165fb59360683122125271d668cfb28c3ad9502d559e491856005178fb22a254

Resubmissions

29-04-2024 17:56

240429-wjgllsgg29 10

17-04-2024 14:59

240417-sc15wsef8y 10

16-04-2024 14:20

240416-rnxq6sdg3t 10

Analysis

max time kernel
1800s
max time network
1796s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29-04-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
Size

8.7MB
MD5

c947363b50231882723bd6b07bc291ca
SHA1

7b9a425f09da9be5dda5facff18c5fd15eed253a
SHA256

985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
SHA512

45f511f6fe78bba853789f85549c8ac591b7812e2fc969a13148bbd1112fa356f6a1ee88a22a907e7f62ef79a0d14d75681eecd2a17f027d105afd381f161184
SSDEEP

98304:vM6uc5LRC1PApsX8mygFiQS8Mi0e6oIOPxOGdG20t7Xk:vM6uc5LRCepmPEQXMir6oIOPoCM

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
persistence

Processes:

985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86

description ioc process

File opened for modification /root/.ssh/authorized_keys 985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
Deletes itself 1 IoCs

Processes:

pid

1599

description	ioc	process
File opened for modification	/root/.ssh/authorized_keys	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86

pid
1599

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86

description	ioc	process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86

Enumerates running processes
Discovers information about currently running processes on the system
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

uptimefreefreefreeuptimefreeuptimefreefreefreefreefreeuptimefreeuptimefreeuptimeuptimefreefreeuptimefreefreefreeuptimeuptimefreefreefreeuptimefreeuptimefreeuptimefreefreeuptimeuptimefreefreefreefreeuptimefreefreefreeuptimefreeuptimeuptimeuptimeuptimeuptimeuptimefreefreefreefreeuptimeuptimefreeuptimefreeuptime

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

uptimeuptime985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86freeuptimefreeuptimeuptimeuptimeuptimefreeuptimeuptimefreeuptimeuptimeuptimefreeuptimefreefreeuptimefreefreeuptimefreefreeuptimeuptimefreeuptimeuptimeuptimeuptimeuptimeuptimefreefreefreefreefreefreefree

description	ioc	process
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/726/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/1139/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/257/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/28/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/16/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/184/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/534/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1107/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/1305/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/81/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/656/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/10/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/1161/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/32/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1041/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/1175/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/494/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/485/cmdline	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/966/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/15/stat	985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	free

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/985ffee662969825146d1b465d068ea4f5f01990d13827511415fd497cf9db86
1⤵
- Adds new SSH keys
- Deletes log files
- Reads runtime system information
PID:1596

/bin/uname
uname -a
2⤵
PID:1607

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1608

/bin/cat
cat /etc/issue
2⤵
PID:1609

/usr/bin/free
free -m
2⤵
PID:1610

/usr/bin/uptime
uptime
2⤵
PID:1611

/bin/journalctl
journalctl -S "@0" -u sshd
2⤵
PID:1615

/bin/cat
cat "/var/log/auth*"
2⤵
PID:1616

/bin/zcat
zcat "/var/log/auth*"
2⤵
PID:1617

/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1617

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1618

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1619

/usr/bin/free
free -m
2⤵
PID:1620

/usr/bin/uptime
uptime
2⤵
PID:1621

/usr/bin/free
free -m
2⤵
PID:1624

/usr/bin/uptime
uptime
2⤵
PID:1625

/usr/bin/free
free -m
2⤵
PID:1626

/usr/bin/uptime
uptime
2⤵
PID:1627

/usr/bin/free
free -m
2⤵
PID:1628

/usr/bin/uptime
uptime
2⤵
PID:1629

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1630

/usr/bin/uptime
uptime
2⤵
PID:1631

/usr/bin/free
free -m
2⤵
PID:1632

/usr/bin/uptime
uptime
2⤵
PID:1633

/usr/bin/free
free -m
2⤵
PID:1634

/usr/bin/uptime
uptime
2⤵
PID:1635

/usr/bin/free
free -m
2⤵
PID:1636

/usr/bin/uptime
uptime
2⤵
PID:1637

/usr/bin/free
free -m
2⤵
PID:1638

/usr/bin/uptime
uptime
2⤵
PID:1639

/usr/bin/free
free -m
2⤵
PID:1640

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1641

/usr/bin/free
free -m
2⤵
PID:1642

/usr/bin/uptime
uptime
2⤵
PID:1643

/usr/bin/free
free -m
2⤵
PID:1644

/usr/bin/uptime
uptime
2⤵
PID:1645

/usr/bin/free
free -m
2⤵
PID:1646

/usr/bin/uptime
uptime
2⤵
PID:1647

/usr/bin/free
free -m
2⤵
PID:1648

/usr/bin/uptime
uptime
2⤵
PID:1649

/usr/bin/free
free -m
2⤵
PID:1650

/usr/bin/uptime
uptime
2⤵
PID:1651

/usr/bin/free
free -m
2⤵
PID:1652

/usr/bin/uptime
uptime
2⤵
PID:1653

/usr/bin/free
free -m
2⤵
PID:1656

/usr/bin/uptime
uptime
2⤵
PID:1657

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1658

/usr/bin/uptime
uptime
2⤵
PID:1659

/usr/bin/free
free -m
2⤵
PID:1660

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1661

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1662

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1663

/usr/bin/free
free -m
2⤵
PID:1664

/usr/bin/uptime
uptime
2⤵
PID:1665

/usr/bin/free
free -m
2⤵
PID:1666

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1667

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1668

/usr/bin/uptime
uptime
2⤵
PID:1669

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1670

/usr/bin/uptime
uptime
2⤵
PID:1671

/usr/bin/free
free -m
2⤵
PID:1672

/usr/bin/uptime
uptime
2⤵
PID:1673

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1674

/usr/bin/uptime
uptime
2⤵
PID:1675

/usr/bin/free
free -m
2⤵
PID:1676

/usr/bin/uptime
uptime
2⤵
PID:1677

/usr/bin/free
free -m
2⤵
PID:1678

/usr/bin/uptime
uptime
2⤵
PID:1679

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1680

/usr/bin/uptime
uptime
2⤵
PID:1681

/usr/bin/free
free -m
2⤵
PID:1682

/usr/bin/uptime
uptime
2⤵
PID:1683

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1684

/usr/bin/uptime
uptime
2⤵
PID:1685

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1686

/usr/bin/uptime
uptime
2⤵
PID:1687

/usr/bin/free
free -m
2⤵
PID:1688

/usr/bin/uptime
uptime
2⤵
PID:1689

/usr/bin/free
free -m
2⤵
PID:1690

/usr/bin/uptime
uptime
2⤵
PID:1691

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1693

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1694

/usr/bin/free
free -m
2⤵
PID:1695

/usr/bin/uptime
uptime
2⤵
PID:1696

/usr/bin/free
free -m
2⤵
PID:1697

/usr/bin/uptime
uptime
2⤵
PID:1698

/usr/bin/free
free -m
2⤵
PID:1699

/usr/bin/uptime
uptime
2⤵
PID:1700

/usr/bin/free
free -m
2⤵
PID:1701

/usr/bin/uptime
uptime
2⤵
PID:1702

/usr/bin/free
free -m
2⤵
PID:1703

/usr/bin/uptime
uptime
2⤵
PID:1704

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1705

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1706

/usr/bin/free
free -m
2⤵
PID:1707

/usr/bin/uptime
uptime
2⤵
PID:1708

/usr/bin/free
free -m
2⤵
PID:1709

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1710

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1711

/usr/bin/uptime
uptime
2⤵
PID:1712

/usr/bin/free
free -m
2⤵
PID:1713

/usr/bin/uptime
uptime
2⤵
PID:1714

/usr/bin/free
free -m
2⤵
PID:1715

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1716

/usr/bin/free
free -m
2⤵
PID:1737

/usr/bin/uptime
uptime
2⤵
PID:1738

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1739

/usr/bin/uptime
uptime
2⤵
PID:1740

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1741

/usr/bin/uptime
uptime
2⤵
PID:1742

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1743

/usr/bin/uptime
uptime
2⤵
PID:1744

/usr/bin/free
free -m
2⤵
PID:1745

/usr/bin/uptime
uptime
2⤵
PID:1746

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1747

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1748

/usr/bin/free
free -m
2⤵
PID:1749

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1750

/usr/bin/free
free -m
2⤵
PID:1751

/usr/bin/uptime
uptime
2⤵
PID:1752

/usr/bin/free
free -m
2⤵
PID:1753

/usr/bin/uptime
uptime
2⤵
PID:1754

/usr/bin/free
free -m
2⤵
PID:1755

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1756

/usr/bin/free
free -m
2⤵
PID:1757

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1758

/usr/bin/free
free -m
2⤵
PID:1759

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1760

/usr/bin/free
free -m
2⤵
PID:1761

/usr/bin/uptime
uptime
2⤵
PID:1762

/usr/bin/free
free -m
2⤵
PID:1763

/usr/bin/uptime
uptime
2⤵
PID:1764

/usr/bin/free
free -m
2⤵
PID:1765

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1766

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1767

/usr/bin/uptime
uptime
2⤵
PID:1768

/usr/bin/free
free -m
2⤵
PID:1769

/usr/bin/uptime
uptime
2⤵
PID:1770

/usr/bin/free
free -m
2⤵
PID:1771

/usr/bin/uptime
uptime
2⤵
PID:1772

/usr/bin/free
free -m
2⤵
PID:1773

/usr/bin/uptime
uptime
2⤵
PID:1774

/usr/bin/free
free -m
2⤵
PID:1775

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1776

/usr/bin/free
free -m
2⤵
PID:1777

/usr/bin/uptime
uptime
2⤵
PID:1778

/usr/bin/free
free -m
2⤵
PID:1779

/usr/bin/uptime
uptime
2⤵
PID:1780

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1781

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1782

/usr/bin/free
free -m
2⤵
PID:1783

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1784

/usr/bin/free
free -m
2⤵
PID:1785

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1786

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1787

/usr/bin/uptime
uptime
2⤵
PID:1788

/usr/bin/free
free -m
2⤵
PID:1789

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1790

/usr/bin/free
free -m
2⤵
PID:1791

/usr/bin/uptime
uptime
2⤵
PID:1792

/usr/bin/free
free -m
2⤵
PID:1794

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1795

/usr/bin/free
free -m
2⤵
PID:1796

/usr/bin/uptime
uptime
2⤵
PID:1797

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1802

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1803

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1804

/usr/bin/uptime
uptime
2⤵
PID:1805

/usr/bin/free
free -m
2⤵
PID:1806

/usr/bin/uptime
uptime
2⤵
PID:1807

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1808

/usr/bin/uptime
uptime
2⤵
PID:1809

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1810

/usr/bin/uptime
uptime
2⤵
PID:1811

/usr/bin/free
free -m
2⤵
PID:1812

/usr/bin/uptime
uptime
2⤵
PID:1813

/usr/bin/free
free -m
2⤵
PID:1814

/usr/bin/uptime
uptime
2⤵
PID:1815

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1816

/usr/bin/uptime
uptime
2⤵
PID:1817

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1818

/usr/bin/uptime
uptime
2⤵
PID:1819

/usr/bin/free
free -m
2⤵
PID:1820

/usr/bin/uptime
uptime
2⤵
PID:1821

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1822

/usr/bin/uptime
uptime
2⤵
PID:1823

/usr/bin/free
free -m
2⤵
PID:1824

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1825

/usr/bin/free
free -m
2⤵
PID:1826

/usr/bin/uptime
uptime
2⤵
PID:1827

/usr/bin/free
free -m
2⤵
PID:1828

/usr/bin/uptime
uptime
2⤵
PID:1829

/usr/bin/free
free -m
2⤵
PID:1830

/usr/bin/uptime
uptime
2⤵
PID:1831

/usr/bin/free
free -m
2⤵
PID:1832

/usr/bin/uptime
uptime
2⤵
PID:1833

/usr/bin/free
free -m
2⤵
PID:1834

/usr/bin/uptime
uptime
2⤵
PID:1835

/usr/bin/free
free -m
2⤵
PID:1836

/usr/bin/uptime
uptime
2⤵
PID:1837

/usr/bin/free
free -m
2⤵
PID:1838

/usr/bin/uptime
uptime
2⤵
PID:1839

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1840

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1841

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1842

/usr/bin/uptime
uptime
2⤵
PID:1843

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1844

/usr/bin/uptime
uptime
2⤵
PID:1845

/usr/bin/free
free -m
2⤵
PID:1846

/usr/bin/uptime
uptime
2⤵
PID:1847

/usr/bin/free
free -m
2⤵
PID:1848

/usr/bin/uptime
uptime
2⤵
PID:1849

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1850

/usr/bin/uptime
uptime
2⤵
PID:1851

/usr/bin/free
free -m
2⤵
PID:1852

/usr/bin/uptime
uptime
2⤵
PID:1853

/usr/bin/free
free -m
2⤵
PID:1854

/usr/bin/uptime
uptime
2⤵
PID:1855

/usr/bin/free
free -m
2⤵
PID:1856

/usr/bin/uptime
uptime
2⤵
PID:1857

/usr/bin/free
free -m
2⤵
PID:1940

/usr/bin/uptime
uptime
2⤵
PID:1941

/usr/bin/free
free -m
2⤵
PID:1942

/usr/bin/uptime
uptime
2⤵
PID:1943

/usr/bin/free
free -m
2⤵
PID:1947

/usr/bin/uptime
uptime
2⤵
PID:1948

/usr/bin/free
free -m
2⤵
PID:1949

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1950

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1951

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1952

/usr/bin/free
free -m
2⤵
PID:1953

/usr/bin/uptime
uptime
2⤵
PID:1954

/usr/bin/free
free -m
2⤵
PID:1955

/usr/bin/uptime
uptime
2⤵
PID:1956

/usr/bin/free
free -m
2⤵
PID:1957

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1958

/usr/bin/free
free -m
2⤵
PID:1959

/usr/bin/uptime
uptime
2⤵
PID:1960

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1961

/usr/bin/uptime
uptime
2⤵
PID:1962

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1963

/usr/bin/uptime
uptime
2⤵
PID:1964

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1965

/usr/bin/uptime
uptime
2⤵
PID:1966

/usr/bin/free
free -m
2⤵
PID:1967

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1968

/usr/bin/free
free -m
2⤵
PID:1969

/usr/bin/uptime
uptime
2⤵
PID:1970

/usr/bin/free
free -m
2⤵
PID:1971

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1972

/usr/bin/free
free -m
2⤵
PID:1973

/usr/bin/uptime
uptime
2⤵
PID:1974

/usr/bin/free
free -m
2⤵
PID:1975

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1976

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1977

/usr/bin/uptime
uptime
2⤵
PID:1978

/usr/bin/free
free -m
2⤵
PID:1979

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1980

/usr/bin/free
free -m
2⤵
PID:1981

/usr/bin/uptime
uptime
2⤵
PID:1982

/usr/bin/free
free -m
2⤵
PID:1983

/usr/bin/uptime
uptime
2⤵
PID:1984

/usr/bin/free
free -m
2⤵
PID:1985

/usr/bin/uptime
uptime
2⤵
PID:1986

/usr/bin/free
free -m
2⤵
PID:1987

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1988

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1989

/usr/bin/uptime
uptime
2⤵
PID:1990

/usr/bin/free
free -m
2⤵
PID:1991

/usr/bin/uptime
uptime
2⤵
PID:1992

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1993

/usr/bin/uptime
uptime
2⤵
PID:1994

/usr/bin/free
free -m
2⤵
PID:1995

/usr/bin/uptime
uptime
2⤵
PID:1996

/usr/bin/free
free -m
2⤵
PID:1997

/usr/bin/uptime
uptime
2⤵
PID:1998

/usr/bin/free
free -m
2⤵
PID:1999

/usr/bin/uptime
uptime
2⤵
PID:2000

/usr/bin/free
free -m
2⤵
PID:2001

/usr/bin/uptime
uptime
2⤵
PID:2002

/usr/bin/free
free -m
2⤵
PID:2016

/usr/bin/uptime
uptime
2⤵
PID:2017

/usr/bin/free
free -m
2⤵
PID:2019

/usr/bin/uptime
uptime
2⤵
PID:2020

/usr/bin/free
free -m
2⤵
PID:2022

/usr/bin/uptime
uptime
2⤵
PID:2023

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2024

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2025

/usr/bin/free
free -m
2⤵
PID:2026

/usr/bin/uptime
uptime
2⤵
PID:2027

/usr/bin/free
free -m
2⤵
PID:2028

/usr/bin/uptime
uptime
2⤵
PID:2029

/usr/bin/free
free -m
2⤵
PID:2030

/usr/bin/uptime
uptime
2⤵
PID:2031

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2032

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2033

/usr/bin/free
free -m
2⤵
PID:2034

/usr/bin/uptime
uptime
2⤵
PID:2035

/usr/bin/free
free -m
2⤵
PID:2036

/usr/bin/uptime
uptime
2⤵
PID:2037

/usr/bin/free
free -m
2⤵
PID:2038

/usr/bin/uptime
uptime
2⤵
PID:2039

/usr/bin/free
free -m
2⤵
PID:2040

/usr/bin/uptime
uptime
2⤵
PID:2041

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2042

/usr/bin/uptime
uptime
2⤵
PID:2043

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2044

/usr/bin/uptime
uptime
2⤵
PID:2045

/usr/bin/free
free -m
2⤵
PID:2046

/usr/bin/uptime
uptime
2⤵
PID:2047

/usr/bin/free
free -m
2⤵
PID:2048

/usr/bin/uptime
uptime
2⤵
PID:2049

/usr/bin/free
free -m
2⤵
PID:2050

/usr/bin/uptime
uptime
2⤵
PID:2051

/usr/bin/free
free -m
2⤵
PID:2052

/usr/bin/uptime
uptime
2⤵
PID:2053

/usr/bin/free
free -m
2⤵
PID:2057

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2058

/usr/bin/free
free -m
2⤵
PID:2059

/usr/bin/uptime
uptime
2⤵
PID:2060

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2061

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2062

/usr/bin/free
free -m
2⤵
PID:2063

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2064

/usr/bin/free
free -m
2⤵
PID:2065

/usr/bin/uptime
uptime
2⤵
PID:2066

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2067

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:2068

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2069

/usr/bin/uptime
uptime
2⤵
PID:2070

/usr/bin/free
free -m
2⤵
PID:2071

/usr/bin/uptime
uptime
2⤵
PID:2072

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2073

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2074

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2075

/usr/bin/uptime
uptime
2⤵
PID:2076

/usr/bin/free
free -m
2⤵
PID:2077

/usr/bin/uptime
uptime
2⤵
PID:2078

/usr/bin/free
free -m
2⤵
PID:2079

/usr/bin/uptime
uptime
2⤵
PID:2080

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2087

/usr/bin/uptime
uptime
2⤵
PID:2088

/usr/bin/free
free -m
2⤵
PID:2089

/usr/bin/uptime
uptime
2⤵
PID:2090

/usr/bin/free
free -m
2⤵
PID:2093

/usr/bin/uptime
uptime
2⤵
PID:2094

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2095

/usr/bin/uptime
uptime
2⤵
PID:2096

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2097

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2098

/usr/bin/free
free -m
2⤵
PID:2099

/usr/bin/uptime
uptime
2⤵
PID:2100

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:2101

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:2102

/usr/bin/free
free -m
2⤵
PID:2103

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:2104

/usr/bin/free
free -m
2⤵
PID:2105

/usr/bin/uptime
uptime
2⤵
PID:2106

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2107

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:2108

/usr/bin/free
free -m
2⤵
PID:2109

/usr/bin/uptime
uptime
2⤵
PID:2110

/usr/bin/free
free -m
2⤵
PID:2111

/usr/bin/uptime
uptime
2⤵
PID:2112

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:2113

/usr/bin/uptime
uptime
2⤵
PID:2114

/usr/bin/free
free -m
2⤵
PID:2115

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:2116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys
Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit