m
2⤵
PID:1636

/usr/bin/uptime
uptime
2⤵
PID:1637

/usr/bin/free
free -m
2⤵
PID:1638

/usr/bin/uptime
uptime
2⤵
PID:1639

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1640

/usr/bin/uptime
uptime
2⤵
PID:1641

/usr/bin/free
free -m
2⤵
PID:1642

/usr/bin/uptime
uptime
2⤵
PID:1643

/usr/bin/free
free -m
2⤵
PID:1644

/usr/bin/uptime
uptime
2⤵
PID:1645

/usr/bin/free
free -m
2⤵
PID:1646

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1647

/usr/bin/free
free -m
2⤵
PID:1648

/usr/bin/uptime
uptime
2⤵
PID:1649

/usr/bin/free
free -m
2⤵
PID:1650

/usr/bin/uptime
uptime
2⤵
PID:1651

/usr/bin/free
free -m
2⤵
PID:1652

/usr/bin/uptime
uptime
2⤵
PID:1653

/usr/bin/free
free -m
2⤵
PID:1654

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1655

/usr/bin/free
free -m
2⤵
PID:1656

/usr/bin/uptime
uptime
2⤵
PID:1657

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1658

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1659

/usr/bin/free
free -m
2⤵
PID:1660

/usr/bin/uptime
uptime
2⤵
PID:1661

/usr/bin/free
free -m
2⤵
PID:1662

/usr/bin/uptime
uptime
2⤵
PID:1663

/usr/bin/free
free -m
2⤵
PID:1664

/usr/bin/uptime
uptime
2⤵
PID:1665

/usr/bin/free
free -m
2⤵
PID:1686

/usr/bin/uptime
uptime
2⤵
PID:1687

/usr/bin/free
free -m
2⤵
PID:1688

/usr/bin/uptime
uptime
2⤵
PID:1689

/usr/bin/free
free -m
2⤵
PID:1690

/usr/bin/uptime
uptime
2⤵
PID:1691

/usr/bin/free
free -m
2⤵
PID:1692

/usr/bin/uptime
uptime
2⤵
PID:1693

/usr/bin/free
free -m
2⤵
PID:1694

/usr/bin/uptime
uptime
2⤵
PID:1695

/usr/bin/free
free -m
2⤵
PID:1696

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1697

/usr/bin/free
free -m
2⤵
PID:1698

/usr/bin/uptime
uptime
2⤵
PID:1699

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1700

/usr/bin/uptime
uptime
2⤵
PID:1701

/usr/bin/free
free -m
2⤵
PID:1702

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1703

/usr/bin/free
free -m
2⤵
PID:1704

/usr/bin/uptime
uptime
2⤵
PID:1705

/usr/bin/free
free -m
2⤵
PID:1706

/usr/bin/uptime
uptime
2⤵
PID:1707

/usr/bin/free
free -m
2⤵
PID:1708

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1709

/usr/bin/free
free -m
2⤵
PID:1710

/usr/bin/uptime
uptime
2⤵
PID:1711

/usr/bin/free
free -m
2⤵
PID:1712

/usr/bin/uptime
uptime
2⤵
PID:1713

/usr/bin/free
free -m
2⤵
PID:1714

/usr/bin/uptime
uptime
2⤵
PID:1715

/usr/bin/free
free -m
2⤵
PID:1716

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1717

/usr/bin/free
free -m
2⤵
PID:1718

/usr/bin/uptime
uptime
2⤵
PID:1719

/usr/bin/free
free -m
2⤵
PID:1720

/usr/bin/uptime
uptime
2⤵
PID:1721

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1722

/usr/bin/uptime
uptime
2⤵
PID:1723

/usr/bin/free
free -m
2⤵
PID:1724

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1725

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1726

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1727

/usr/bin/free
free -m
2⤵
PID:1728

/usr/bin/uptime
uptime
2⤵
PID:1729

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1730

/usr/bin/uptime
uptime
2⤵
PID:1731

/usr/bin/free
free -m
2⤵
PID:1732

/usr/bin/uptime
uptime
2⤵
PID:1733

/usr/bin/free
free -m
2⤵
PID:1734

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1735

/usr/bin/free
free -m
2⤵
PID:1736

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1737

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1738

/usr/bin/uptime
uptime
2⤵
PID:1739

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1740

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1741

/usr/bin/free
free -m
2⤵
PID:1742

/usr/bin/uptime
uptime
2⤵
PID:1743

/usr/bin/free
free -m
2⤵
PID:1744

/usr/bin/uptime
uptime
2⤵
PID:1745

/usr/bin/free
free -m
2⤵
PID:1749

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1750

/usr/bin/free
free -m
2⤵
PID:1751

/usr/bin/uptime
uptime
2⤵
PID:1752

/usr/bin/free
free -m
2⤵
PID:1753

/usr/bin/uptime
uptime
2⤵
PID:1754

/usr/bin/free
free -m
2⤵
PID:1755

/usr/bin/uptime
uptime
2⤵
PID:1756

/usr/bin/free
free -m
2⤵
PID:1757

/usr/bin/uptime
uptime
2⤵
PID:1758

/usr/bin/free
free -m
2⤵
PID:1759

/usr/bin/uptime
uptime
2⤵
PID:1760

/usr/bin/free
free -m
2⤵
PID:1761

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1762

/usr/bin/free
free -m
2⤵
PID:1763

/usr/bin/uptime
uptime
2⤵
PID:1764

/usr/bin/free
free -m
2⤵
PID:1765

/usr/bin/uptime
uptime
2⤵
PID:1766

/usr/bin/free
free -m
2⤵
PID:1767

/usr/bin/uptime
uptime
2⤵
PID:1768

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1769

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1770

/usr/bin/free
free -m
2⤵
PID:1771

/usr/bin/uptime
uptime
2⤵
PID:1772

/usr/bin/free
free -m
2⤵
PID:1773

/usr/bin/uptime
uptime
2⤵
PID:1774

/usr/bin/free
free -m
2⤵
PID:1775

/usr/bin/uptime
uptime
2⤵
PID:1776

/usr/bin/free
free -m
2⤵
PID:1777

/usr/bin/uptime
uptime
2⤵
PID:1778

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1779

/usr/bin/uptime
uptime
2⤵
PID:1780

/usr/bin/free
free -m
2⤵
PID:1781

/usr/bin/uptime
uptime
2⤵
PID:1782

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1783

/usr/bin/uptime
uptime
2⤵
PID:1784

/usr/bin/free
free -m
2⤵
PID:1785

/usr/bin/uptime
uptime
2⤵
PID:1786

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1787

/usr/bin/uptime
uptime
2⤵
PID:1788

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1789

/usr/bin/uptime
uptime
2⤵
PID:1790

/usr/bin/free
free -m
2⤵
PID:1791

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1792

/usr/bin/free
free -m
2⤵
PID:1793

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1794

/usr/bin/free
free -m
2⤵
PID:1795

/usr/bin/uptime
uptime
2⤵
PID:1796

/usr/bin/free
free -m
2⤵
PID:1797

/usr/bin/uptime
uptime
2⤵
PID:1798

/usr/bin/free
free -m
2⤵
PID:1799

/usr/bin/uptime
uptime
2⤵
PID:1800

/usr/bin/free
free -m
2⤵
PID:1801

/usr/bin/uptime
uptime
2⤵
PID:1802

/usr/bin/free
free -m
2⤵
PID:1803

/usr/bin/uptime
uptime
2⤵
PID:1804

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1805

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1806

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1807

/usr/bin/uptime
uptime
2⤵
PID:1808

/usr/bin/free
free -m
2⤵
PID:1812

/usr/bin/uptime
uptime
2⤵
PID:1813

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1815

/usr/bin/uptime
uptime
2⤵
PID:1816

/usr/bin/free
free -m
2⤵
PID:1817

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1818

/usr/bin/free
free -m
2⤵
PID:1819

/usr/bin/uptime
uptime
2⤵
PID:1820

/usr/bin/free
free -m
2⤵
PID:1821

/usr/bin/uptime
uptime
2⤵
PID:1822

/usr/bin/free
free -m
2⤵
PID:1823

/usr/bin/uptime
uptime
2⤵
PID:1824

/usr/bin/free
free -m
2⤵
PID:1825

/usr/bin/uptime
uptime
2⤵
PID:1826

/usr/bin/free
free -m
2⤵
PID:1827

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1828

/usr/bin/free
free -m
2⤵
PID:1829

/usr/bin/uptime
uptime
2⤵
PID:1830

/usr/bin/free
free -m
2⤵
PID:1831

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1832

/usr/bin/free
free -m
2⤵
PID:1833

/usr/bin/uptime
uptime
2⤵
PID:1834

/usr/bin/free
free -m
2⤵
PID:1835

/usr/bin/uptime
uptime
2⤵
PID:1836

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1837

/usr/bin/uptime
uptime
2⤵
PID:1838

/usr/bin/free
free -m
2⤵
PID:1839

/usr/bin/uptime
uptime
2⤵
PID:1840

/usr/bin/free
free -m
2⤵
PID:1841

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1842

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1843

/usr/bin/uptime
uptime
2⤵
PID:1844

/usr/bin/free
free -m
2⤵
PID:1845

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1846

/usr/bin/free
free -m
2⤵
PID:1847

/usr/bin/uptime
uptime
2⤵
PID:1848

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1849

/usr/bin/uptime
uptime
2⤵
PID:1850

/usr/bin/free
free -m
2⤵
PID:1851

/usr/bin/uptime
uptime
2⤵
PID:1852

/usr/bin/free
free -m
2⤵
PID:1853

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1854

/usr/bin/free
free -m
2⤵
PID:1855

/usr/bin/uptime
uptime
2⤵
PID:1856

/usr/bin/free
free -m
2⤵
PID:1857

/usr/bin/uptime
uptime
2⤵
PID:1858

/usr/bin/free
free -m
2⤵
PID:1859

/usr/bin/uptime
uptime
2⤵
PID:1860

/usr/bin/free
free -m
2⤵
PID:1861

/usr/bin/uptime
uptime
2⤵
PID:1862

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1863

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1864

/usr/bin/free
free -m
2⤵
PID:1865

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1866

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1867

/usr/bin/uptime
uptime
2⤵
PID:1868

/usr/bin/free
free -m
2⤵
PID:1869

/usr/bin/uptime
uptime
2⤵
PID:1870

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1871

/usr/bin/uptime
uptime
2⤵
PID:1872

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1874

/usr/bin/uptime
uptime
2⤵
PID:1875

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1876

/usr/bin/uptime
uptime
2⤵
PID:1877

/usr/bin/free
free -m
2⤵
PID:1878

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1879

/usr/bin/free
free -m
2⤵
PID:1881

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1882

/usr/bin/free
free -m
2⤵
PID:1884

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1885

/usr/bin/free
free -m
2⤵
PID:1886

/usr/bin/uptime
uptime
2⤵
PID:1887

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1888

/usr/bin/uptime
uptime
2⤵
PID:1889

/usr/bin/free
free -m
2⤵
PID:1890

/usr/bin/uptime
uptime
2⤵
PID:1891

/usr/bin/free
free -m
2⤵
PID:1892

/usr/bin/uptime
uptime
2⤵
PID:1893

/usr/bin/free
free -m
2⤵
PID:1894

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1895

/usr/bin/free
free -m
2⤵
PID:1896

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1897

/usr/bin/free
free -m
2⤵
PID:1898

/usr/bin/uptime
uptime
2⤵
PID:1899

/usr/bin/free
free -m
2⤵
PID:1900

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1901

/usr/bin/free
free -m
2⤵
PID:1902

/usr/bin/uptime
uptime
2⤵
PID:1903

/usr/bin/free
free -m
2⤵
PID:1904

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1905

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1906

/usr/bin/uptime
uptime
2⤵
PID:1907

/usr/bin/free
free -m
2⤵
PID:1908

/usr/bin/uptime
uptime
2⤵
PID:1909

/usr/bin/free
free -m
2⤵
PID:1910

/usr/bin/uptime
uptime
2⤵
PID:1911

/usr/bin/free
free -m
2⤵
PID:1912

/usr/bin/uptime
uptime
2⤵
PID:1913

/usr/bin/free
free -m
2⤵
PID:1914

/usr/bin/uptime
uptime
2⤵
PID:1915

/usr/bin/free
free -m
2⤵
PID:1916

/usr/bin/uptime
uptime
2⤵
PID:1917

/usr/bin/free
free -m
2⤵
PID:1918

/usr/bin/uptime
uptime
2⤵
PID:1919

/usr/bin/free
free -m
2⤵
PID:1920

/usr/bin/uptime
uptime
2⤵
PID:1921

/usr/bin/free
free -m
2⤵
PID:1922

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1923

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1924

/usr/bin/uptime
uptime
2⤵
PID:1925

/usr/bin/free
free -m
2⤵
PID:1926

/usr/bin/uptime
uptime
2⤵
PID:1927

/usr/bin/free
free -m
2⤵
PID:1928

/usr/bin/uptime
uptime
2⤵
PID:1929

/usr/bin/free
free -m
2⤵
PID:1930

/usr/bin/uptime
uptime
2⤵
PID:1931

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1932

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1933

/usr/bin/free
free -m
2⤵
PID:1934

/usr/bin/uptime
uptime
2⤵
PID:1935

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1938

/usr/bin/uptime
uptime
2⤵
PID:1939

/usr/bin/free
free -m
2⤵
PID:1940

/usr/bin/uptime
uptime
2⤵
PID:1941

/usr/bin/free
free -m
2⤵
PID:1942

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1943

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1944

/usr/bin/uptime
uptime
2⤵
PID:1945

/usr/bin/free
free -m
2⤵
PID:2026

/usr/bin/uptime
uptime
2⤵
PID:2027

/usr/bin/free
free -m
2⤵
PID:2028

/usr/bin/uptime
uptime
2⤵
PID:2029

/usr/bin/free
free -m
2⤵
PID:2030

/usr/bin/uptime
uptime
2⤵
PID:2031

/usr/bin/free
free -m
2⤵
PID:2032

/usr/bin/uptime
uptime
2⤵
PID:2033

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2034

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:2035

/usr/bin/free
free -m
2⤵
PID:2036

/usr/bin/uptime
uptime
2⤵
PID:2037

/usr/bin/free
free -m
2⤵
PID:2038

/usr/bin/uptime
uptime
2⤵
PID:2039

/usr/bin/free
free -m
2⤵
PID:2040

/usr/bin/uptime
uptime
2⤵
PID:2041

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys
Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit