xorddos | 696bad26159da671a74a879c34188dcae0edcd6726f8314c5bde240765235dd8

Resubmissions

09-05-2024 09:13

240509-k6691aac91 10

08-05-2024 04:23

240508-e1by1sae2w 10

Analysis

max time kernel
193s
max time network
194s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
09-05-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
Size

611KB
MD5

232e172f7a005dd12d4aad55e0c4a331
SHA1

9425435b359cd7ee6138564c687709e9d244f065
SHA256

696bad26159da671a74a879c34188dcae0edcd6726f8314c5bde240765235dd8
SHA512

f42110ba007957a6256c9a74e0d6e57dd8a3918823a803dbac583155438a60072c54f79ad052ff24da27ff649c04ead6e9962c32710bcf8eb072e8e0050c769f
SSDEEP

12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr6T6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNN6BVEBl/91h

Score

10^/10

xorddos botnet downloader infostealer persistence

Malware Config

Extracted

Family

xorddos

http://aa.finance1num.org/config.rar

cdn.netflix2cdn.com:443

cdn.finance1num.com:443

Attributes

crc_polynomial
EDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 64 IoCs

resource	yara_rule
behavioral7/files/fstream-6.dat	family_xorddos
behavioral7/files/fstream-8.dat	family_xorddos
behavioral7/files/fstream-9.dat	family_xorddos
behavioral7/files/fstream-11.dat	family_xorddos
behavioral7/files/fstream-12.dat	family_xorddos
behavioral7/files/fstream-14.dat	family_xorddos
behavioral7/files/fstream-15.dat	family_xorddos
behavioral7/files/fstream-17.dat	family_xorddos
behavioral7/files/fstream-18.dat	family_xorddos
behavioral7/files/fstream-20.dat	family_xorddos
behavioral7/files/fstream-21.dat	family_xorddos
behavioral7/files/fstream-23.dat	family_xorddos
behavioral7/files/fstream-24.dat	family_xorddos
behavioral7/files/fstream-26.dat	family_xorddos
behavioral7/files/fstream-27.dat	family_xorddos
behavioral7/files/fstream-29.dat	family_xorddos
behavioral7/files/fstream-30.dat	family_xorddos
behavioral7/files/fstream-32.dat	family_xorddos
behavioral7/files/fstream-33.dat	family_xorddos
behavioral7/files/fstream-35.dat	family_xorddos
behavioral7/files/fstream-36.dat	family_xorddos
behavioral7/files/fstream-38.dat	family_xorddos
behavioral7/files/fstream-39.dat	family_xorddos
behavioral7/files/fstream-41.dat	family_xorddos
behavioral7/files/fstream-42.dat	family_xorddos
behavioral7/files/fstream-44.dat	family_xorddos
behavioral7/files/fstream-45.dat	family_xorddos
behavioral7/files/fstream-47.dat	family_xorddos
behavioral7/files/fstream-48.dat	family_xorddos
behavioral7/files/fstream-50.dat	family_xorddos
behavioral7/files/fstream-51.dat	family_xorddos
behavioral7/files/fstream-53.dat	family_xorddos
behavioral7/files/fstream-54.dat	family_xorddos
behavioral7/files/fstream-56.dat	family_xorddos
behavioral7/files/fstream-57.dat	family_xorddos
behavioral7/files/fstream-59.dat	family_xorddos
behavioral7/files/fstream-60.dat	family_xorddos
behavioral7/files/fstream-62.dat	family_xorddos
behavioral7/files/fstream-63.dat	family_xorddos
behavioral7/files/fstream-65.dat	family_xorddos
behavioral7/files/fstream-66.dat	family_xorddos
behavioral7/files/fstream-68.dat	family_xorddos
behavioral7/files/fstream-69.dat	family_xorddos
behavioral7/files/fstream-71.dat	family_xorddos
behavioral7/files/fstream-72.dat	family_xorddos
behavioral7/files/fstream-74.dat	family_xorddos
behavioral7/files/fstream-75.dat	family_xorddos
behavioral7/files/fstream-77.dat	family_xorddos
behavioral7/files/fstream-78.dat	family_xorddos
behavioral7/files/fstream-80.dat	family_xorddos
behavioral7/files/fstream-81.dat	family_xorddos
behavioral7/files/fstream-83.dat	family_xorddos
behavioral7/files/fstream-84.dat	family_xorddos
behavioral7/files/fstream-86.dat	family_xorddos
behavioral7/files/fstream-87.dat	family_xorddos
behavioral7/files/fstream-89.dat	family_xorddos
behavioral7/files/fstream-90.dat	family_xorddos
behavioral7/files/fstream-92.dat	family_xorddos
behavioral7/files/fstream-93.dat	family_xorddos
behavioral7/files/fstream-95.dat	family_xorddos
behavioral7/files/fstream-96.dat	family_xorddos
behavioral7/files/fstream-98.dat	family_xorddos
behavioral7/files/fstream-99.dat	family_xorddos
behavioral7/files/fstream-101.dat	family_xorddos

Executes dropped EXE 64 IoCs

ioc	pid	Process
/usr/bin/amvgdtmaah	1392	amvgdtmaah
/usr/bin/amvgdtmaah	1394	amvgdtmaah
/usr/bin/amvgdtmaah	1397	amvgdtmaah
/usr/bin/amvgdtmaah	1399	amvgdtmaah
/usr/bin/amvgdtmaah	1402	amvgdtmaah
/usr/bin/mddwzvmyum	1486	mddwzvmyum
/usr/bin/mddwzvmyum	1489	mddwzvmyum
/usr/bin/mddwzvmyum	1491	mddwzvmyum
/usr/bin/mddwzvmyum	1494	mddwzvmyum
/usr/bin/mddwzvmyum	1497	mddwzvmyum
/usr/bin/ooikezqcfd	1501	ooikezqcfd
/usr/bin/ooikezqcfd	1503	ooikezqcfd
/usr/bin/ooikezqcfd	1506	ooikezqcfd
/usr/bin/ooikezqcfd	1509	ooikezqcfd
/usr/bin/ooikezqcfd	1511	ooikezqcfd
/usr/bin/anlrpiioey	1516	anlrpiioey
/usr/bin/anlrpiioey	1519	anlrpiioey
/usr/bin/anlrpiioey	1521	anlrpiioey
/usr/bin/anlrpiioey	1524	anlrpiioey
/usr/bin/anlrpiioey	1527	anlrpiioey
/usr/bin/xnktwmjcsl	1531	xnktwmjcsl
/usr/bin/xnktwmjcsl	1534	xnktwmjcsl
/usr/bin/xnktwmjcsl	1536	xnktwmjcsl
/usr/bin/xnktwmjcsl	1539	xnktwmjcsl
/usr/bin/xnktwmjcsl	1543	xnktwmjcsl
/usr/bin/ilowhuvtxe	1546	ilowhuvtxe
/usr/bin/ilowhuvtxe	1549	ilowhuvtxe
/usr/bin/ilowhuvtxe	1551	ilowhuvtxe
/usr/bin/ilowhuvtxe	1554	ilowhuvtxe
/usr/bin/ilowhuvtxe	1557	ilowhuvtxe
/usr/bin/tfqdxuefry	1578	tfqdxuefry
/usr/bin/tfqdxuefry	1581	tfqdxuefry
/usr/bin/tfqdxuefry	1584	tfqdxuefry
/usr/bin/tfqdxuefry	1587	tfqdxuefry
/usr/bin/tfqdxuefry	1590	tfqdxuefry
/usr/bin/uaknwidqlq	1593	uaknwidqlq
/usr/bin/uaknwidqlq	1596	uaknwidqlq
/usr/bin/uaknwidqlq	1598	uaknwidqlq
/usr/bin/uaknwidqlq	1601	uaknwidqlq
/usr/bin/uaknwidqlq	1604	uaknwidqlq
/usr/bin/fxxhltjnea	1608	fxxhltjnea
/usr/bin/fxxhltjnea	1611	fxxhltjnea
/usr/bin/fxxhltjnea	1613	fxxhltjnea
/usr/bin/fxxhltjnea	1616	fxxhltjnea
/usr/bin/fxxhltjnea	1618	fxxhltjnea
/usr/bin/lxwoieyngr	1623	lxwoieyngr
/usr/bin/lxwoieyngr	1626	lxwoieyngr
/usr/bin/lxwoieyngr	1628	lxwoieyngr
/usr/bin/lxwoieyngr	1631	lxwoieyngr
/usr/bin/lxwoieyngr	1634	lxwoieyngr
/usr/bin/swlrwiukjq	1638	swlrwiukjq
/usr/bin/swlrwiukjq	1641	swlrwiukjq
/usr/bin/swlrwiukjq	1643	swlrwiukjq
/usr/bin/swlrwiukjq	1646	swlrwiukjq
/usr/bin/swlrwiukjq	1649	swlrwiukjq
/usr/bin/fsjijtsmhi	1676	fsjijtsmhi
/usr/bin/fsjijtsmhi	1679	fsjijtsmhi
/usr/bin/fsjijtsmhi	1681	fsjijtsmhi
/usr/bin/fsjijtsmhi	1684	fsjijtsmhi
/usr/bin/fsjijtsmhi	1686	fsjijtsmhi
/usr/bin/lyekaezyic	1697	lyekaezyic
/usr/bin/lyekaezyic	1700	lyekaezyic
/usr/bin/lyekaezyic	1702	lyekaezyic
/usr/bin/lyekaezyic	1705	lyekaezyic

Reads EFI boot settings 1 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

infostealer

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/cron.hourly/gcc.sh	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/etc/crontab	sh

Modifies init.d 1 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118

Write file to user bin folder 1 TTPs 39 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/amvgdtmaah	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/ilowhuvtxe	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/swlrwiukjq	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/fsjijtsmhi	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/ozreofkepj	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/ieslcrzcfm	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/szfigrhiaq	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/uipkfplcos	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/mddwzvmyum	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/anlrpiioey	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/oonhwjmami	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/jshuxexaou	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/jwdrnkgkte	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/gfvcvgoknv	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/lyekaezyic	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/ztnqkqszeb	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/wfzjniaali	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/tfqdxuefry	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/uaknwidqlq	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/fxxhltjnea	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/pdycgybivs	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/lxwoieyngr	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/pwwrozcwsj	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/ehwvkyutfx	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/bbfvgfewbe	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/cfdtbjugvp	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/yhkhvnhjhy	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/ooikezqcfd	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/ejbncqtfjf	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/lvtzjbhrmk	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/dqhiaerbes	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/xnktwmjcsl	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/qahwidgeuj	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/bsuekfsbyn	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/nsvyrsxelo	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/mnqnzttxjg	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/okgxpyngga	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/jfkcksqfff	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for modification	/usr/bin/xqrrcuxfti	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/rs_dev	ooikezqcfd
File opened for reading	/proc/rs_dev	lyekaezyic
File opened for reading	/proc/rs_dev	ieslcrzcfm
File opened for reading	/proc/rs_dev	oonhwjmami
File opened for reading	/proc/rs_dev	wfzjniaali
File opened for reading	/proc/rs_dev	xnktwmjcsl
File opened for reading	/proc/rs_dev	ehwvkyutfx
File opened for reading	/proc/rs_dev	gfvcvgoknv
File opened for reading	/proc/rs_dev	swlrwiukjq
File opened for reading	/proc/rs_dev	uaknwidqlq
File opened for reading	/proc/rs_dev	swlrwiukjq
File opened for reading	/proc/rs_dev	szfigrhiaq
File opened for reading	/proc/rs_dev	xnktwmjcsl
File opened for reading	/proc/rs_dev	ozreofkepj
File opened for reading	/proc/rs_dev	bbfvgfewbe
File opened for reading	/proc/rs_dev	amvgdtmaah
File opened for reading	/proc/rs_dev	cfdtbjugvp
File opened for reading	/proc/rs_dev	232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
File opened for reading	/proc/rs_dev	amvgdtmaah
File opened for reading	/proc/rs_dev	ozreofkepj
File opened for reading	/proc/rs_dev	lyekaezyic
File opened for reading	/proc/rs_dev	ozreofkepj
File opened for reading	/proc/rs_dev	oonhwjmami
File opened for reading	/proc/rs_dev	lvtzjbhrmk
File opened for reading	/proc/rs_dev	gfvcvgoknv
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/rs_dev	ooikezqcfd
File opened for reading	/proc/rs_dev	fxxhltjnea
File opened for reading	/proc/rs_dev	mddwzvmyum
File opened for reading	/proc/rs_dev	ooikezqcfd
File opened for reading	/proc/rs_dev	szfigrhiaq
File opened for reading	/proc/rs_dev	qahwidgeuj
File opened for reading	/proc/rs_dev	qahwidgeuj
File opened for reading	/proc/rs_dev	wfzjniaali
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/rs_dev	bbfvgfewbe
File opened for reading	/proc/rs_dev	mnqnzttxjg
File opened for reading	/proc/rs_dev	pwwrozcwsj
File opened for reading	/proc/rs_dev	jshuxexaou
File opened for reading	/proc/rs_dev	mnqnzttxjg
File opened for reading	/proc/rs_dev	swlrwiukjq
File opened for reading	/proc/rs_dev	fsjijtsmhi
File opened for reading	/proc/rs_dev	ozreofkepj
File opened for reading	/proc/rs_dev	fsjijtsmhi
File opened for reading	/proc/rs_dev	nsvyrsxelo
File opened for reading	/proc/rs_dev	gfvcvgoknv
File opened for reading	/proc/rs_dev	ilowhuvtxe
File opened for reading	/proc/rs_dev	dqhiaerbes
File opened for reading	/proc/rs_dev	ztnqkqszeb
File opened for reading	/proc/rs_dev	tfqdxuefry
File opened for reading	/proc/rs_dev	okgxpyngga
File opened for reading	/proc/rs_dev	jfkcksqfff
File opened for reading	/proc/rs_dev	jfkcksqfff
File opened for reading	/proc/rs_dev	lvtzjbhrmk
File opened for reading	/proc/rs_dev	pdycgybivs
File opened for reading	/proc/rs_dev	amvgdtmaah
File opened for reading	/proc/rs_dev	amvgdtmaah
File opened for reading	/proc/rs_dev	fxxhltjnea
File opened for reading	/proc/rs_dev	bsuekfsbyn
File opened for reading	/proc/rs_dev	jwdrnkgkte
File opened for reading	/proc/rs_dev	fxxhltjnea
File opened for reading	/proc/rs_dev	lxwoieyngr
File opened for reading	/proc/rs_dev	ehwvkyutfx
File opened for reading	/proc/rs_dev	okgxpyngga

/tmp/232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
/tmp/232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Write file to user bin folder
- Reads runtime system information
PID:1379
- /bin/sh
  sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
  2⤵
  - Creates/modifies Cron job
  PID:1385
- - /bin/sed
    sed -i "/\\/etc\\/cron.hourly\\/gcc.sh/d" /etc/crontab
    3⤵
    - Reads runtime system information
    PID:1386

/bin/chkconfig
chkconfig --add 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
PID:1382

/sbin/chkconfig
chkconfig --add 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
PID:1382

/usr/bin/chkconfig
chkconfig --add 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
PID:1382

/usr/sbin/chkconfig
chkconfig --add 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
PID:1382

/usr/local/bin/chkconfig
chkconfig --add 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
PID:1382

/usr/local/sbin/chkconfig
chkconfig --add 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
PID:1382

/usr/X11R6/bin/chkconfig
chkconfig --add 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118
1⤵
PID:1382

/bin/update-rc.d
update-rc.d 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118 defaults
1⤵
PID:1384

/sbin/update-rc.d
update-rc.d 232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118 defaults
1⤵
PID:1384
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads EFI boot settings
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1389

/usr/bin/amvgdtmaah
/usr/bin/amvgdtmaah whoami 1380
1⤵
- Executes dropped EXE
PID:1392

/usr/bin/amvgdtmaah
/usr/bin/amvgdtmaah "cat resolv.conf" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1394

/usr/bin/amvgdtmaah
/usr/bin/amvgdtmaah "ifconfig eth0" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1397

/usr/bin/amvgdtmaah
/usr/bin/amvgdtmaah "cd /etc" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1399

/usr/bin/amvgdtmaah
/usr/bin/amvgdtmaah uptime 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1402

/usr/bin/mddwzvmyum
/usr/bin/mddwzvmyum "cat resolv.conf" 1380
1⤵
- Executes dropped EXE
PID:1486

/usr/bin/mddwzvmyum
/usr/bin/mddwzvmyum top 1380
1⤵
- Executes dropped EXE
PID:1489

/usr/bin/mddwzvmyum
/usr/bin/mddwzvmyum "ifconfig eth0" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1491

/usr/bin/mddwzvmyum
/usr/bin/mddwzvmyum "route -n" 1380
1⤵
- Executes dropped EXE
PID:1494

/usr/bin/mddwzvmyum
/usr/bin/mddwzvmyum "cd /etc" 1380
1⤵
- Executes dropped EXE
PID:1497

/usr/bin/ooikezqcfd
/usr/bin/ooikezqcfd who 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1501

/usr/bin/ooikezqcfd
/usr/bin/ooikezqcfd "echo \"find\"" 1380
1⤵
- Executes dropped EXE
PID:1503

/usr/bin/ooikezqcfd
/usr/bin/ooikezqcfd "netstat -antop" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1506

/usr/bin/ooikezqcfd
/usr/bin/ooikezqcfd "netstat -an" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1509

/usr/bin/ooikezqcfd
/usr/bin/ooikezqcfd "cat resolv.conf" 1380
1⤵
- Executes dropped EXE
PID:1511

/usr/bin/anlrpiioey
/usr/bin/anlrpiioey "echo \"find\"" 1380
1⤵
- Executes dropped EXE
PID:1516

/usr/bin/anlrpiioey
/usr/bin/anlrpiioey ls 1380
1⤵
- Executes dropped EXE
PID:1519

/usr/bin/anlrpiioey
/usr/bin/anlrpiioey gnome-terminal 1380
1⤵
- Executes dropped EXE
PID:1521

/usr/bin/anlrpiioey
/usr/bin/anlrpiioey "grep \"A\"" 1380
1⤵
- Executes dropped EXE
PID:1524

/usr/bin/anlrpiioey
/usr/bin/anlrpiioey "ps -ef" 1380
1⤵
- Executes dropped EXE
PID:1527

/usr/bin/xnktwmjcsl
/usr/bin/xnktwmjcsl "ps -ef" 1380
1⤵
- Executes dropped EXE
PID:1531

/usr/bin/xnktwmjcsl
/usr/bin/xnktwmjcsl "echo \"find\"" 1380
1⤵
- Executes dropped EXE
PID:1534

/usr/bin/xnktwmjcsl
/usr/bin/xnktwmjcsl sh 1380
1⤵
- Executes dropped EXE
PID:1536

/usr/bin/xnktwmjcsl
/usr/bin/xnktwmjcsl "netstat -antop" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1539

/usr/bin/xnktwmjcsl
/usr/bin/xnktwmjcsl ls 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1543

/usr/bin/ilowhuvtxe
/usr/bin/ilowhuvtxe su 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1546

/usr/bin/ilowhuvtxe
/usr/bin/ilowhuvtxe pwd 1380
1⤵
- Executes dropped EXE
PID:1549

/usr/bin/ilowhuvtxe
/usr/bin/ilowhuvtxe "echo \"find\"" 1380
1⤵
- Executes dropped EXE
PID:1551

/usr/bin/ilowhuvtxe
/usr/bin/ilowhuvtxe su 1380
1⤵
- Executes dropped EXE
PID:1554

/usr/bin/ilowhuvtxe
/usr/bin/ilowhuvtxe "route -n" 1380
1⤵
- Executes dropped EXE
PID:1557

/usr/bin/tfqdxuefry
/usr/bin/tfqdxuefry "netstat -an" 1380
1⤵
- Executes dropped EXE
PID:1578

/usr/bin/tfqdxuefry
/usr/bin/tfqdxuefry "netstat -antop" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1581

/usr/bin/tfqdxuefry
/usr/bin/tfqdxuefry id 1380
1⤵
- Executes dropped EXE
PID:1584

/usr/bin/tfqdxuefry
/usr/bin/tfqdxuefry "netstat -an" 1380
1⤵
- Executes dropped EXE
PID:1587

/usr/bin/tfqdxuefry
/usr/bin/tfqdxuefry "ls -la" 1380
1⤵
- Executes dropped EXE
PID:1590

/usr/bin/uaknwidqlq
/usr/bin/uaknwidqlq "route -n" 1380
1⤵
- Executes dropped EXE
PID:1593

/usr/bin/uaknwidqlq
/usr/bin/uaknwidqlq ifconfig 1380
1⤵
- Executes dropped EXE
PID:1596

/usr/bin/uaknwidqlq
/usr/bin/uaknwidqlq whoami 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1598

/usr/bin/uaknwidqlq
/usr/bin/uaknwidqlq "sleep 1" 1380
1⤵
- Executes dropped EXE
PID:1601

/usr/bin/uaknwidqlq
/usr/bin/uaknwidqlq "route -n" 1380
1⤵
- Executes dropped EXE
PID:1604

/usr/bin/fxxhltjnea
/usr/bin/fxxhltjnea "netstat -antop" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1608

/usr/bin/fxxhltjnea
/usr/bin/fxxhltjnea "echo \"find\"" 1380
1⤵
- Executes dropped EXE
PID:1611

/usr/bin/fxxhltjnea
/usr/bin/fxxhltjnea su 1380
1⤵
- Executes dropped EXE
PID:1613

/usr/bin/fxxhltjnea
/usr/bin/fxxhltjnea "grep \"A\"" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1616

/usr/bin/fxxhltjnea
/usr/bin/fxxhltjnea "echo \"find\"" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1618

/usr/bin/lxwoieyngr
/usr/bin/lxwoieyngr sh 1380
1⤵
- Executes dropped EXE
PID:1623

/usr/bin/lxwoieyngr
/usr/bin/lxwoieyngr "ps -ef" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1626

/usr/bin/lxwoieyngr
/usr/bin/lxwoieyngr "netstat -an" 1380
1⤵
- Executes dropped EXE
PID:1628

/usr/bin/lxwoieyngr
/usr/bin/lxwoieyngr sh 1380
1⤵
- Executes dropped EXE
PID:1631

/usr/bin/lxwoieyngr
/usr/bin/lxwoieyngr who 1380
1⤵
- Executes dropped EXE
PID:1634

/usr/bin/swlrwiukjq
/usr/bin/swlrwiukjq "cat resolv.conf" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1638

/usr/bin/swlrwiukjq
/usr/bin/swlrwiukjq top 1380
1⤵
- Executes dropped EXE
PID:1641

/usr/bin/swlrwiukjq
/usr/bin/swlrwiukjq gnome-terminal 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1643

/usr/bin/swlrwiukjq
/usr/bin/swlrwiukjq "ps -ef" 1380
1⤵
- Executes dropped EXE
PID:1646

/usr/bin/swlrwiukjq
/usr/bin/swlrwiukjq id 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1649

/usr/bin/fsjijtsmhi
/usr/bin/fsjijtsmhi ifconfig 1380
1⤵
- Executes dropped EXE
PID:1676

/usr/bin/fsjijtsmhi
/usr/bin/fsjijtsmhi bash 1380
1⤵
- Executes dropped EXE
PID:1679

/usr/bin/fsjijtsmhi
/usr/bin/fsjijtsmhi su 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1681

/usr/bin/fsjijtsmhi
/usr/bin/fsjijtsmhi gnome-terminal 1380
1⤵
- Executes dropped EXE
PID:1684

/usr/bin/fsjijtsmhi
/usr/bin/fsjijtsmhi "echo \"find\"" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1686

/usr/bin/lyekaezyic
/usr/bin/lyekaezyic sh 1380
1⤵
- Executes dropped EXE
PID:1697

/usr/bin/lyekaezyic
/usr/bin/lyekaezyic "route -n" 1380
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1700

/usr/bin/lyekaezyic
/usr/bin/lyekaezyic "ifconfig eth0" 1380
1⤵
- Executes dropped EXE
PID:1702

/usr/bin/lyekaezyic
/usr/bin/lyekaezyic bash 1380
1⤵
- Executes dropped EXE
PID:1705

/usr/bin/lyekaezyic
/usr/bin/lyekaezyic whoami 1380
1⤵
- Reads runtime system information
PID:1707

/usr/bin/ozreofkepj
/usr/bin/ozreofkepj sh 1380
1⤵
PID:1712

/usr/bin/ozreofkepj
/usr/bin/ozreofkepj "route -n" 1380
1⤵
- Reads runtime system information
PID:1715

/usr/bin/ozreofkepj
/usr/bin/ozreofkepj ls 1380
1⤵
- Reads runtime system information
PID:1717

/usr/bin/ozreofkepj
/usr/bin/ozreofkepj "grep \"A\"" 1380
1⤵
- Reads runtime system information
PID:1720

/usr/bin/ozreofkepj
/usr/bin/ozreofkepj "cat resolv.conf" 1380
1⤵
- Reads runtime system information
PID:1723

/usr/bin/ejbncqtfjf
/usr/bin/ejbncqtfjf "netstat -antop" 1380
1⤵
PID:1727

/usr/bin/ejbncqtfjf
/usr/bin/ejbncqtfjf ifconfig 1380
1⤵
PID:1729

/usr/bin/ejbncqtfjf
/usr/bin/ejbncqtfjf ls 1380
1⤵
PID:1732

/usr/bin/ejbncqtfjf
/usr/bin/ejbncqtfjf "route -n" 1380
1⤵
PID:1735

/usr/bin/ejbncqtfjf
/usr/bin/ejbncqtfjf su 1380
1⤵
PID:1738

/usr/bin/pwwrozcwsj
/usr/bin/pwwrozcwsj who 1380
1⤵
PID:1742

/usr/bin/pwwrozcwsj
/usr/bin/pwwrozcwsj "sleep 1" 1380
1⤵
PID:1745

/usr/bin/pwwrozcwsj
/usr/bin/pwwrozcwsj gnome-terminal 1380
1⤵
PID:1747

/usr/bin/pwwrozcwsj
/usr/bin/pwwrozcwsj bash 1380
1⤵
- Reads runtime system information
PID:1750

/usr/bin/pwwrozcwsj
/usr/bin/pwwrozcwsj su 1380
1⤵
PID:1753

/usr/bin/okgxpyngga
/usr/bin/okgxpyngga pwd 1380
1⤵
- Reads runtime system information
PID:1757

/usr/bin/okgxpyngga
/usr/bin/okgxpyngga "netstat -antop" 1380
1⤵
- Reads runtime system information
PID:1760

/usr/bin/okgxpyngga
/usr/bin/okgxpyngga "netstat -antop" 1380
1⤵
PID:1762

/usr/bin/okgxpyngga
/usr/bin/okgxpyngga who 1380
1⤵
PID:1765

/usr/bin/okgxpyngga
/usr/bin/okgxpyngga "ls -la" 1380
1⤵
PID:1767

/usr/bin/qahwidgeuj
/usr/bin/qahwidgeuj id 1380
1⤵
PID:1772

/usr/bin/qahwidgeuj
/usr/bin/qahwidgeuj ifconfig 1380
1⤵
PID:1775

/usr/bin/qahwidgeuj
/usr/bin/qahwidgeuj "sleep 1" 1380
1⤵
- Reads runtime system information
PID:1777

/usr/bin/qahwidgeuj
/usr/bin/qahwidgeuj ls 1380
1⤵
PID:1780

/usr/bin/qahwidgeuj
/usr/bin/qahwidgeuj whoami 1380
1⤵
- Reads runtime system information
PID:1783

/usr/bin/ehwvkyutfx
/usr/bin/ehwvkyutfx whoami 1380
1⤵
PID:1787

/usr/bin/ehwvkyutfx
/usr/bin/ehwvkyutfx "grep \"A\"" 1380
1⤵
PID:1790

/usr/bin/ehwvkyutfx
/usr/bin/ehwvkyutfx "cat resolv.conf" 1380
1⤵
PID:1792

/usr/bin/ehwvkyutfx
/usr/bin/ehwvkyutfx "route -n" 1380
1⤵
- Reads runtime system information
PID:1795

/usr/bin/ehwvkyutfx
/usr/bin/ehwvkyutfx uptime 1380
1⤵
- Reads runtime system information
PID:1798

/usr/bin/jfkcksqfff
/usr/bin/jfkcksqfff "cd /etc" 1380
1⤵
PID:1802

/usr/bin/jfkcksqfff
/usr/bin/jfkcksqfff pwd 1380
1⤵
- Reads runtime system information
PID:1805

/usr/bin/jfkcksqfff
/usr/bin/jfkcksqfff "ps -ef" 1380
1⤵
PID:1807

/usr/bin/jfkcksqfff
/usr/bin/jfkcksqfff "echo \"find\"" 1380
1⤵
PID:1810

/usr/bin/jfkcksqfff
/usr/bin/jfkcksqfff "sleep 1" 1380
1⤵
- Reads runtime system information
PID:1813

/usr/bin/oonhwjmami
/usr/bin/oonhwjmami bash 1380
1⤵
PID:1817

/usr/bin/oonhwjmami
/usr/bin/oonhwjmami top 1380
1⤵
- Reads runtime system information
PID:1819

/usr/bin/oonhwjmami
/usr/bin/oonhwjmami top 1380
1⤵
- Reads runtime system information
PID:1822

/usr/bin/oonhwjmami
/usr/bin/oonhwjmami who 1380
1⤵
PID:1824

/usr/bin/oonhwjmami
/usr/bin/oonhwjmami "sleep 1" 1380
1⤵
PID:1827

/usr/bin/bbfvgfewbe
/usr/bin/bbfvgfewbe "cat resolv.conf" 1380
1⤵
- Reads runtime system information
PID:1832

/usr/bin/bbfvgfewbe
/usr/bin/bbfvgfewbe "cat resolv.conf" 1380
1⤵
PID:1835

/usr/bin/bbfvgfewbe
/usr/bin/bbfvgfewbe "netstat -antop" 1380
1⤵
PID:1837

/usr/bin/bbfvgfewbe
/usr/bin/bbfvgfewbe ifconfig 1380
1⤵
- Reads runtime system information
PID:1840

/usr/bin/bbfvgfewbe
/usr/bin/bbfvgfewbe "netstat -antop" 1380
1⤵
PID:1843

/usr/bin/ieslcrzcfm
/usr/bin/ieslcrzcfm "ps -ef" 1380
1⤵
- Reads runtime system information
PID:1847

/usr/bin/ieslcrzcfm
/usr/bin/ieslcrzcfm pwd 1380
1⤵
PID:1849

/usr/bin/ieslcrzcfm
/usr/bin/ieslcrzcfm "route -n" 1380
1⤵
PID:1852

/usr/bin/ieslcrzcfm
/usr/bin/ieslcrzcfm "ifconfig eth0" 1380
1⤵
PID:1855

/usr/bin/ieslcrzcfm
/usr/bin/ieslcrzcfm who 1380
1⤵
PID:1858

/usr/bin/bsuekfsbyn
/usr/bin/bsuekfsbyn whoami 1380
1⤵
PID:1862

/usr/bin/bsuekfsbyn
/usr/bin/bsuekfsbyn "cat resolv.conf" 1380
1⤵
- Reads runtime system information
PID:1865

/usr/bin/bsuekfsbyn
/usr/bin/bsuekfsbyn "route -n" 1380
1⤵
PID:1867

/usr/bin/bsuekfsbyn
/usr/bin/bsuekfsbyn "ifconfig eth0" 1380
1⤵
PID:1870

/usr/bin/bsuekfsbyn
/usr/bin/bsuekfsbyn "netstat -antop" 1380
1⤵
PID:1873

/usr/bin/xqrrcuxfti
/usr/bin/xqrrcuxfti "ps -ef" 1380
1⤵
PID:1878

/usr/bin/xqrrcuxfti
/usr/bin/xqrrcuxfti bash 1380
1⤵
PID:1881

/usr/bin/xqrrcuxfti
/usr/bin/xqrrcuxfti "ps -ef" 1380
1⤵
PID:1883

/usr/bin/xqrrcuxfti
/usr/bin/xqrrcuxfti "echo \"find\"" 1380
1⤵
PID:1886

/usr/bin/xqrrcuxfti
/usr/bin/xqrrcuxfti ifconfig 1380
1⤵
PID:1889

/usr/bin/szfigrhiaq
/usr/bin/szfigrhiaq "route -n" 1380
1⤵
PID:1893

/usr/bin/szfigrhiaq
/usr/bin/szfigrhiaq "ifconfig eth0" 1380
1⤵
- Reads runtime system information
PID:1896

/usr/bin/szfigrhiaq
/usr/bin/szfigrhiaq sh 1380
1⤵
PID:1898

/usr/bin/szfigrhiaq
/usr/bin/szfigrhiaq who 1380
1⤵
PID:1901

/usr/bin/szfigrhiaq
/usr/bin/szfigrhiaq "sleep 1" 1380
1⤵
- Reads runtime system information
PID:1904

/usr/bin/lvtzjbhrmk
/usr/bin/lvtzjbhrmk who 1380
1⤵
PID:1908

/usr/bin/lvtzjbhrmk
/usr/bin/lvtzjbhrmk top 1380
1⤵
PID:1911

/usr/bin/lvtzjbhrmk
/usr/bin/lvtzjbhrmk "sleep 1" 1380
1⤵
PID:1913

/usr/bin/lvtzjbhrmk
/usr/bin/lvtzjbhrmk top 1380
1⤵
- Reads runtime system information
PID:1916

/usr/bin/lvtzjbhrmk
/usr/bin/lvtzjbhrmk "sleep 1" 1380
1⤵
- Reads runtime system information
PID:1919

/usr/bin/pdycgybivs
/usr/bin/pdycgybivs top 1380
1⤵
PID:1923

/usr/bin/pdycgybivs
/usr/bin/pdycgybivs uptime 1380
1⤵
- Reads runtime system information
PID:1926

/usr/bin/pdycgybivs
/usr/bin/pdycgybivs "ifconfig eth0" 1380
1⤵
PID:1928

/usr/bin/pdycgybivs
/usr/bin/pdycgybivs uptime 1380
1⤵
PID:1931

/usr/bin/pdycgybivs
/usr/bin/pdycgybivs "ls -la" 1380
1⤵
PID:1934

/usr/bin/cfdtbjugvp
/usr/bin/cfdtbjugvp whoami 1380
1⤵
PID:1938

/usr/bin/cfdtbjugvp
/usr/bin/cfdtbjugvp "netstat -antop" 1380
1⤵
PID:1941

/usr/bin/cfdtbjugvp
/usr/bin/cfdtbjugvp who 1380
1⤵
PID:1944

/usr/bin/cfdtbjugvp
/usr/bin/cfdtbjugvp who 1380
1⤵
- Reads runtime system information
PID:1946

/usr/bin/cfdtbjugvp
/usr/bin/cfdtbjugvp ls 1380
1⤵
PID:1949

/usr/bin/dqhiaerbes
/usr/bin/dqhiaerbes pwd 1380
1⤵
PID:1953

/usr/bin/dqhiaerbes
/usr/bin/dqhiaerbes whoami 1380
1⤵
- Reads runtime system information
PID:1956

/usr/bin/dqhiaerbes
/usr/bin/dqhiaerbes id 1380
1⤵
PID:1958

/usr/bin/dqhiaerbes
/usr/bin/dqhiaerbes "route -n" 1380
1⤵
PID:1961

/usr/bin/dqhiaerbes
/usr/bin/dqhiaerbes whoami 1380
1⤵
PID:1964

/usr/bin/ztnqkqszeb
/usr/bin/ztnqkqszeb who 1380
1⤵
PID:1968

/usr/bin/ztnqkqszeb
/usr/bin/ztnqkqszeb "route -n" 1380
1⤵
PID:1970

/usr/bin/ztnqkqszeb
/usr/bin/ztnqkqszeb gnome-terminal 1380
1⤵
- Reads runtime system information
PID:1973

/usr/bin/ztnqkqszeb
/usr/bin/ztnqkqszeb ifconfig 1380
1⤵
PID:1976

/usr/bin/ztnqkqszeb
/usr/bin/ztnqkqszeb "ls -la" 1380
1⤵
PID:1979

/usr/bin/jshuxexaou
/usr/bin/jshuxexaou "ps -ef" 1380
1⤵
- Reads runtime system information
PID:1983

/usr/bin/jshuxexaou
/usr/bin/jshuxexaou "cd /etc" 1380
1⤵
PID:1986

/usr/bin/jshuxexaou
/usr/bin/jshuxexaou ls 1380
1⤵
PID:1988

/usr/bin/jshuxexaou
/usr/bin/jshuxexaou gnome-terminal 1380
1⤵
PID:1991

/usr/bin/jshuxexaou
/usr/bin/jshuxexaou id 1380
1⤵
PID:1994

/usr/bin/jwdrnkgkte
/usr/bin/jwdrnkgkte "netstat -antop" 1380
1⤵
PID:1998

/usr/bin/jwdrnkgkte
/usr/bin/jwdrnkgkte uptime 1380
1⤵
PID:2001

/usr/bin/jwdrnkgkte
/usr/bin/jwdrnkgkte who 1380
1⤵
- Reads runtime system information
PID:2003

/usr/bin/jwdrnkgkte
/usr/bin/jwdrnkgkte whoami 1380
1⤵
PID:2006

/usr/bin/jwdrnkgkte
/usr/bin/jwdrnkgkte bash 1380
1⤵
PID:2009

/usr/bin/nsvyrsxelo
/usr/bin/nsvyrsxelo "ls -la" 1380
1⤵
- Reads runtime system information
PID:2013

/usr/bin/nsvyrsxelo
/usr/bin/nsvyrsxelo "grep \"A\"" 1380
1⤵
PID:2016

/usr/bin/nsvyrsxelo
/usr/bin/nsvyrsxelo "netstat -antop" 1380
1⤵
PID:2018

/usr/bin/nsvyrsxelo
/usr/bin/nsvyrsxelo top 1380
1⤵
PID:2021

/usr/bin/nsvyrsxelo
/usr/bin/nsvyrsxelo uptime 1380
1⤵
PID:2023

/usr/bin/gfvcvgoknv
/usr/bin/gfvcvgoknv who 1380
1⤵
PID:2028

/usr/bin/gfvcvgoknv
/usr/bin/gfvcvgoknv "ifconfig eth0" 1380
1⤵
PID:2031

/usr/bin/gfvcvgoknv
/usr/bin/gfvcvgoknv ifconfig 1380
1⤵
- Reads runtime system information
PID:2033

/usr/bin/gfvcvgoknv
/usr/bin/gfvcvgoknv "ps -ef" 1380
1⤵
- Reads runtime system information
PID:2036

/usr/bin/gfvcvgoknv
/usr/bin/gfvcvgoknv ifconfig 1380
1⤵
- Reads runtime system information
PID:2039

/usr/bin/uipkfplcos
/usr/bin/uipkfplcos gnome-terminal 1380
1⤵
PID:2047

/usr/bin/uipkfplcos
/usr/bin/uipkfplcos "ps -ef" 1380
1⤵
PID:2050

/usr/bin/uipkfplcos
/usr/bin/uipkfplcos uptime 1380
1⤵
PID:2052

/usr/bin/uipkfplcos
/usr/bin/uipkfplcos su 1380
1⤵
PID:2055

/usr/bin/uipkfplcos
/usr/bin/uipkfplcos "grep \"A\"" 1380
1⤵
PID:2058

/usr/bin/yhkhvnhjhy
/usr/bin/yhkhvnhjhy top 1380
1⤵
PID:2062

/usr/bin/yhkhvnhjhy
/usr/bin/yhkhvnhjhy "cd /etc" 1380
1⤵
PID:2065

/usr/bin/yhkhvnhjhy
/usr/bin/yhkhvnhjhy su 1380
1⤵
PID:2067

/usr/bin/yhkhvnhjhy
/usr/bin/yhkhvnhjhy "cat resolv.conf" 1380
1⤵
PID:2070

/usr/bin/yhkhvnhjhy
/usr/bin/yhkhvnhjhy "ls -la" 1380
1⤵
PID:2073

/usr/bin/wfzjniaali
/usr/bin/wfzjniaali "cat resolv.conf" 1380
1⤵
- Reads runtime system information
PID:2092

/usr/bin/wfzjniaali
/usr/bin/wfzjniaali who 1380
1⤵
PID:2095

/usr/bin/wfzjniaali
/usr/bin/wfzjniaali uptime 1380
1⤵
- Reads runtime system information
PID:2097

/usr/bin/wfzjniaali
/usr/bin/wfzjniaali "sleep 1" 1380
1⤵
PID:2100

/usr/bin/wfzjniaali
/usr/bin/wfzjniaali "route -n" 1380
1⤵
PID:2103

/usr/bin/mnqnzttxjg
/usr/bin/mnqnzttxjg "echo \"find\"" 1380
1⤵
- Reads runtime system information
PID:2108

/usr/bin/mnqnzttxjg
/usr/bin/mnqnzttxjg "netstat -an" 1380
1⤵
PID:2110

/usr/bin/mnqnzttxjg
/usr/bin/mnqnzttxjg gnome-terminal 1380
1⤵
- Reads runtime system information
PID:2113

/usr/bin/mnqnzttxjg
/usr/bin/mnqnzttxjg "netstat -an" 1380
1⤵
PID:2116

/usr/bin/mnqnzttxjg
/usr/bin/mnqnzttxjg "netstat -antop" 1380
1⤵
PID:2119

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/gcc.sh

Filesize
228B

MD5
3bab747cedc5f0ebe86aaa7f982470cd

SHA1
3c7d1c6931c2b3dae39d38346b780ea57c8e6142

SHA256
74d31cac40d98ee64df2a0c29ceb229d12ac5fa699c2ee512fc69360f0cf68c5

SHA512
21e8a6d9ca8531d37def83d8903e5b0fa11ecf33d85d05edab1e0feb4acac65ae2cf5222650fb9f533f459ccc51bb2903276ff6f827b847cc5e6dac7d45a0a42

Download Submit
/etc/crontab

Filesize
1KB

MD5
d55bd2d9a7a695204a017b028f02a7b2

SHA1
3da348041c30890853b40167718c06d709f7a024

SHA256
5eefb92328565795396fc24e1d2034942496ac76bd028003fea3bc3e0ffab559

SHA512
d592a561846901b9996deeda1d7098aa8feb3584e4f1615fb6d0a1d3deec166f587d79b40619723fcdd256263f62af93e9ac8a27ccfd1b89fce9414f7860c8aa

Download Submit
/etc/init.d/232e172f7a005dd12d4aad55e0c4a331_JaffaCakes118

Filesize
495B

MD5
f7a333b19ea51d6b66ae7af4ccb05a57

SHA1
12134856f0bc1f5a1ccd5b6079ee5b7213c29ee6

SHA256
41b424c38117a02c79198d512f7ddbf0bed3aebb880ab8fd023eb4aeabe5c21c

SHA512
a7442da51852aca975c922b4ed18ac28135bf5634b3718b69e4bc24d579704cc4a05ea1c53f90f64b67731a9e68c745b12d65d3a572261890213c19a20b69c0f

Download Submit
/etc/sedJAe7N0

Filesize
1KB

MD5
44df62f8c671c9306af920e2839cda53

SHA1
90db86feb0aa6d41208eeb8097929407d79d95cc

SHA256
c5c9241274bee45e7e60d8b247a15bd5f69bf821b813215194156fd60fc4afc9

SHA512
0b86ddc2a648da07820a8ef90c71a54908650f589cc7a6c9ca40d74083909f56cdc68633dca82174ca6ddfd340bbd538bdb3a9ace8ba5031b474a4db01d5427d

Download Submit
/run/gcc.pid

Filesize
32B

MD5
b944ca477cb214a36a2405def8b23edd

SHA1
921ebe3dcbc07edd6785a6af540e0d3b12af4c25

SHA256
fbd91542fcb290f1deeafbb99c5885d5ab302f14cac2745e59017aef8f3474ba

SHA512
a44bbfb735ec013272c8c665461252694218cd0e61b332ea3686aa377e5b8125daf29f80cfa81a587120442fa245307a8398293d4f3671999f0b69502bfd6e5e

Download Submit
/usr/bin/amvgdtmaah

Filesize
611KB

MD5
cd92d53d3fa369bd98ed77fa3547456c

SHA1
a6d8a2a43c37b1eab58cae1cf961bc4a0639b3e6

SHA256
38cbbb25698f8dee0971fcd969ca4068637bfb7ca4247dea4ab0ca40b48e39e9

SHA512
8ce981c3f9d96adf2c742d1fd13d3f268ca7bdbb9b771e5cf9c918f60efb1b159682691c15882cb7fab561026b0ea68ba3e62ef7b5a5337ebf6da93f9e34982d

Download Submit
/usr/bin/amvgdtmaah

Filesize
611KB

MD5
02462a3ebc8bb6c68f071448dfdad2f5

SHA1
812cf340159e40593dfbc3f834167cde3c22da5e

SHA256
10d654a76279b6b242715138e48140862bf47689540abcdfd1b536f31b150495

SHA512
6bcb8ec072680f92ae5ef0762e2f2e63c27ec71b8d568a6e0355229ae661fbaa87aca392468b4e1740ab75354996a53bf7ef13987099548b7b902d58de280c6a

Download Submit
/usr/bin/anlrpiioey

Filesize
611KB

MD5
c47245a6dbd42d190b7393b47bb67cf5

SHA1
b58c297485e8a7061d933a6178ba1185a9ff1b15

SHA256
8045c3b1a593e567f7eb091a88dcd563129cd9e254390f75a33f117d9f423582

SHA512
6183838b4721b5fd81b9ee5af6486cab2403afbf0a93a8d997f68554185a364a6c0ac6bea6c6846e5129433dd4af6a9ccb7ce2b59ad15978d469b4e45d5ef918

Download Submit
/usr/bin/anlrpiioey

Filesize
611KB

MD5
bb0b29f4340456d14db47705bb7b4695

SHA1
74e7a87eba181a2d32de2e5ea01b772770b343b1

SHA256
1766fc06c7aeeac109accab9859756ea9908f8d9abfc6219b226f5547d86aeb7

SHA512
51c29c1b0679fb1f365f040e5aa8b53da60e6a863db38b0bddbdd83b17faa0dc9b0877322c849c5e7f5945913e8f0e8c4b9e9e8e09b5427f170c22239f2c9e32

Download Submit
/usr/bin/bbfvgfewbe

Filesize
611KB

MD5
b69e1d3c0b3eb7cac08724de30eddbeb

SHA1
8cb0050fdb5c8b9ed1ba0ee11411e429b2f78ea9

SHA256
d4c3eb40665f14297f3dee44143a6b86a1026d7a1f6d716a31a6be263b580998

SHA512
ea16ab122c4bd797b772dd7b3d56b81ec79060aa27c88bfbf49e2b7250d593d975b7cf2c57cf40487fe50f3f145c09a0e686f8f77f2e8920c1f441ee7ee8f503

Download Submit
/usr/bin/bbfvgfewbe

Filesize
611KB

MD5
b6cf3a0571b8714b10c48a7386246fab

SHA1
9498602e81e40a2599cea123e86fc967d6ca09e6

SHA256
5a8d81c923ef2d373843135e6d8b7ac7c84e57dfe17629eb12def81f020077d8

SHA512
c2a8762b53f83216ea31121da5b256e415c97b462d7178bf9a4f01add0db7b98d7708a4543e2940409c1563a93f74342e739aea6709242c5a240457ea11e9a67

Download Submit
/usr/bin/bsuekfsbyn

Filesize
611KB

MD5
a8344581b3b570bdfcf12991131b2fdc

SHA1
af6776f1c7c42e5fcb56300b2170b1bd2db60420

SHA256
b988ff0bbdc480d680ffdb0c63c650231671724950a5a981f46ac9939ba4867a

SHA512
2289ad782f38e4cec9c3143f0f6c8ff71e800361f4edeca0b9a6f2c1a357bb5bbb8bac93d8ba593381489e448a312f7d242174c637dea07dc2ee5debdcd7da21

Download Submit
/usr/bin/bsuekfsbyn

Filesize
611KB

MD5
1c3fb8d3bd086869b052f0e905835b68

SHA1
0167fb3a46bdbe8c1d6c80a40bf6ce200a9c21e4

SHA256
45220361b3dc3b39d24d46cb1421009e528ea5d80815c544e12607ad724978bd

SHA512
576d6387170b8a3ecbd479c3ff357bf16c711e9a7968623d4223802e8818e6932c5dc1f1c0d9e8d8db6a9c9abf14b22d49d08d8a255c45999f5142789025ceb1

Download Submit
/usr/bin/cfdtbjugvp

Filesize
611KB

MD5
6d854395ace2ec283d0e3c382ffc8d2a

SHA1
6762cf840d8c5ac200ade6cdd16eb65ec69b4054

SHA256
7f858389c357c44bde524c4134d9f29a33153903cac6d1042b1d52763eaeb981

SHA512
49e6f705e6d86f8151ce367901ec0de765674c80282ba3841577da6da3dee16d88faa2fcc8231c85799d087dd8facd3467898150ae8ec21cd2f3ffd9096ad5fa

Download Submit
/usr/bin/cfdtbjugvp

Filesize
611KB

MD5
5c982ca572f830f7d74360d040bc4f62

SHA1
5eb9d1051a0b38b3f1b775b112df0a6227bf4f6c

SHA256
c52903a23d1d4d0f98a47cd2ee0fcda3e544137c785ed6a4bbcd98993db57cce

SHA512
7b63f3051547daf507515c2bebbf92fe3e7dfa0f1a706eb10964002f3f021646ca1472bb591a575ac65f4a7b85a844c9a9422223099d19c652242e70269427ff

Download Submit
/usr/bin/dqhiaerbes

Filesize
611KB

MD5
5bcdc0ff9daefeed4395f0e1afe927ba

SHA1
aed7e5b4265c96741e6768e28371c737352f4b4b

SHA256
1d0ee7d999f7e8f719d6de7489fc0db16cca8149dc28724769eb2b53cd96295d

SHA512
861f17cb139c3c746566f6a26e4bbcdc9362b7de2287f5e8833398bb5c9182008c05bde4c530cba1e0900280c8a740336fd28c72071b713641fca52bc9db9f37

Download Submit
/usr/bin/dqhiaerbes

Filesize
611KB

MD5
413a00c4d544aa518d114235daa10325

SHA1
71e273eb1bfb31f21212cb1adaf277672a22f807

SHA256
c990f0c87a4b561b460428685e23173d8b4ac5a99bd01c76e3f9c6dcecfc9e43

SHA512
01d0b177894082e833227733aab088bf301bd5182b40acdb79124a1477bc09733ecf5f3af2c027ba90d7a3d03b01c920fd6c6edc94369082b00db8551ffafbff

Download Submit
/usr/bin/ehwvkyutfx

Filesize
611KB

MD5
f23d80a274908b9da58ca73074c2daef

SHA1
9003257a91eacaeb1d880da275920f09972eebcc

SHA256
e4ce77000d7b8b396be3ceff3e350bee1df2a43685f3994925a0d3352c0b2678

SHA512
d358c88acdf1632c807ecc330a486352634730177d908a5a4b12ff3350e4cbd75dbbd90ec81c2b1d8e67bcab88655fffc6b65c5415b804d4e9c77c05b93a683a

Download Submit
/usr/bin/ehwvkyutfx

Filesize
611KB

MD5
29de51cac43c78265f83e4e3b7dec3e7

SHA1
4f04f18936fbdde83ded273e49e379666cbe592d

SHA256
d2f4a5a1e1362d98cdeccb766776b9efdbaf77589b5ebe280765774017950dad

SHA512
034685d8c0d0da865b2d6c1403dd179db3897b84ecad65b4e38039e69662f1546afdbf8244a98eeb40a4a4a46e740f9a32b851b917325420e33ed2dd20100b89

Download Submit
/usr/bin/ejbncqtfjf

Filesize
611KB

MD5
33b9f3387746d739c6e9772e13265bf8

SHA1
fd83d4b266bd01e03249307cfe2adafef827088b

SHA256
320a99091a089bdfc0dc6a9a37c37b16343ae28622a0342e7fb2bbb1f5da74a0

SHA512
60c5a1d751f9f4da04db8142906461a0c05ec37263f52911272c9805993b632b44cf2278e4dfdaef27dd212e836929aa536fb41309f81ba172b97c91683140a1

Download Submit
/usr/bin/ejbncqtfjf

Filesize
611KB

MD5
6d7732c712cf22015c80b9bd20de9f5b

SHA1
708fff7b9a600b010d0139cdf07e320de1998fd2

SHA256
1a1af547facd662be913966e0f97224b50e7cdf71bb1e06411d8db7dc0972f23

SHA512
7dcc0c708484caa6e13d3a7350341a193645891c56c0f11a8d88d5815fd902b1296f974f604655dc1d996e1a291b4baacec14262235fb8d15d8ac86ba754ac09

Download Submit
/usr/bin/fsjijtsmhi

Filesize
611KB

MD5
27e02e9d41ada0c017d4406870a685ff

SHA1
3fa5ffded0e956f5acc70b51346257a7acf2cde2

SHA256
e026f4756e545e96030a030e5941d1ec5e556d9d4351c123a62b61518a8909f3

SHA512
0e19913957c1d6305869703f53abbc00ff6cb86ba38a3ea8a9da930d3882d35f074f1c35a1c3740872d7f1b8d38db28bb1fa55ed77ad43028a58453436aae52b

Download Submit
/usr/bin/fsjijtsmhi

Filesize
611KB

MD5
3217e85437d1d97a3d04335b8181e623

SHA1
44945e8fdd833014fe0d2376356d6e4926acb8dd

SHA256
0a6aae4223e02a248d3551e70c4ad4d43f6088122abee3f54652bc22b17caf26

SHA512
aa579597e9d5c0939f8ee7f25c3b0090d0078d91de34b4b9714bd78e2be20113d08da72e6342d71382cc60109b62a38431ea5dab4fb7d4601d9d361dd0de4f21

Download Submit
/usr/bin/fxxhltjnea

Filesize
611KB

MD5
13544688be302391e3008ee5c7ff14da

SHA1
a0bae9a765b414e463080644b0c430b54943a904

SHA256
d3f33555d2d4f0eb716ecc328967c274a36ed79fd4f11045528f9e7fedb054a7

SHA512
f7c6994c1729fb19a32864370ca9bbf0030f159b4d5b43acd565f4fc936e7b547e85fd32700ea594beb3480981def8d1bded7aa1eb3860c8f4e4cbf120fdc31d

Download Submit
/usr/bin/fxxhltjnea

Filesize
611KB

MD5
c9ff3c4d12768ad52a93bd4ed0397ef0

SHA1
12d6220309fb6e459bcd557eca654a50408d0372

SHA256
db23269528c86e5001e59bfeb1b8547d80344a6f9a63e75b05eae0f5d593c578

SHA512
ffe8e2793f94e7b58d2f9ab334e22de7c389c4076aec578d0f7a2ebdc6911f38e2f30b32b4280c028591df80e0142afe9dbd0537a2b9e919ceceeb97884acf84

Download Submit
/usr/bin/gfvcvgoknv

Filesize
611KB

MD5
4bf6b3de1a6d1398088771524f39cd02

SHA1
d99a9a63660e58f19311aaa801ba23c7a17fae0e

SHA256
6244cc07f3ee8d255304668200964e23795e9eebe35aeee2319d32e7f269a45d

SHA512
703a9be63acc74b2f85a68db9fd68c5dbfedad4a233c16be614ff555604271c0961255cbb4252136f23bca1daccbab623acee4d37c87c2b844c642b48a7b1f22

Download Submit
/usr/bin/gfvcvgoknv

Filesize
611KB

MD5
19f51758b8eec00bf25458a8d0cb36b9

SHA1
2bee254b2604e96ecda5e7cffc2bc1f60b6e178f

SHA256
df99cc338bdf3b798c5943189daff4068aba1a03a592fa011f082de22b71fd64

SHA512
72c93f0bdfac8238bfbfa370455353818131acbc57939d85b1e1ae8b76bbcf42342bc049cd9ed227370b820102765aa174bbda253ee975f19da64c6b6b2d167d

Download Submit
/usr/bin/ieslcrzcfm

Filesize
611KB

MD5
879206c48396c1381f8d36b3594086c2

SHA1
0d331c2365790231565c61f974545cb63e6e2028

SHA256
8311e2cf6ca0d83bd581c8e3e5ef865fbff56004de44ea25190cf64dffba223e

SHA512
e66f504e021fc66358b58576533c6fb1666e1c604a1f05e23632ca1a3bad72956ab8c060cf7423fa113eb52cc66cf942afa3d832df2309cf182fe62e007b2aff

Download Submit
/usr/bin/ieslcrzcfm

Filesize
611KB

MD5
edfad12af94cc089dd27d3a3e0308a2a

SHA1
859e076cac9be7228729a3767fb413cbb5a55cf7

SHA256
7b9f53aeba0841b9a2b87ab23592478d02f4731225679b1422153340d372af24

SHA512
b9a5493c78a641c0adaf1eacda15f9f9e0b2b52d02a8dba9bd24b7580413aae94891d72e62ce88ef191fa528d77fc672f99431083238bf61bfab571e424610c7

Download Submit
/usr/bin/ilowhuvtxe

Filesize
611KB

MD5
580710dc04afb5193eff668079b4417b

SHA1
aa6fe1a6ec72ad4b7cb7bc55329a7f6fb11ca4d9

SHA256
b215705e96964c016dd0de5d3630e99ca52372cfa19c134b007e375d6cf97b31

SHA512
d53f7778aa68f314a9e73b2f17c27e936cfd2a3b699a398325b0238aae8976d24857e5ed8e6d1497979373f71e0c244fe1c5075ab468dc7e8aa780be4c4133a8

Download Submit
/usr/bin/ilowhuvtxe

Filesize
611KB

MD5
db778a3a59a950bb9ea1d118c53f6c58

SHA1
b0e1dbaea7f9e749f91cd35d1d10aa8295046633

SHA256
b7cdb989e870a9c3a5842beb05daef9c6629467d432914fa680d08c66fa16aa6

SHA512
1c9bacc95dcc327b68545b6cbe54111a8480a609a4b47578cf7881a276b538cc614f8b994af37ffabc7a36fb4294cbf768f31bcaa2baab357c0b4796192fc7be

Download Submit
/usr/bin/jfkcksqfff

Filesize
611KB

MD5
5279bd68d3286ac52b039786efe9a06c

SHA1
79ed869369016ccb122e635b9dd88e868a4052e9

SHA256
a3c375579be730a6cc29af36723313ca4e901db07740147c9d797c92c03e26b0

SHA512
2049794b496a334319c18d39f5b537133a85e69cfd3e55196eb6525e6221f13c8f9dd26cf6b525fde8033886dd61f9111e3ec0363b9c2b4a065d242bb4f25acb

Download Submit
/usr/bin/jfkcksqfff

Filesize
611KB

MD5
279c49854947b034aa7d68d61ab756f6

SHA1
4fc4dbfcb39fd0120a5a38616dbf5f62d8d8dc76

SHA256
41c00c1ba597836c980be05f62141fb78bc1f17a151edc1768ec30e1ca361de8

SHA512
ead792a9a8910ebce1fb940c52edba62cdeaee80aca067ed307c5fa8afb12fa0c7be5e0c6e1f584f7da1f93eb25042b898cd8a2aa02a79d61df8222ad9088f9a

Download Submit
/usr/bin/jshuxexaou

Filesize
611KB

MD5
edde5b8f3dc346612f84ab111bf732d5

SHA1
3524784a345552f3e5ef1875305693f52039dbce

SHA256
aa71ef30a8b7a2c6366c3415314c9ea24f928d6de6206eed534fca6cca925eb4

SHA512
eff570a4ef41083d54401aa085e9f69ce022ed1eba026066c89652ee50da67ea6a9c0689d4bc861377cefc5b686144cbb66077ebe15293c60c07cf68f81d4501

Download Submit
/usr/bin/jshuxexaou

Filesize
611KB

MD5
f766ac6a10958351c2dd38a0704a181f

SHA1
a6a06bacb4558cbd8cbfb753a0e2bed9015587eb

SHA256
8a3de4eae4bcfafd45b0a2a26c69f7138dfd24bae9441156ffc24c8499a9ea78

SHA512
462c9248146ad5ba91d6089a9264cd9d1d972f2b4ca95f05c2bdf8688cf65130b76ea014f7dd4f3ef88fcde2f30983851b9d95a97b09b0b530130a3c3d1442fa

Download Submit
/usr/bin/jwdrnkgkte

Filesize
611KB

MD5
7e023e5eec125cb37fda24cf08aad337

SHA1
f93e7f64e1f820e8f84ec59d76113b806e71babf

SHA256
77c8b31118c3dea48ab297b54c478b29f1bfcec8abc85131b563583149a0c069

SHA512
63482269188ef71062a601aa6ea66cb5fca2abb3b4ffa5fb7f7b4fd649f68e1da2be4732566eef2df1d92bd802e22895684c158f6edb9dd94d2811506a25986f

Download Submit
/usr/bin/jwdrnkgkte

Filesize
611KB

MD5
c6227f36fe217f7024b7eba0f16f6862

SHA1
5f40de6ff60e9c8aab4534f44610a8e78ee9c7e1

SHA256
0262b2f477cfcc8b91d87a3497dcea15ab0e937bb07a277661f3ff6c5775e5a5

SHA512
a432b284cd98aa3361230ac2c867844124e8e4f975abf27ff9b8eba5ffac3a2ecbcc45e3cbf5edaa48d41f2aea4a87c103ce5fc7c90eb6f1dde35e1e261edcc5

Download Submit
/usr/bin/lvtzjbhrmk

Filesize
611KB

MD5
79e661ecd211a792fd75065e9284df3c

SHA1
bccf531da74c638a75de4ba6090cffa31f558d4a

SHA256
f8cab0fd847c510269b6a6826ccda62aebb857b3fdffb715b0b67939e0b30eca

SHA512
fb46e11cd6bd5e7185a098538b0b1ccf5dfc716cf01e4e38cc5536a42fcb234f24c5433582514a5de94bdf9b4d05bbcf22296ad834306c6a00ddf6c03a56ae2f

Download Submit
/usr/bin/lvtzjbhrmk

Filesize
611KB

MD5
7b9d938492d1660045df469293432139

SHA1
8d24e6182765eef54cf0cdc7ec5355560ae3850b

SHA256
f7135989440854b8e60372977b38853d0bb0205f0c37f480f53ef4a23dc83a77

SHA512
3261ec27dffa7cb9f51a908c34d3f2da7abd85b155504f2a923f67e22f3b5f684a8ce5e409e9d597d79961f91b29832c6faed576d645c9741fe49f97b0242831

Download Submit
/usr/bin/lxwoieyngr

Filesize
611KB

MD5
0b2c1081b5713e670df6e2f2bf9915db

SHA1
d34886525abda69ebad77e995fafeb30f4c40917

SHA256
60009204811b13e1963b092fa5493ad8bcd34f36819c89c27a769752823ed8cc

SHA512
6d8e6c8f77a1766d700897f8d0c0e8e08df6831b4fd658d268c22164cd7bdb12a3232e6f6b9b94373f1e01d04e6cc1388e28f08644bce90e34b8b2635cd2d2fa

Download Submit
/usr/bin/lxwoieyngr

Filesize
611KB

MD5
8bfbe2d896e321ac5012ad5194d07966

SHA1
4820850c8b580bc4f8e9e892a6d2fc77d5db7727

SHA256
7d29d1a9eb0367f7c73fedad322ba2597ae2a9c96c29205745c04a410180e5cc

SHA512
2a159012154a33e6696c542ff2feb1658971d70fb71a61d4aedd587b754701d7be2a31ae7413455ea12544906b0058f5e561166e7dbdb31668c205aa1817e058

Download Submit
/usr/bin/lyekaezyic

Filesize
611KB

MD5
14cadb16697fc9b4fa47410a984e6298

SHA1
3fe97460f5545e7ca6c4ea5664b0bfc0da3a41fb

SHA256
e0158d8efcfdeec6205f69e862e3a2906b67f3757f3619fdde76302d79d764cb

SHA512
0b8a81089fe186eca1beb294205533b4c65bb468117289614a3196ae1875bd0f61fc69919d050a383a9f97027905427e0f7588393c5e4a05d55180db7be32ecc

Download Submit
/usr/bin/lyekaezyic

Filesize
611KB

MD5
fe4660dbb8155e48318d3c17273f4163

SHA1
cb71f4bd89b7e20c78328b870b41f9d7362ddca3

SHA256
5e84b92a373592599a8ce3464300f4cf1be6349bf199f0f33d6d0b55aee7a1c4

SHA512
984ad4348deb4bd3feee8fa55a050a0cc18049e22f8b4877c616135d26ae449c25511bcaddda01928b25360326aa7d7d0c83fc781673ca486e8c972bdab1f95d

Download Submit
/usr/bin/mddwzvmyum

Filesize
611KB

MD5
5e928dab1e9957433154b22bf7ea652e

SHA1
d1660378e64303abf899fa7f4f682ec9391f5aa2

SHA256
dd6ab2f9ec1534b6b7a993c53587e664af15fee2ef2ecda62fd58dffcca18a11

SHA512
a3b8c6613487b67dd7aa7edfb548b2c5c258d23e407e72537ca05ef0dbd272ea687c7f88ecb098c221662bf568c3f207354a5382efeaaf034913602fd61fa80c

Download Submit
/usr/bin/mddwzvmyum

Filesize
611KB

MD5
f29aef531921299a18bb0564e159ae2a

SHA1
06508ecf30448cb628f91e41ba718a5e20d727f2

SHA256
b89988a676bf03693910ec2d2aa9561811e4fff4082e870972ed22ce51ae3331

SHA512
258514a7b88d056bab94fccdf299d06cb5cdf8bc451fe5c89cf46a26cd0c9ef50a848d97c2b35bb1b6ff18d817fb55b0795d21a611690c0b2fd45c518230be2f

Download Submit
/usr/bin/mnqnzttxjg

Filesize
611KB

MD5
d6c0907857e8b579443ce9c221f0afae

SHA1
63e0dc33efc63b1bc2946e913cf01f872dd884ad

SHA256
f25bd9d8ca3597cab049dbb05252d0ed9d4445afa8a5690fdd8a98ae0fbc477d

SHA512
d2252e065e428e8997ce9765e8b73bb82b98b1c780d6a67620f723898d8ea05c92ffa356c5853015d16da6f3aff88198951bc0fce59cf4076953384b19e53b1b

Download Submit
/usr/bin/mnqnzttxjg

Filesize
611KB

MD5
99d4934e6538523f4c7360a953699bd4

SHA1
b8a495fef076475fd51d34c4acf98010ae259000

SHA256
42f0f4fd8ff53f6041abaf1304514e5b5fc90b87d2525d4165d91f0a683be77d

SHA512
051750e3948b60135b9e66d2a57e12b2e7a6ca30292250c2c2184ce60a91b760265a96b05c5835a553456bff657d60cc90dd925f54fcc318a654ca8dc37e1608

Download Submit
/usr/bin/nsvyrsxelo

Filesize
611KB

MD5
54a13acb44e470b0531df14139a1920e

SHA1
957a529bec5dafddd3db0005fa17605ec10f822f

SHA256
55190459fa8a8be83ed4cbbb581a5dbd8d2d2bdb3342cc9d85b9e45a899a8e20

SHA512
2902a25dd4f25ceeaaeb9e3977383a892407ca304f63603f8b34bbb9d17bc4fa9049207a5cfd456451c9ea44c376cceb63b7e631c7f546643a8592224510915c

Download Submit
/usr/bin/nsvyrsxelo

Filesize
611KB

MD5
fe44f37f3ac422bc0317fdf56462ab7a

SHA1
7f69648bd2c6ef9acb72df588049ac278cbced3e

SHA256
46c66a01122306abc9e1aee5406c7c48664eafa4e3bc8de0e46723034a521406

SHA512
966571c1c9778a0e1d28977d876307f710a334aa77594cdd5224eeb10b018ce995ba4fdb6b6e9eddb9d2821243b23672e3d955309c13a3c9da5ef8b8c76ef485

Download Submit
/usr/bin/okgxpyngga

Filesize
611KB

MD5
0c2079ea22a1cb64ff029866b5a0a324

SHA1
d0c6798136b29245244e0951eed4ac08403fb91c

SHA256
ba043a3e13437c5840492c9d2f157767d97c526ee13e9b2627bcda4442f56d16

SHA512
d5fd16db2f370afa9f86a4016adc5764ec459568ad4bee301e37c840b9fd6fe0a29ce704b72cdfd2d74a4dafc5f2673351999356f39dd7d81ccc04157b7cb535

Download Submit
/usr/bin/okgxpyngga

Filesize
611KB

MD5
f341828b4cc411c33fc7e1e6314de9ea

SHA1
ad2768b532272b64ae8813b026eeb27c63425850

SHA256
9e43d6ccae3bb15828b4ae2dcab2d4f3caf8cc2256cb14222cbb3bfec10fa9ca

SHA512
c383ee1376dc4c38b9f9f78c50940dc8a2e7beeb5bc7ac10e9db5d109fbb49f7881142c89afd4b131ad4428fd405b057a68dcd11bc62481449ffc247f1fb119b

Download Submit
/usr/bin/ooikezqcfd

Filesize
611KB

MD5
d9dc86811cb992884872252c49c7b1c7

SHA1
50831a6c88d2fd9300deee40f337ef22a1ab7410

SHA256
ffd3d19d93dfe6ebf5eee2e850321eb7b1e87621b706ced100e57abf0dbdf1af

SHA512
6ea61e9b6b77ad78963513a14033b2561f325db1fbf4ce9f81b117c8fbafe042054ace43662d48304927bbeb2632553c627a3f6edafe33f62b72c3a1fb6af9f9

Download Submit
/usr/bin/ooikezqcfd

Filesize
611KB

MD5
32dd8cbd332fb1a3a2477c08b00eb972

SHA1
2ee3d57a952165f7fcb89f59de92261692a258ce

SHA256
64c554a41e02395423c8db607b7a1465722d1eeb6f1f15c0cc68014bb153742d

SHA512
785d274d11ec8d1da37f381c630d1c0ff07205333d53ad045ed0a2250d96d51d3158e58987ac50542de0397a636aaa04eb4e92dd768704bde132089aa46438af

Download Submit
/usr/bin/oonhwjmami

Filesize
611KB

MD5
67b8bd5baa9fd8f19e280117b684a3d5

SHA1
570589c58bdc598fcd585df7d8bfade2de5b77fa

SHA256
0592977adc37237f4b89a21525e585c394394830f14c0485f24f04c054c3400f

SHA512
2e555901c5456f914cc83f1f7be6b30b096f6c55f5afee02568d4af093eab1d10965aae061f6ddd4bbfe7717ad8f4227f9599b5bd7e67ec9dc5a6a78a24eb33b

Download Submit
/usr/bin/oonhwjmami

Filesize
611KB

MD5
1204464d8fd6e2fc4118d1809b0ed7dd

SHA1
fae1132b9d8a755db9e3b987c7fd3829e4e9061f

SHA256
e7d7a07fc7450ce3a89181b44a82d2a6bce442409f1afc6a0278fbee16ccd4b7

SHA512
29972821a9ff3dec776390f192ec7b5712f80578e661dc667887ae05d97262b887925b9b67a82c024712356756de4308bb68368afc1ec92d84d0867f494329ac

Download Submit
/usr/bin/ozreofkepj

Filesize
611KB

MD5
cea98af8c87c8eae1e7ce0510489e7cb

SHA1
08c6dbf2101ae9e8a52651016febd0c645f09246

SHA256
69a605513e80a752941112bb7018ed085e42c1e7600fc610ff18586ae9c63618

SHA512
c02f51364ec8c56c4bc69c7fae3d84313e0583e4a0a3b47ec0ae0597b40d6a4578706069247b747c523a74009fe46222f590004ee844d713b9214fc6f45a76ad

Download Submit
/usr/bin/ozreofkepj

Filesize
611KB

MD5
01958f2c21018a9e482efd74a6b34427

SHA1
2bc9c90cc2ea8f693709b4340b92b21688ab79b8

SHA256
606b072c78feff085ec4e694423b72c5ce7cf753e16d1eda966d3992009821f7

SHA512
cb5b7465d2ac3a0ade13b53542296b1db5491311363d7add7b2c1ce1f6471a9189c276c0e956fb67c0a3cb110722a764824eea06f740c520d6159dd180e36e24

Download Submit
/usr/bin/pdycgybivs

Filesize
611KB

MD5
32d6808131609c63b5522aa92d0ee538

SHA1
9ee7b6934eda3fcfb041cf7a96ef69baa2d8997e

SHA256
4d11936ecf583fc289c4f121e77850191e4155fc03c5b46ca906b5a49fec9668

SHA512
7b2807b78d2f2fa855cdbdd14a551892807a701932762797ca6b947f0665cc072ea20dde943598585acf246f9a0c25f69efcb041c4e2215308c566f8ec46f05d

Download Submit
/usr/bin/pdycgybivs

Filesize
611KB

MD5
5e4387113d9635cc6eb2a7570a2ee2f9

SHA1
293aff0feb4ecc733abd8a2aa89f785368d1be83

SHA256
bb72f4502022bedeff73a1247c76e60cc18aefeb748413f7362f477159af001a

SHA512
97e38c5fd3e243cbcae44155ad7c4d1cff8e60ca779f560439f8e4263fa576e1d0be77f954c92c87055c253a0407820297c430be706f1bd48866db94cd9b970d

Download Submit
/usr/bin/pwwrozcwsj

Filesize
611KB

MD5
9c8a530675b6e906133ecddb2dfcf959

SHA1
c88b019c4c9fc56075fd3fe39042a36672b0706b

SHA256
5e431cb8a98617d45165886c41200b473929a685806045fc80bb66b47f71d172

SHA512
45beae602016f1ed4f2d5dc079be4ef9d75ed5df9ee43cb0548a303717172855f0433ef3c99884868abe9bfc5e3c912c2158e8e05ddb9273bcb8cbbab15513af

Download Submit
/usr/bin/pwwrozcwsj

Filesize
611KB

MD5
178e6229bbf4ade114c311d3dda6318a

SHA1
94fa8db9622eea2d55b7ac567915f18e4b8c8095

SHA256
522e1dd5f9e94aecc822d118475da7c7590f0cdcd22c345baa36910aadfc59c3

SHA512
c2fa221f20b33ec4a9fbd37e5fd666445464687e2509709544a3188b1793a61f42cc081c6b86a72c09c72d970ddb97c97b678f1543400c5518cd8527ba8f6733

Download Submit
/usr/bin/qahwidgeuj

Filesize
611KB

MD5
3f916626786fedb281854be7ea516fef

SHA1
abc324ff661ee1a171089c376f073cf18ab9aa21

SHA256
5f332026b8261aee6f15e1857c03f9a99ccc55d235c50693f878d86740a4850f

SHA512
ab8f5102930cfa375f99acdd8c44b68ddd85e4c25aa5ff939b878a56a8e91bd8cfaa8ef77a8433c76628e79e92dea53d1e98123cd7c367671315dd7f705fd648

Download Submit
/usr/bin/qahwidgeuj

Filesize
611KB

MD5
9e70c82d8962f0d73ab121911fad29f7

SHA1
36acc938c962b459c379bc730b63975a921556ec

SHA256
de2a03a813cf93ef6ec4501633a1bda9d36ef89dc2db5a3565757f1e05f897fb

SHA512
63648c26146b321b040983c99a0e33caa414d25fcb64718bc4a510e618cbf41d7814a990bf5d53ef1a29c266d12b20033b7553124ba2ee3ab9fdfcbd59fd3617

Download Submit
/usr/bin/swlrwiukjq

Filesize
611KB

MD5
dd417c693403f3325ddfeb580143ab32

SHA1
25eba52aac2ae40199b68c2d3a9985076f9b0e5a

SHA256
c2f9cd15ec449ef513262b3514bb14becf3d7b2d356e1bb3af757b68ccbca6a9

SHA512
993bd969c93b9396d10145abfd7d7cf7051532ebdcf6c2f59d2e33ec6ca25dd5f3de05aa0c8da99534d5accf55471aa6bdad5c62293b05a9280df81c0a72061f

Download Submit
/usr/bin/swlrwiukjq

Filesize
611KB

MD5
276df1e233b15c9670eb88aaa6e5757b

SHA1
e3552283f3ec7eb8cca9c85c74501e574c9a7527

SHA256
a295aea0195bc7f2901dfd1e7f2d0e6c63f280a72a865675b12e78b49157404c

SHA512
f6832b68135897d7e0b25b22443018439072558001fbbe13ef4377c769f5787b95b884b121b2c818f2982e4ec70e21284f1316cf1eb70252bc85d6b738157921

Download Submit
/usr/bin/szfigrhiaq

Filesize
611KB

MD5
45571f4db9684573e210c690b4dfd45f

SHA1
b7842f749871dce06bdb4f4337985e8e93fd5b4a

SHA256
f0773b6d7e0ebf440a26e087cafec57d9f5301a11aaeaf07eccf74d1563d7fb0

SHA512
5fef7ed92a9d22481eefd364dc941874eb3fe35c11ea5fe862f6be26a0ec1255fb5886135811cc06c66345420cb156003f4ab05aa46ee85d76159fba2c635bf6

Download Submit
/usr/bin/szfigrhiaq

Filesize
611KB

MD5
472a7d5baff1d858523cbe9d29ca2418

SHA1
5134690234d7171ea5acf3fc9c057be04d159296

SHA256
7c1cb49291b137677126b14f7758ded4b4ff7afae377daee0ab6dde316cb4669

SHA512
c5d42f06e46a99d2615b1bb530c9bef3789e8bbe52507b521756e9e7804764d2814f936a216be621e1470ed2460ca34c3b3344e6b0ea7dd0c229941f03c878df

Download Submit
/usr/bin/tfqdxuefry

Filesize
611KB

MD5
7f4b027a7b7e870e9ceb1a0dc0e79929

SHA1
68821ed9be22a7f99e5fb9e0506ff20a29e2c4d7

SHA256
461161f02388d2ed8e41f2016bd75997491648ca46930281b2e0b758e25a4dec

SHA512
80100723b305ff6ca9cf222113351dda1ecda1d1c9db466e7249f6bef0a07c9ea7999ceac96898b3a7e51ad92650a9c872dc664e1033a0fe148752b8bc16da6a

Download Submit
/usr/bin/tfqdxuefry

Filesize
611KB

MD5
0c35e632900f4892d691bb9cdfd72cfa

SHA1
f2b8c68539bf52187fc07380d068dd331a965230

SHA256
7b0c38f02d186ae26ac17adb51e4da3a85ac4f79480154a08aa94dc87a27f7a0

SHA512
438d9c70fe7a7d125b82d8ee969c8b728ba093f4ccddc79dcc18b1ceaa1eae837792506c9a2769a33dd54f29140f66ca45fca087435d99cbcf7e38fd30b66879

Download Submit
/usr/bin/uaknwidqlq

Filesize
611KB

MD5
2f1a8f30bdea60b002e30329bcd23cb7

SHA1
739aa94b5878acde76c85158fd8c96b9fb55afc5

SHA256
4d80564a1ba00c5fbaeefcd1ea81b0019fcaa94b90c5b3383b1b4298a5480bce

SHA512
0925e215a0044a496711929baec27d9b0af161c613d79be4cba963d1b855734e236529cb10e570f66cb76389b595568c6eeed2d1e8dd92d93be2a13dc7b8c27d

Download Submit
/usr/bin/uaknwidqlq

Filesize
611KB

MD5
9dc8872e67ea6d8bcf2888cc058f6979

SHA1
8e6f2d86bef0fd3ec331b2c3fd19e49ca0fb88b1

SHA256
24784fc8d71a7b50914194d765a643d54eb035879b7a64d47489013f49f338f6

SHA512
7d09b4b5ac2cfb4e7982329d7bfb28089c9d535ca38eaf88a4128d3a1820ea4e38c05d2ff8b5a93e35ae6772f4227eca41dd3b078c0f72647c870cba08c007b2

Download Submit
/usr/bin/uipkfplcos

Filesize
611KB

MD5
26e699b1d20e67fb5c1bfaaca259b574

SHA1
e1f7d5ed7f6253a17ea68c4548633ee1ca174437

SHA256
881bfa57c59976dbbf8c9d063e550bc7e217cceeca1c5e4b49ec092664156a09

SHA512
e05db4ce61531045b66cce1c24dd7a3d629a35333b1802441113efd658e2115bb59873242326eeac3753f1cba4ae971fea5534ee48b71e6c49df7bb339f39888

Download Submit
/usr/bin/uipkfplcos

Filesize
611KB

MD5
761a46fc1e7e853d9dc45fbbc4d0856a

SHA1
e2a91713088152f5c1eb3cd5a343c43de3640e16

SHA256
425a79b05d20eebde06f71eb4fa4650967582134cbc2db70eb58f8530052d901

SHA512
c3b4a10ea37e5afffc74b1950868de2a99f8708b1e213835f166a5dfb92c583ffb74e678436639b7cff0bc1384b21beca373575036d35a70bef71f1eb71eb415

Download Submit
/usr/bin/wfzjniaali

Filesize
611KB

MD5
e440d8b603cb5bb522b959803145dc6e

SHA1
e0832d235f7f427a653b3a6f564349efa148aa1a

SHA256
f40c40c61cf5a314a5d74079a646c2991f0961d5c1b75fb36bc02fadacaf54a2

SHA512
b22bb6d159f29eb4cf209e717594c29de5a519537db16cba69ad36c1cb76796bde1443cc067a24be2c386ce908e98de4466a3b93224f920087175b8ffe8b0d44

Download Submit
/usr/bin/wfzjniaali

Filesize
611KB

MD5
3e6582e4b64134893d9a9ecd9aedbc52

SHA1
fabc5b3c4dd085bff01ab2fc69b4f4164cb1d9c2

SHA256
aa7024e658f6a07443e3387a9584a2c906dc1d7504cf21f6f0c54b5e66706af9

SHA512
9cffa797e4f34ddf476b4d5caee9bcfeeaf5d03429965a5c0a9c43a713b3ce0ac0bc4be61b0a6c2c876a8df4cffc8020a3aafbc9e1f56404d9b817a2b092b053

Download Submit
/usr/bin/xnktwmjcsl

Filesize
611KB

MD5
03247dfbc7f4246b74785d88e81bbd1c

SHA1
6db33697e25fdd541eb9b0febc93adfb344c9330

SHA256
3e3fd5b2becb8bb5d0effbd1e9649ed5a1696043404171f1d36035f732650dff

SHA512
b5cb3ddea77969119e8960c32afdae6cf6908f4b11c2de6dbacf180230fe090864c3612b6eb834d05ef83d4f746edd2af0db22010095813681d132cdd2166806

Download Submit
/usr/bin/xnktwmjcsl

Filesize
611KB

MD5
669da05746eb7b4664c3811a992bea2c

SHA1
9f22ed0a82b138938cb5dc16c94144cf459c7b0d

SHA256
5b33d2ffd2bca49ebfa25778d9277eace5e569b1dd7497483ddb1f8c1f057833

SHA512
7176919b643457be91b2f7cb4b6f46667ac6834f09de1ad5b6e54f74e26a00c7437442d96e79cd00b7e3702a0cc42fd4fb758a3ec38bbb003ab4a361c96ea9d0

Download Submit
/usr/bin/xqrrcuxfti

Filesize
611KB

MD5
0fb5785894aa460909771848cf4d91ca

SHA1
990cd91ce8b605188648058caa1a4fa499610286

SHA256
4aaf42ee9c1fd4e8fc46e6602c53c4972a0abafa7a6936d10e45f6a5f4f41bf7

SHA512
ef225576da2b59cba981be15876af169445bc068fe2c1a6990349835e69d500ada04afcc8b7d71ef452f3526c69b1c1336b8b8defdf6db2f8663a4e42ba986b5

Download Submit
/usr/bin/xqrrcuxfti

Filesize
611KB

MD5
c26ff3758d4ddb7aa633d9a08df16d1b

SHA1
128af9d7a92ff0f34ab9274e67061273d175b31d

SHA256
dd96d18564eb8922b480cb26856a9456722371ce8e62744a3827ed1bdd2beb6b

SHA512
c32009a8855fac9fe3964ccef56447e24d0dc56340afbe9addce8e3d39ee501747a5fdab8a1edecee220cd575e590a561113722f6dcc1b0785c8cc6a8f11b723

Download Submit
/usr/bin/yhkhvnhjhy

Filesize
611KB

MD5
2729a63a1ecf232552c3f958be6e01a5

SHA1
2348291f7ab66d3d74a1129b2436fa4883fbe438

SHA256
a5b4cd0254f6bd030bff249b49cfd3ef5bcea5aad28c3077dd14f11463cf3c34

SHA512
afc2ea614b723d103a835ec217793474dbb55a444279f07f053c00de1008f6c336a6c4a6e6c49f37a98a799bdc177669f74953fe32db98d3b588761eea827418

Download Submit
/usr/bin/yhkhvnhjhy

Filesize
611KB

MD5
a04d1a4a43fbbcc9544cab5817f962b5

SHA1
859ea3d44dcfe20695e0cbf836cb6f913abd704b

SHA256
c40af77b5bb116262fefd165150a1ac987e44d217e828b8d9a255914cb0278e8

SHA512
765e426714e4afc54b9e67f1860db738148e91ab4cef5f942c81e63fcfa789a42804c337fde913ed4f0b77f93bdf39afa5695bfd6939af9604e14d89e75f79d7

Download Submit
/usr/bin/ztnqkqszeb

Filesize
611KB

MD5
6b4f01f5b2d8e8c6c2d733710c38e326

SHA1
f3d5920e28d31f4f507a25e281f4d37ef6cb12a4

SHA256
b73b93b95c616366136a896337627fca9b54cb5064aa4b2e35ad12867563edf0

SHA512
edfe2f41fb2f4fb8a4e4db9f4dbac930a5a950c48172b20655f4eb780053d0af2823c449db7460f1aa03a54184e0f7bc88e965df9ea1648d350c9462ec1d6f01

Download Submit
/usr/bin/ztnqkqszeb

Filesize
611KB

MD5
656a8daa774f39135dbc8d85e6d04bed

SHA1
debc604c23de3a6e15cb1cf0a0209874092fd430

SHA256
ffa54c5ccb005b74e943004c649e34dfff0ae5322600ca5be889b4c11359862c

SHA512
0ed9a01e13a1594b5e161d0d49f13ca555fb8fe61bb83f0f9b48d0dc318ddb2dfa51097df2ebafe7feb170800946b91e1ad2c07aeaa3548ee29f8e0217d440ef

Download Submit
/usr/lib/libudev.so

Filesize
611KB

MD5
232e172f7a005dd12d4aad55e0c4a331

SHA1
9425435b359cd7ee6138564c687709e9d244f065

SHA256
696bad26159da671a74a879c34188dcae0edcd6726f8314c5bde240765235dd8

SHA512
f42110ba007957a6256c9a74e0d6e57dd8a3918823a803dbac583155438a60072c54f79ad052ff24da27ff649c04ead6e9962c32710bcf8eb072e8e0050c769f

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads