74c8c33e442ca7d5eecf11b47eb8698ef95457cfd60f50e1051e2251df609348

Analysis

max time kernel
3s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17/05/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bssh-devil/mass
Size

4KB
MD5

68588348f132aca0058d357b8e9f2713
SHA1

156fe2c968b1241c9021d32a73b8f4095a648b82
SHA256

9d87c06e3aede40862887087d76173c2ac487e78cfb5e82aa9d2780d94bb32e4
SHA512

882e7528652dbfb3852ca5d08997adc6fe96489d147bca9ca0d2b3feb281cadca20e71937a37008d8ea3f291d738652d0090e1ab92295959522829ea428bde3b
SSDEEP

24:v+gfQjUus1EPz0hyzwGA9/F3+2g27VINUl95KeoUsP+iUprLANa7g0k8bgMucknh:v32EEPwhyzwR/9+M7Zlkn+LFZbHi

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/1128/stat	killall
File opened for reading	/proc/1489/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/205/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/31/stat	killall
File opened for reading	/proc/1120/stat	killall
File opened for reading	/proc/1486/cmdline	killall
File opened for reading	/proc/766/stat	killall
File opened for reading	/proc/875/stat	killall
File opened for reading	/proc/1065/stat	killall
File opened for reading	/proc/1175/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/1138/stat	killall
File opened for reading	/proc/1491/stat	killall
File opened for reading	/proc/169/stat	killall
File opened for reading	/proc/685/stat	killall
File opened for reading	/proc/1288/stat	killall
File opened for reading	/proc/1302/stat	killall
File opened for reading	/proc/115/stat	killall
File opened for reading	/proc/162/stat	killall
File opened for reading	/proc/461/stat	killall
File opened for reading	/proc/1184/stat	killall
File opened for reading	/proc/1187/stat	killall
File opened for reading	/proc/1242/stat	killall
File opened for reading	/proc/172/stat	killall
File opened for reading	/proc/981/stat	killall
File opened for reading	/proc/1055/stat	killall
File opened for reading	/proc/1116/cmdline	killall
File opened for reading	/proc/1297/stat	killall
File opened for reading	/proc/448/stat	killall
File opened for reading	/proc/542/cmdline	killall
File opened for reading	/proc/1032/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/325/stat	killall
File opened for reading	/proc/1018/stat	killall
File opened for reading	/proc/1051/stat	killall
File opened for reading	/proc/1112/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/1488/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/789/stat	killall
File opened for reading	/proc/1138/cmdline	killall
File opened for reading	/proc/1234/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/454/cmdline	killall
File opened for reading	/proc/1463/stat	killall
File opened for reading	/proc/171/stat	killall
File opened for reading	/proc/917/stat	killall
File opened for reading	/proc/1156/stat	killall
File opened for reading	/proc/1133/stat	killall
File opened for reading	/proc/30/stat	killall
File opened for reading	/proc/83/stat	killall
File opened for reading	/proc/163/stat	killall
File opened for reading	/proc/531/stat	killall
File opened for reading	/proc/1013/stat	killall
File opened for reading	/proc/588/cmdline	killall

/tmp/bssh-devil/mass
/tmp/bssh-devil/mass
1⤵
PID:1491
- /usr/bin/clear
  clear
  2⤵
  PID:1492
- /tmp/bssh-devil/scan_user
  ./scan_user .0
  2⤵
  PID:1493
- /tmp/bssh-devil/scan_user
  ./scan_user .1
  2⤵
  PID:1494
- /tmp/bssh-devil/scan_user
  ./scan_user .2
  2⤵
  PID:1495
- /tmp/bssh-devil/scan_user
  ./scan_user .3
  2⤵
  PID:1496
- /tmp/bssh-devil/scan_user
  ./scan_user .4
  2⤵
  PID:1497
- /tmp/bssh-devil/scan_user
  ./scan_user .5
  2⤵
  PID:1498
- /tmp/bssh-devil/scan_user
  ./scan_user .6
  2⤵
  PID:1499
- /tmp/bssh-devil/scan_user
  ./scan_user .7
  2⤵
  PID:1500
- /tmp/bssh-devil/scan_user
  ./scan_user .8
  2⤵
  PID:1501
- /tmp/bssh-devil/scan_user
  ./scan_user .9
  2⤵
  PID:1502
- /tmp/bssh-devil/scan_user
  ./scan_user .10
  2⤵
  PID:1503
- /tmp/bssh-devil/scan_user
  ./scan_user .11
  2⤵
  PID:1504
- /tmp/bssh-devil/scan_user
  ./scan_user .12
  2⤵
  PID:1505
- /tmp/bssh-devil/scan_user
  ./scan_user .13
  2⤵
  PID:1506
- /tmp/bssh-devil/scan_user
  ./scan_user .14
  2⤵
  PID:1507
- /tmp/bssh-devil/scan_user
  ./scan_user .15
  2⤵
  PID:1508
- /tmp/bssh-devil/scan_user
  ./scan_user .16
  2⤵
  PID:1509
- /tmp/bssh-devil/scan_user
  ./scan_user .17
  2⤵
  PID:1510
- /tmp/bssh-devil/scan_user
  ./scan_user .18
  2⤵
  PID:1511
- /tmp/bssh-devil/scan_user
  ./scan_user .19
  2⤵
  PID:1512
- /tmp/bssh-devil/scan_user
  ./scan_user .20
  2⤵
  PID:1513
- /tmp/bssh-devil/scan_user
  ./scan_user .21
  2⤵
  PID:1514
- /tmp/bssh-devil/scan_user
  ./scan_user .22
  2⤵
  PID:1515
- /tmp/bssh-devil/scan_user
  ./scan_user .23
  2⤵
  PID:1516
- /tmp/bssh-devil/scan_user
  ./scan_user .24
  2⤵
  PID:1517
- /tmp/bssh-devil/scan_user
  ./scan_user .25
  2⤵
  PID:1518
- /tmp/bssh-devil/scan_user
  ./scan_user .26
  2⤵
  PID:1519
- /tmp/bssh-devil/scan_user
  ./scan_user .27
  2⤵
  PID:1520
- /tmp/bssh-devil/scan_user
  ./scan_user .28
  2⤵
  PID:1521
- /tmp/bssh-devil/scan_user
  ./scan_user .29
  2⤵
  PID:1522
- /tmp/bssh-devil/scan_user
  ./scan_user .30
  2⤵
  PID:1523
- /tmp/bssh-devil/scan_user
  ./scan_user .31
  2⤵
  PID:1524
- /tmp/bssh-devil/scan_user
  ./scan_user .32
  2⤵
  PID:1525
- /tmp/bssh-devil/scan_user
  ./scan_user .33
  2⤵
  PID:1526
- /tmp/bssh-devil/scan_user
  ./scan_user .34
  2⤵
  PID:1527
- /tmp/bssh-devil/scan_user
  ./scan_user .35
  2⤵
  PID:1528
- /tmp/bssh-devil/scan_user
  ./scan_user .36
  2⤵
  PID:1529
- /tmp/bssh-devil/scan_user
  ./scan_user .37
  2⤵
  PID:1530
- /tmp/bssh-devil/scan_user
  ./scan_user .38
  2⤵
  PID:1531
- /tmp/bssh-devil/scan_user
  ./scan_user .39
  2⤵
  PID:1532
- /tmp/bssh-devil/scan_user
  ./scan_user .40
  2⤵
  PID:1533
- /tmp/bssh-devil/scan_user
  ./scan_user .41
  2⤵
  PID:1534
- /tmp/bssh-devil/scan_user
  ./scan_user .42
  2⤵
  PID:1535
- /tmp/bssh-devil/scan_user
  ./scan_user .43
  2⤵
  PID:1536
- /tmp/bssh-devil/scan_user
  ./scan_user .44
  2⤵
  PID:1537
- /tmp/bssh-devil/scan_user
  ./scan_user .45
  2⤵
  PID:1538
- /tmp/bssh-devil/scan_user
  ./scan_user .46
  2⤵
  PID:1539
- /tmp/bssh-devil/scan_user
  ./scan_user .47
  2⤵
  PID:1540
- /tmp/bssh-devil/scan_user
  ./scan_user .48
  2⤵
  PID:1541
- /tmp/bssh-devil/scan_user
  ./scan_user .49
  2⤵
  PID:1542
- /tmp/bssh-devil/scan_user
  ./scan_user .50
  2⤵
  PID:1543
- /tmp/bssh-devil/scan_user
  ./scan_user .51
  2⤵
  PID:1544
- /tmp/bssh-devil/scan_user
  ./scan_user .52
  2⤵
  PID:1545
- /tmp/bssh-devil/scan_user
  ./scan_user .53
  2⤵
  PID:1546
- /tmp/bssh-devil/scan_user
  ./scan_user .54
  2⤵
  PID:1547
- /tmp/bssh-devil/scan_user
  ./scan_user .55
  2⤵
  PID:1548
- /tmp/bssh-devil/scan_user
  ./scan_user .56
  2⤵
  PID:1549
- /tmp/bssh-devil/scan_user
  ./scan_user .57
  2⤵
  PID:1550
- /tmp/bssh-devil/scan_user
  ./scan_user .58
  2⤵
  PID:1551
- /tmp/bssh-devil/scan_user
  ./scan_user .59
  2⤵
  PID:1552
- /tmp/bssh-devil/scan_user
  ./scan_user .60
  2⤵
  PID:1553
- /tmp/bssh-devil/scan_user
  ./scan_user .61
  2⤵
  PID:1554
- /tmp/bssh-devil/scan_user
  ./scan_user .62
  2⤵
  PID:1555
- /tmp/bssh-devil/scan_user
  ./scan_user .63
  2⤵
  PID:1556
- /tmp/bssh-devil/scan_user
  ./scan_user .64
  2⤵
  PID:1557
- /tmp/bssh-devil/scan_user
  ./scan_user .65
  2⤵
  PID:1558
- /tmp/bssh-devil/scan_user
  ./scan_user .66
  2⤵
  PID:1559
- /tmp/bssh-devil/scan_user
  ./scan_user .67
  2⤵
  PID:1560
- /tmp/bssh-devil/scan_user
  ./scan_user .68
  2⤵
  PID:1561
- /tmp/bssh-devil/scan_user
  ./scan_user .69
  2⤵
  PID:1562
- /tmp/bssh-devil/scan_user
  ./scan_user .70
  2⤵
  PID:1563
- /tmp/bssh-devil/scan_user
  ./scan_user .71
  2⤵
  PID:1564
- /tmp/bssh-devil/scan_user
  ./scan_user .72
  2⤵
  PID:1565
- /tmp/bssh-devil/scan_user
  ./scan_user .73
  2⤵
  PID:1566
- /tmp/bssh-devil/scan_user
  ./scan_user .74
  2⤵
  PID:1567
- /tmp/bssh-devil/scan_user
  ./scan_user .75
  2⤵
  PID:1568
- /tmp/bssh-devil/scan_user
  ./scan_user .76
  2⤵
  PID:1569
- /tmp/bssh-devil/scan_user
  ./scan_user .77
  2⤵
  PID:1570
- /tmp/bssh-devil/scan_user
  ./scan_user .78
  2⤵
  PID:1571
- /tmp/bssh-devil/scan_user
  ./scan_user .79
  2⤵
  PID:1572
- /tmp/bssh-devil/scan_user
  ./scan_user .80
  2⤵
  PID:1573
- /tmp/bssh-devil/scan_user
  ./scan_user .81
  2⤵
  PID:1574
- /tmp/bssh-devil/scan_user
  ./scan_user .82
  2⤵
  PID:1575
- /tmp/bssh-devil/scan_user
  ./scan_user .83
  2⤵
  PID:1576
- /tmp/bssh-devil/scan_user
  ./scan_user .84
  2⤵
  PID:1577
- /tmp/bssh-devil/scan_user
  ./scan_user .85
  2⤵
  PID:1578
- /tmp/bssh-devil/scan_user
  ./scan_user .86
  2⤵
  PID:1579
- /tmp/bssh-devil/scan_user
  ./scan_user .87
  2⤵
  PID:1580
- /tmp/bssh-devil/scan_user
  ./scan_user .88
  2⤵
  PID:1581
- /tmp/bssh-devil/scan_user
  ./scan_user .89
  2⤵
  PID:1582
- /tmp/bssh-devil/scan_user
  ./scan_user .90
  2⤵
  PID:1583
- /tmp/bssh-devil/scan_user
  ./scan_user .91
  2⤵
  PID:1584
- /tmp/bssh-devil/scan_user
  ./scan_user .92
  2⤵
  PID:1585
- /tmp/bssh-devil/scan_user
  ./scan_user .93
  2⤵
  PID:1586
- /tmp/bssh-devil/scan_user
  ./scan_user .94
  2⤵
  PID:1587
- /tmp/bssh-devil/scan_user
  ./scan_user .95
  2⤵
  PID:1588
- /tmp/bssh-devil/scan_user
  ./scan_user .96
  2⤵
  PID:1589
- /tmp/bssh-devil/scan_user
  ./scan_user .97
  2⤵
  PID:1590
- /tmp/bssh-devil/scan_user
  ./scan_user .98
  2⤵
  PID:1591
- /tmp/bssh-devil/scan_user
  ./scan_user .99
  2⤵
  PID:1592
- /tmp/bssh-devil/scan_user
  ./scan_user .100
  2⤵
  PID:1593
- /tmp/bssh-devil/scan_user
  ./scan_user .101
  2⤵
  PID:1594
- /tmp/bssh-devil/scan_user
  ./scan_user .102
  2⤵
  PID:1595
- /tmp/bssh-devil/scan_user
  ./scan_user .103
  2⤵
  PID:1596
- /tmp/bssh-devil/scan_user
  ./scan_user .104
  2⤵
  PID:1597
- /tmp/bssh-devil/scan_user
  ./scan_user .105
  2⤵
  PID:1598
- /tmp/bssh-devil/scan_user
  ./scan_user .106
  2⤵
  PID:1599
- /tmp/bssh-devil/scan_user
  ./scan_user .107
  2⤵
  PID:1600
- /tmp/bssh-devil/scan_user
  ./scan_user .108
  2⤵
  PID:1601
- /tmp/bssh-devil/scan_user
  ./scan_user .109
  2⤵
  PID:1602
- /tmp/bssh-devil/scan_user
  ./scan_user .110
  2⤵
  PID:1603
- /tmp/bssh-devil/scan_user
  ./scan_user .111
  2⤵
  PID:1604
- /tmp/bssh-devil/scan_user
  ./scan_user .112
  2⤵
  PID:1605
- /tmp/bssh-devil/scan_user
  ./scan_user .113
  2⤵
  PID:1606
- /tmp/bssh-devil/scan_user
  ./scan_user .114
  2⤵
  PID:1607
- /tmp/bssh-devil/scan_user
  ./scan_user .115
  2⤵
  PID:1608
- /tmp/bssh-devil/scan_user
  ./scan_user .116
  2⤵
  PID:1609
- /tmp/bssh-devil/scan_user
  ./scan_user .117
  2⤵
  PID:1610
- /tmp/bssh-devil/scan_user
  ./scan_user .118
  2⤵
  PID:1611
- /tmp/bssh-devil/scan_user
  ./scan_user .119
  2⤵
  PID:1612
- /tmp/bssh-devil/scan_user
  ./scan_user .120
  2⤵
  PID:1613
- /tmp/bssh-devil/scan_user
  ./scan_user .121
  2⤵
  PID:1614
- /tmp/bssh-devil/scan_user
  ./scan_user .122
  2⤵
  PID:1615
- /tmp/bssh-devil/scan_user
  ./scan_user .123
  2⤵
  PID:1616
- /tmp/bssh-devil/scan_user
  ./scan_user .124
  2⤵
  PID:1617
- /tmp/bssh-devil/scan_user
  ./scan_user .125
  2⤵
  PID:1618
- /tmp/bssh-devil/scan_user
  ./scan_user .126
  2⤵
  PID:1619
- /tmp/bssh-devil/scan_user
  ./scan_user .127
  2⤵
  PID:1620
- /tmp/bssh-devil/scan_user
  ./scan_user .128
  2⤵
  PID:1621
- /tmp/bssh-devil/scan_user
  ./scan_user .129
  2⤵
  PID:1622
- /tmp/bssh-devil/scan_user
  ./scan_user .130
  2⤵
  PID:1623
- /tmp/bssh-devil/scan_user
  ./scan_user .131
  2⤵
  PID:1624
- /tmp/bssh-devil/scan_user
  ./scan_user .132
  2⤵
  PID:1625
- /tmp/bssh-devil/scan_user
  ./scan_user .133
  2⤵
  PID:1626
- /tmp/bssh-devil/scan_user
  ./scan_user .134
  2⤵
  PID:1627
- /tmp/bssh-devil/scan_user
  ./scan_user .135
  2⤵
  PID:1628
- /tmp/bssh-devil/scan_user
  ./scan_user .136
  2⤵
  PID:1629
- /tmp/bssh-devil/scan_user
  ./scan_user .137
  2⤵
  PID:1630
- /tmp/bssh-devil/scan_user
  ./scan_user .138
  2⤵
  PID:1631
- /tmp/bssh-devil/scan_user
  ./scan_user .139
  2⤵
  PID:1632
- /tmp/bssh-devil/scan_user
  ./scan_user .140
  2⤵
  PID:1633
- /tmp/bssh-devil/scan_user
  ./scan_user .141
  2⤵
  PID:1634
- /tmp/bssh-devil/scan_user
  ./scan_user .142
  2⤵
  PID:1635
- /tmp/bssh-devil/scan_user
  ./scan_user .143
  2⤵
  PID:1636
- /tmp/bssh-devil/scan_user
  ./scan_user .144
  2⤵
  PID:1637
- /tmp/bssh-devil/scan_user
  ./scan_user .145
  2⤵
  PID:1638
- /tmp/bssh-devil/scan_user
  ./scan_user .146
  2⤵
  PID:1639
- /tmp/bssh-devil/scan_user
  ./scan_user .147
  2⤵
  PID:1640
- /tmp/bssh-devil/scan_user
  ./scan_user .148
  2⤵
  PID:1641
- /tmp/bssh-devil/scan_user
  ./scan_user .149
  2⤵
  PID:1642
- /tmp/bssh-devil/scan_user
  ./scan_user .150
  2⤵
  PID:1643
- /tmp/bssh-devil/scan_user
  ./scan_user .151
  2⤵
  PID:1644
- /tmp/bssh-devil/scan_user
  ./scan_user .152
  2⤵
  PID:1645
- /tmp/bssh-devil/scan_user
  ./scan_user .153
  2⤵
  PID:1646
- /tmp/bssh-devil/scan_user
  ./scan_user .154
  2⤵
  PID:1647
- /tmp/bssh-devil/scan_user
  ./scan_user .155
  2⤵
  PID:1648
- /tmp/bssh-devil/scan_user
  ./scan_user .156
  2⤵
  PID:1649
- /tmp/bssh-devil/scan_user
  ./scan_user .157
  2⤵
  PID:1650
- /tmp/bssh-devil/scan_user
  ./scan_user .158
  2⤵
  PID:1651
- /tmp/bssh-devil/scan_user
  ./scan_user .159
  2⤵
  PID:1652
- /tmp/bssh-devil/scan_user
  ./scan_user .160
  2⤵
  PID:1653
- /tmp/bssh-devil/scan_user
  ./scan_user .161
  2⤵
  PID:1654
- /tmp/bssh-devil/scan_user
  ./scan_user .162
  2⤵
  PID:1655
- /tmp/bssh-devil/scan_user
  ./scan_user .163
  2⤵
  PID:1656
- /tmp/bssh-devil/scan_user
  ./scan_user .164
  2⤵
  PID:1657
- /tmp/bssh-devil/scan_user
  ./scan_user .165
  2⤵
  PID:1658
- /tmp/bssh-devil/scan_user
  ./scan_user .166
  2⤵
  PID:1659
- /tmp/bssh-devil/scan_user
  ./scan_user .167
  2⤵
  PID:1660
- /tmp/bssh-devil/scan_user
  ./scan_user .168
  2⤵
  PID:1661
- /tmp/bssh-devil/scan_user
  ./scan_user .169
  2⤵
  PID:1662
- /tmp/bssh-devil/scan_user
  ./scan_user .170
  2⤵
  PID:1663
- /tmp/bssh-devil/scan_user
  ./scan_user .171
  2⤵
  PID:1664
- /tmp/bssh-devil/scan_user
  ./scan_user .172
  2⤵
  PID:1665
- /tmp/bssh-devil/scan_user
  ./scan_user .173
  2⤵
  PID:1666
- /tmp/bssh-devil/scan_user
  ./scan_user .174
  2⤵
  PID:1667
- /tmp/bssh-devil/scan_user
  ./scan_user .175
  2⤵
  PID:1668
- /tmp/bssh-devil/scan_user
  ./scan_user .176
  2⤵
  PID:1669
- /tmp/bssh-devil/scan_user
  ./scan_user .177
  2⤵
  PID:1670
- /tmp/bssh-devil/scan_user
  ./scan_user .178
  2⤵
  PID:1671
- /tmp/bssh-devil/scan_user
  ./scan_user .179
  2⤵
  PID:1672
- /tmp/bssh-devil/scan_user
  ./scan_user .180
  2⤵
  PID:1673
- /tmp/bssh-devil/scan_user
  ./scan_user .181
  2⤵
  PID:1674
- /tmp/bssh-devil/scan_user
  ./scan_user .182
  2⤵
  PID:1675
- /tmp/bssh-devil/scan_user
  ./scan_user .183
  2⤵
  PID:1676
- /tmp/bssh-devil/scan_user
  ./scan_user .184
  2⤵
  PID:1677
- /tmp/bssh-devil/scan_user
  ./scan_user .185
  2⤵
  PID:1678
- /tmp/bssh-devil/scan_user
  ./scan_user .186
  2⤵
  PID:1679
- /tmp/bssh-devil/scan_user
  ./scan_user .187
  2⤵
  PID:1680
- /tmp/bssh-devil/scan_user
  ./scan_user .188
  2⤵
  PID:1681
- /tmp/bssh-devil/scan_user
  ./scan_user .189
  2⤵
  PID:1682
- /tmp/bssh-devil/scan_user
  ./scan_user .190
  2⤵
  PID:1683
- /tmp/bssh-devil/scan_user
  ./scan_user .191
  2⤵
  PID:1684
- /tmp/bssh-devil/scan_user
  ./scan_user .192
  2⤵
  PID:1685
- /tmp/bssh-devil/scan_user
  ./scan_user .193
  2⤵
  PID:1686
- /tmp/bssh-devil/scan_user
  ./scan_user .194
  2⤵
  PID:1687
- /tmp/bssh-devil/scan_user
  ./scan_user .195
  2⤵
  PID:1688
- /tmp/bssh-devil/scan_user
  ./scan_user .196
  2⤵
  PID:1689
- /tmp/bssh-devil/scan_user
  ./scan_user .197
  2⤵
  PID:1690
- /tmp/bssh-devil/scan_user
  ./scan_user .198
  2⤵
  PID:1691
- /tmp/bssh-devil/scan_user
  ./scan_user .199
  2⤵
  PID:1692
- /tmp/bssh-devil/scan_user
  ./scan_user .200
  2⤵
  PID:1693
- /tmp/bssh-devil/scan_user
  ./scan_user .201
  2⤵
  PID:1694
- /tmp/bssh-devil/scan_user
  ./scan_user .202
  2⤵
  PID:1695
- /tmp/bssh-devil/scan_user
  ./scan_user .203
  2⤵
  PID:1696
- /tmp/bssh-devil/scan_user
  ./scan_user .204
  2⤵
  PID:1697
- /tmp/bssh-devil/scan_user
  ./scan_user .205
  2⤵
  PID:1698
- /tmp/bssh-devil/scan_user
  ./scan_user .206
  2⤵
  PID:1699
- /tmp/bssh-devil/scan_user
  ./scan_user .207
  2⤵
  PID:1700
- /tmp/bssh-devil/scan_user
  ./scan_user .208
  2⤵
  PID:1701
- /tmp/bssh-devil/scan_user
  ./scan_user .209
  2⤵
  PID:1702
- /tmp/bssh-devil/scan_user
  ./scan_user .210
  2⤵
  PID:1703
- /tmp/bssh-devil/scan_user
  ./scan_user .211
  2⤵
  PID:1704
- /tmp/bssh-devil/scan_user
  ./scan_user .212
  2⤵
  PID:1705
- /tmp/bssh-devil/scan_user
  ./scan_user .213
  2⤵
  PID:1706
- /tmp/bssh-devil/scan_user
  ./scan_user .214
  2⤵
  PID:1707
- /tmp/bssh-devil/scan_user
  ./scan_user .215
  2⤵
  PID:1708
- /tmp/bssh-devil/scan_user
  ./scan_user .216
  2⤵
  PID:1709
- /tmp/bssh-devil/scan_user
  ./scan_user .217
  2⤵
  PID:1710
- /tmp/bssh-devil/scan_user
  ./scan_user .218
  2⤵
  PID:1711
- /tmp/bssh-devil/scan_user
  ./scan_user .219
  2⤵
  PID:1712
- /tmp/bssh-devil/scan_user
  ./scan_user .220
  2⤵
  PID:1713
- /tmp/bssh-devil/scan_user
  ./scan_user .221
  2⤵
  PID:1714
- /tmp/bssh-devil/scan_user
  ./scan_user .222
  2⤵
  PID:1715
- /tmp/bssh-devil/scan_user
  ./scan_user .223
  2⤵
  PID:1716
- /tmp/bssh-devil/scan_user
  ./scan_user .224
  2⤵
  PID:1717
- /tmp/bssh-devil/scan_user
  ./scan_user .225
  2⤵
  PID:1718
- /tmp/bssh-devil/scan_user
  ./scan_user .226
  2⤵
  PID:1719
- /tmp/bssh-devil/scan_user
  ./scan_user .227
  2⤵
  PID:1720
- /tmp/bssh-devil/scan_user
  ./scan_user .228
  2⤵
  PID:1721
- /tmp/bssh-devil/scan_user
  ./scan_user .229
  2⤵
  PID:1722
- /tmp/bssh-devil/scan_user
  ./scan_user .230
  2⤵
  PID:1723
- /tmp/bssh-devil/scan_user
  ./scan_user .231
  2⤵
  PID:1724
- /tmp/bssh-devil/scan_user
  ./scan_user .232
  2⤵
  PID:1725
- /tmp/bssh-devil/scan_user
  ./scan_user .233
  2⤵
  PID:1726
- /tmp/bssh-devil/scan_user
  ./scan_user .234
  2⤵
  PID:1727
- /tmp/bssh-devil/scan_user
  ./scan_user .235
  2⤵
  PID:1728
- /tmp/bssh-devil/scan_user
  ./scan_user .236
  2⤵
  PID:1729
- /tmp/bssh-devil/scan_user
  ./scan_user .237
  2⤵
  PID:1730
- /tmp/bssh-devil/scan_user
  ./scan_user .238
  2⤵
  PID:1734
- /tmp/bssh-devil/scan_user
  ./scan_user .239
  2⤵
  PID:1735
- /tmp/bssh-devil/scan_user
  ./scan_user .240
  2⤵
  PID:1736
- /tmp/bssh-devil/scan_user
  ./scan_user .241
  2⤵
  PID:1737
- /tmp/bssh-devil/scan_user
  ./scan_user .242
  2⤵
  PID:1738
- /tmp/bssh-devil/scan_user
  ./scan_user .243
  2⤵
  PID:1739
- /tmp/bssh-devil/scan_user
  ./scan_user .244
  2⤵
  PID:1740
- /tmp/bssh-devil/scan_user
  ./scan_user .245
  2⤵
  PID:1741
- /tmp/bssh-devil/scan_user
  ./scan_user .246
  2⤵
  PID:1742
- /tmp/bssh-devil/scan_user
  ./scan_user .247
  2⤵
  PID:1743
- /tmp/bssh-devil/scan_user
  ./scan_user .248
  2⤵
  PID:1744
- /tmp/bssh-devil/scan_user
  ./scan_user .249
  2⤵
  PID:1745
- /tmp/bssh-devil/scan_user
  ./scan_user .250
  2⤵
  PID:1746
- /tmp/bssh-devil/scan_user
  ./scan_user .251
  2⤵
  PID:1747
- /tmp/bssh-devil/scan_user
  ./scan_user .252
  2⤵
  PID:1748
- /tmp/bssh-devil/scan_user
  ./scan_user .253
  2⤵
  PID:1749
- /tmp/bssh-devil/scan_user
  ./scan_user .254
  2⤵
  PID:1750
- /tmp/bssh-devil/scan_user
  ./scan_user .255
  2⤵
  PID:1751
- /bin/sleep
  sleep 3
  2⤵
  PID:1752
- /usr/bin/killall
  killall -9 scan_user
  2⤵
  - Reads runtime system information
  PID:1753

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads