8f2c7ff8dfcb4f27c8b28763a80e95db601be5608daeed7524429d6ae90ea04b

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/05/2024, 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

parkos_el7_install.sh
Size

7KB
MD5

da7a9b77465f511cb4dbcf3339790747
SHA1

39c8ca41db979581f390168cf9be91677799a0fc
SHA256

8f2c7ff8dfcb4f27c8b28763a80e95db601be5608daeed7524429d6ae90ea04b
SHA512

f6bff956a14749bf680fd1226c22feb926d400d4e3126f18bc1980ca3e0c5cf9dfd613bdf1cb45573651203ed88cb0acc99a4ff2b7ad44e8008a72d34cb952d4
SSDEEP

192:R+9rjJrRrbOth0nuhEuKFuuuUYm6MU8ptZ4rq0DkUyL4f7c3Kn6pAqgeSOo9cE9A:RiRrbD9p1ziz/qgJOo9cypvrHu

Score

6^/10

persistence

Malware Config

Signatures

Adds a user to the system 1 IoCs

pid	Process
1512	useradd

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

persistence

Scheduled Task/Job

T1053

description	ioc	Process
File opened for modification	/etc/crontab	bash
File opened for modification	/var/spool/cron/park	bash

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/etc/profile	bash

Enumerates running processes
Discovers information about currently running processes on the system

Modifies Bash startup script 1 TTPs 1 IoCs

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/profile	bash

Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/89/cmdline	pkill
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/1025/status	pkill
File opened for reading	/proc/31/cmdline	pkill
File opened for reading	/proc/478/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/493/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/676/status	pkill
File opened for reading	/proc/1353/cmdline	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1151/status	pkill
File opened for reading	/proc/558/cmdline	pkill
File opened for reading	/proc/1502/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/533/cmdline	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/1192/cmdline	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/179/cmdline	pkill
File opened for reading	/proc/214/cmdline	pkill
File opened for reading	/proc/993/cmdline	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/1020/cmdline	pkill
File opened for reading	/proc/250/cmdline	pkill
File opened for reading	/proc/1186/status	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/1067/status	pkill
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/541/status	pkill
File opened for reading	/proc/1498/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/677/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/1059/status	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/495/cmdline	pkill
File opened for reading	/proc/423/cmdline	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/988/cmdline	pkill
File opened for reading	/proc/214/status	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/80/cmdline	pkill
File opened for reading	/proc/1187/cmdline	pkill
File opened for reading	/proc/1162/status	pkill
File opened for reading	/proc/1250/cmdline	pkill
File opened for reading	/proc/188/status	pkill
File opened for reading	/proc/178/status	pkill
File opened for reading	/proc/179/status	pkill
File opened for reading	/proc/85/status	pkill
File opened for reading	/proc/171/status	pkill
File opened for reading	/proc/1067/cmdline	pkill
File opened for reading	/proc/1271/cmdline	pkill
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/83/status	pkill

/tmp/parkos_el7_install.sh
/tmp/parkos_el7_install.sh
1⤵
PID:1502

/usr/local/sbin/bash
bash /tmp/parkos_el7_install.sh
1⤵
PID:1502

/usr/local/bin/bash
bash /tmp/parkos_el7_install.sh
1⤵
PID:1502

/usr/sbin/bash
bash /tmp/parkos_el7_install.sh
1⤵
PID:1502

/usr/bin/bash
bash /tmp/parkos_el7_install.sh
1⤵
PID:1502

/sbin/bash
bash /tmp/parkos_el7_install.sh
1⤵
PID:1502

/bin/bash
bash /tmp/parkos_el7_install.sh
1⤵
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies Bash startup script
PID:1502
- /usr/bin/dirname
  dirname /tmp/parkos_el7_install.sh
  2⤵
  PID:1505
- /usr/bin/hostnamectl
  hostnamectl set-hostname park
  2⤵
  PID:1506
- /bin/sed
  sed -i s/park//g /etc/hosts
  2⤵
  PID:1507
- /bin/sed
  sed -i "1s/\$/& park/" /etc/hosts
  2⤵
  PID:1508
- /usr/sbin/useradd
  useradd -d /home/park -p park
  2⤵
  - Adds a user to the system
  PID:1512
- /bin/rm
  rm -rf /dxpark
  2⤵
  PID:1516
- /bin/mkdir
  mkdir -p /dxpark
  2⤵
  PID:1517
- /bin/rm
  rm -rf "jdk*"
  2⤵
  PID:1518
- /usr/bin/wget
  wget -O jdk17_linux_x64_bin.tar.gz http://files.dxpark.cn/jdk17_linux_x64_bin.tar.gz
  2⤵
  PID:1519
- /bin/tar
  tar zxvf jdk17_linux_x64_bin.tar.gz
  2⤵
  PID:1520
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1524
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1524
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1524
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1524
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1524
- - /bin/gzip
    gzip -d
    3⤵
    PID:1524
- /bin/mkdir
  mkdir -p service
  2⤵
  PID:1525
- /bin/mkdir
  mkdir -p parkweb
  2⤵
  PID:1526
- /bin/mkdir
  mkdir -p tools
  2⤵
  PID:1527
- /bin/mkdir
  mkdir -p parkos
  2⤵
  PID:1528
- /bin/mkdir
  mkdir -p db
  2⤵
  PID:1529
- /usr/bin/wget
  wget -O frpc.tar.gz http://files.dxpark.cn/frpc.tar.gz
  2⤵
  PID:1530
- /bin/tar
  tar zxvf frpc.tar.gz
  2⤵
  - Reads runtime system information
  PID:1531
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1532
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1532
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1532
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1532
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1532
- - /bin/gzip
    gzip -d
    3⤵
    PID:1532
- /usr/bin/pkill
  pkill redis
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1533
- /usr/bin/pkill
  pkill redis
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1537
- /bin/rm
  rm -rf "redis*"
  2⤵
  PID:1538
- /usr/bin/wget
  wget -O redis.tar.gz http://files.dxpark.cn/redis.tar.gz
  2⤵
  PID:1539
- /bin/tar
  tar zxvf redis.tar.gz
  2⤵
  PID:1540
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1541
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1541
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1541
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1541
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1541
- - /bin/gzip
    gzip -d
    3⤵
    PID:1541
- /usr/bin/wget
  wget -O redis.conf http://files.dxpark.cn/redis.conf
  2⤵
  PID:1545
- /bin/systemctl
  systemctl stop runsunloginclient.service
  2⤵
  - Reads runtime system information
  PID:1546
- /bin/systemctl
  systemctl stop runsunloginclient.service
  2⤵
  PID:1553
- /usr/bin/sudo
  sudo rpm -e sunloginclient
  2⤵
  PID:1554
- /usr/bin/sudo
  sudo rpm -e sunloginenterprise
  2⤵
  - Reads runtime system information
  PID:1558
- /usr/bin/sudo
  sudo rpm -e sunloginremote
  2⤵
  PID:1559
- /usr/bin/wget
  wget -O hmcityos.png http://files.dxpark.cn/hmcityos.png
  2⤵
  PID:1570
- /usr/bin/wget
  wget -O sunloginenterprise_3.6.0.52553_x86_64.rpm http://files.dxpark.cn/sunloginenterprise_3.6.0.52553_x86_64.rpm
  2⤵
  PID:1574
- /usr/bin/wget
  wget -O ToDesk_Host_centos7_amd64.rpm https://dl.todesk.com/tob/linux/ToDesk_Host_centos7_amd64.rpm
  2⤵
  PID:1582
- /usr/bin/wget
  wget -O parkos_frp.py http://files.dxpark.cn/parkos_frp.py
  2⤵
  PID:1583
- /usr/bin/python
  python parkos_frp.py
  2⤵
  PID:1587
- /usr/bin/wget
  wget -O google-chrome-stable_current_x86_64.rpm http://files.dxpark.cn/google-chrome-stable_current_x86_64.rpm
  2⤵
  PID:1591
- /usr/bin/wget
  wget -O hmcityos.png http://files.dxpark.cn/hmcityos.png
  2⤵
  PID:1593
- /usr/bin/wget
  wget -O libs.tar.gz http://files.dxpark.cn/libs.tar.gz
  2⤵
  PID:1597
- /usr/bin/wget
  wget -O application.yaml http://files.dxpark.cn/application.yaml
  2⤵
  PID:1598
- /usr/bin/wget
  wget -O application-lc.yaml http://files.dxpark.cn/application-lc.yaml
  2⤵
  PID:1605
- /usr/bin/wget
  wget -O application-wh.yaml http://files.dxpark.cn/application-wh.yaml
  2⤵
  PID:1609
- /usr/bin/wget
  wget -O application-wz.yaml http://files.dxpark.cn/application-wz.yaml
  2⤵
  PID:1616
- /usr/bin/wget
  wget -O application.properties http://files.dxpark.cn/application.properties
  2⤵
  PID:1617
- /usr/bin/wget
  wget -O logback-spring.xml http://files.dxpark.cn/logback-spring.xml
  2⤵
  PID:1621
- /usr/bin/wget
  wget -O install.sh http://files.dxpark.cn/install.sh
  2⤵
  PID:1622
- /usr/bin/wget
  wget -O start.sh http://files.dxpark.cn/start.sh
  2⤵
  PID:1629
- /usr/bin/wget
  wget -O stop.sh http://files.dxpark.cn/stop.sh
  2⤵
  PID:1636
- /usr/bin/wget
  wget -O restart.sh http://files.dxpark.cn/restart.sh
  2⤵
  PID:1637
- /usr/bin/wget
  wget -O lib.tar.gz http://files.dxpark.cn/v040/lib.tar.gz
  2⤵
  PID:1641
- /usr/bin/wget
  wget -O parkos-0.4.0.jar http://files.dxpark.cn/v040/parkos-0.4.0.jar
  2⤵
  PID:1642
- /usr/bin/wget
  wget -O park.db http://files.dxpark.cn/park.db
  2⤵
  PID:1652
- /usr/bin/wget
  wget -O parkweb.tar.gz http://files.dxpark.cn/v040/parkweb.tar.gz
  2⤵
  PID:1653
- /usr/bin/wget
  wget -O dxpark_check.py http://files.dxpark.cn/dxpark_check.py
  2⤵
  PID:1657
- /usr/bin/wget
  wget -O dxpark_version.py http://files.dxpark.cn/dxpark_version.py
  2⤵
  PID:1658
- /usr/bin/wget
  wget -O crontab.log http://files.dxpark.cn/crontab.log
  2⤵
  PID:1665
- /bin/tar
  tar zxvf parkweb.tar.gz
  2⤵
  PID:1669
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1670
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1670
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1670
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1670
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1670
- - /bin/gzip
    gzip -d
    3⤵
    PID:1670
- /bin/tar
  tar zxvf lib.tar.gz
  2⤵
  PID:1671
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1672
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1672
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1672
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1672
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1672
- - /bin/gzip
    gzip -d
    3⤵
    PID:1672
- /bin/tar
  tar zxvf libs.tar.gz
  2⤵
  PID:1673
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:1677
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:1677
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:1677
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:1677
- - /sbin/gzip
    gzip -d
    3⤵
    PID:1677
- - /bin/gzip
    gzip -d
    3⤵
    PID:1677
- /usr/bin/wget
  wget -O comm-0.0.1.jar http://files.dxpark.cn/v040/comm-0.0.1.jar
  2⤵
  PID:1678
- /bin/sed
  sed -i /zh_CN.UTF-8/d /etc/profile
  2⤵
  PID:1682
- /bin/sed
  sed -i /JAVA_HOME/d /etc/profile
  2⤵
  PID:1683
- /bin/sed
  sed -i "/export PATH/d" /etc/profile
  2⤵
  PID:1684
- /sbin/sysctl
  /sbin/sysctl -p
  2⤵
  PID:1685
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1687
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8090 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1688
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8100 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1689
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8200 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1690
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8091 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1691
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8101 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1692
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8201 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1693
- /bin/sed
  sed "11 i-A INPUT -p tcp -m state --state NEW -m tcp --dport 8500 -j ACCEPT" -i /etc/sysconfig/iptables
  2⤵
  PID:1694
- /bin/systemctl
  systemctl disable firewalld
  2⤵
  - Reads runtime system information
  PID:1695
- /bin/systemctl
  systemctl enable iptables
  2⤵
  PID:1701
- /bin/systemctl
  systemctl restart iptables
  2⤵
  PID:1703
- /bin/sed
  sed -i /check/d /etc/rc.d/rc.local
  2⤵
  PID:1707
- /bin/sed
  sed -i /crontab/d /etc/rc.d/rc.local
  2⤵
  PID:1708
- /bin/sed
  sed -i /frp/d /etc/rc.d/rc.local
  2⤵
  PID:1709
- /bin/sed
  sed -i /parkos/d /etc/rc.d/rc.local
  2⤵
  PID:1713
- /bin/sed
  sed -i /nginx/d /etc/rc.d/rc.local
  2⤵
  PID:1714
- /bin/sed
  sed -i /python/d /etc/rc.d/rc.local
  2⤵
  PID:1715
- /bin/sed
  sed -i /check/d /etc/crontab
  2⤵
  PID:1716
- /bin/sed
  sed -i /crontab/d /etc/crontab
  2⤵
  PID:1717
- /bin/sed
  sed -i /parkos/d /etc/crontab
  2⤵
  PID:1718
- /bin/sed
  sed -i /frp/d /etc/crontab
  2⤵
  PID:1719
- /bin/sed
  sed -i /python/d /etc/crontab
  2⤵
  PID:1720
- /usr/bin/timedatectl
  timedatectl set-timezone Asia/Shanghai
  2⤵
  PID:1721
- /usr/bin/timedatectl
  timedatectl set-local-rtc 1
  2⤵
  PID:1722
- /sbin/hwclock
  hwclock --systohc --localtime
  2⤵
  PID:1726
- /bin/systemctl
  systemctl enable ntpd
  2⤵
  - Reads runtime system information
  PID:1731
- /bin/systemctl
  systemctl restart crond
  2⤵
  - Reads runtime system information
  PID:1736
- /bin/sh
  sh /dxpark/service/parkos/install.sh
  2⤵
  PID:1737
- /bin/sh
  sh /dxpark/service/parkos/stop.sh
  2⤵
  PID:1741
- /bin/sh
  sh /dxpark/service/parkos/stop.sh
  2⤵
  PID:1742
- /bin/sh
  sh /dxpark/service/parkos/stop.sh
  2⤵
  PID:1743
- /bin/chmod
  chmod a+x /dxpark/dxpark_check.py /dxpark/dxpark_version.py
  2⤵
  PID:1744
- /bin/chmod
  chmod a+x "/dxpark/service/frpc/*.sh"
  2⤵
  PID:1745
- /bin/chmod
  chmod a+x /dxpark/service/parkos/install.sh /dxpark/service/parkos/restart.sh /dxpark/service/parkos/start.sh /dxpark/service/parkos/stop.sh
  2⤵
  PID:1746
- /bin/chown
  chown -R park:park /dxpark/
  2⤵
  PID:1747
- /bin/chmod
  chmod 777 -R /dxpark/service/frpc
  2⤵
  PID:1748
- /bin/chmod
  chmod 777 -R /dxpark/service/parkos
  2⤵
  PID:1749
- /bin/chmod
  chmod 777 -R /dxpark/parkweb
  2⤵
  PID:1750
- /bin/rm
  rm -rf parkweb.tar.gz
  2⤵
  PID:1754
- /bin/rm
  rm -rf frpc.tar.gz
  2⤵
  PID:1755
- /bin/rm
  rm -rf libs.tar.gz lib.tar.gz
  2⤵
  PID:1756
- /usr/bin/locale-check
  /usr/bin/locale-check C.UTF-8
  2⤵
  PID:1758
- /usr/bin/python
  python /dxpark/dxpark_check.py
  2⤵
  PID:1759
- /bin/systemctl
  systemctl stop runsunloginclient.service
  2⤵
  PID:1760
- /bin/systemctl
  systemctl stop runsunloginclient.service
  2⤵
  PID:1764
- /bin/systemctl
  systemctl start runsunloginclient.service
  2⤵
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Scheduled Task/Job

T1053

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/dxpark/install.log

Filesize
90B

MD5
588036f800d8df997d34e36a250b570b

SHA1
114636e6003854507958b98a7fe484ab243884dc

SHA256
af09559b83a291562b50067f0e77cdc4974273e7497aecad99fb3d8b7982d5bc

SHA512
ecd88ab3a86cda846afa271c0652979de57f1281b7e970f60123361b3d2efb17099f15a0efdb8b2f6dd88901e28404cf440cf47b92ec424b247faec551ab5df7

Download Submit
/dxpark/install.log

Filesize
118B

MD5
90c109c8ce648d8ed60fc567cc1a1641

SHA1
d484d836e445066c704db8e487c2490256242df8

SHA256
690b5e8c84b784d8d9de62568af0fccb8e94c0d834eeda53322e23f7c962b694

SHA512
c57b8fae618953d5727afc1d64afbf59b77e5973f38607ade9108f2d1fe54d5e2750193daf0828422a2f751671fc2895ac07197b254a10e4b938b22034fcc2d1

Download Submit
/dxpark/install.log

Filesize
240B

MD5
ed11b69557b53977fbc12d245ec021c0

SHA1
3a9f3e52c3304dc9c4f4896237fc20d51075a399

SHA256
dea36e17b874f604a7f90ba4a96f40977cd835a8596f4a9f58b149bb1d61725d

SHA512
0a3f56bd6c6eba1a3ca74ef8d0a52b28af0d3c31b9fec5aaf198dd64289905d2f28bf4633fc220398d5b4c598df8d81debe186fa34273bfb6a69ebcb819b4bf2

Download Submit
/dxpark/install.log

Filesize
18B

MD5
9ab8bae3c216a4326c52436628a2d0d4

SHA1
e366a116ca9a22adc117a7023d5114c7dad32545

SHA256
3278cef65de06960161e9ab1227d4ebc0a12dfa986a714e077b370e76a719f9b

SHA512
775a78061bd33e3fefbb92e6deec8f4ca9e881fe0f6d19769cf4477c46ea92c5cfd5a80e3c9a3d2b7c0a5dd43ff839a0fd5b161f714e0ebe0a39a5660d5b01f2

Download Submit
/dxpark/install.log

Filesize
41B

MD5
663dafbea1b7947307799202bb69edbf

SHA1
7425515cfad90b7af1de0fcc88cc6ff3bc900b1c

SHA256
2c3b631b4b805c629850c6b47d53b34910ae56847299f63c9c45239cc471da02

SHA512
921cfc17620b41b44c32b50289aa89c0d8ffd1d3be762ba6a3c3dbb1432bfcde81519cda6c7d4b09bed40bed815d7a4c29f68c9218d02228f274e9efd224c94f

Download Submit
/dxpark/install.log

Filesize
56B

MD5
040043cd1fd33d3c1b02038e43a3b6cd

SHA1
64e285d2e30349714eb2db845eae2ef639404f96

SHA256
484c9c72d5ea927f9cd4fe7c9df3002b2624476e86e05eb4a6eee4a19f19c431

SHA512
0a7063352f09eafc2d0e915aeb9c021ec5cc12827bc8b5899a7265c2d8ed355963865418f943baecd15e3c9f0775ad6495eda5baa387c9a5c402936460f1c362

Download Submit
/etc/crontab

Filesize
656B

MD5
66bc5197e09a98af133703ba7f058ce8

SHA1
1310d993d113589265e0815cf2ad3d512fdb0801

SHA256
e20802d846681d43272d2bfe7e6b8cbb01e7afb8bd146927ff510f6798c0afbc

SHA512
770b5521cbf0017061ac2cae5d884cf32a7f3a7f98ec0a02d32a992f527df09926c0298fd2c7074fc81a0a9493c94c0810d5e16f0f9a009092a8556dbe2392ac

Download Submit
/etc/crontab

Filesize
727B

MD5
8b41c3530d385ddee59f99ae5d3a8acc

SHA1
c65f4f852197c056bda18bb97d4a4d08461c36d2

SHA256
74498170436576939ba7f4ed6ad85b5b007aace44e93dde1e1a4e71dd2151451

SHA512
f116bbbb6f8ed5aedee6b08f758d5c94da1db7cc5973d09c32b72c50f2313012a1a18fc7dc87ce724d11b4a94641a3f1da273c6c95f50b99409bf13aaa292e51

Download Submit
/etc/profile

Filesize
609B

MD5
14acae220f106a9d7934db9447db1c72

SHA1
7536657e86f8f412d381c65a8ea7c546fcae81e6

SHA256
0227c2c9b395779ff77edd5ca77cbd506decd8c3a3a5f8e1673d574a9b7288c0

SHA512
bcfee3a0f2172f7c4b2d29fd9f321505609cb91f70c832ba47e87053611c088fd6ecf7ea3153b5d0ad1fa65dfe4225915ac768583ff9b24bca8df83493b37ae5

Download Submit
/etc/profile

Filesize
635B

MD5
a4b1e1c7c760be22000a310cc2a31b78

SHA1
cd50400ce3e20639b3b3e0f9b5a7d0d3b1e5f367

SHA256
2a917250d74d881fe8edd25b71fdab13874a6587f83907676828f6c1fa174157

SHA512
1e03b7984be38b23154bb66d0054cad99c7a33be5758bcae56cd55c785155a227e1c3b533075d1f9f6ee593cb595ccfd7876e13b15706d03e7460db7d9ce8e6c

Download Submit
/etc/profile

Filesize
674B

MD5
83ab8e440ebac901ef092358caf1eec5

SHA1
9e25228a22bcf440d529e80b143dcfa3ee2a9b09

SHA256
e8cf5e3696cb004724f2b54d59fb9587482f6c32b81d5d499e6cb926a01f097b

SHA512
9de08d4eb8615c8121c4a82838f607f678057b23994277ff7319295e8e1b46cb6baac0174e166d56fc12d29294e226d92b9b9c23af292d2beb7d734a957b6521

Download Submit
/etc/profile

Filesize
754B

MD5
516438c595b2b1dd5bc2c25391edf7d7

SHA1
e644584dd0bee3be4f542e149f2959671287fa04

SHA256
6008775b7f1065a027f04c06014b09fb1d297d8b55d5423449c7c675d8f72316

SHA512
dd9dab93775a62e19b21f1e73a6b0250214429d16b904f1962a6e488e2c08eb980756a235cad081f8e66a995913bbbef0debdad3a49dd09e4a249a561bd5b10e

Download Submit
/etc/profile

Filesize
806B

MD5
8d0622f7511ebe41a4d0869e849e3c7b

SHA1
636e372ca6fcb34295aa9d61d9af67cf39d8af40

SHA256
a65d40ab539e5dec7777b8348211b7839513b77539fd562323207473b54f8c9e

SHA512
f0df8244a291602aafa1fbcb02ae679cd71cbdd34214cbe82d0764f98250ea7782aa486d7aeb09f2a889e79319b350ca6450a6a4d97c212bf17a6cd64ff761b7

Download Submit
/etc/sedFJPywS

Filesize
224B

MD5
c01b5fc0f2394121d78eb4bd936008d6

SHA1
f24dec52d1e8a1df74c06b299bd9ea7a0cea9974

SHA256
0cdc376288b542e10723c3cc2a31cf51c58a9dbe07a8b41ddab92bac9a412bb7

SHA512
016718675fcb1f3b4f4ecc47afc9a7637c1568e1a6551639ed8037ec389f432fed5feec98b2f91cd388af70c0084daae7ed5a596f6563bca75ece070f392e1ed

Download Submit
/etc/sedOQsRk5

Filesize
585B

MD5
0b94eef1e9dd492513e62227a6807c8a

SHA1
5b2210b2771170e6deb417d5ac9517135c01807a

SHA256
162a4b76a506e481267388731bc10537663ed3c5032183b34a9a14a61c92e0e6

SHA512
1b596c333b0f6bd109094c512647f20b8dc4de73290128e9696e876c654038b99a7c9279b2a1cc8a1e90a1d6987f69cfee211e0b2b52331870c6ddf87aa694e8

Download Submit
/etc/sedVrOjR5

Filesize
722B

MD5
8f111d100ea459f68d333d63a8ef2205

SHA1
077ca9c46a964de67c0f7765745d5c6f9e2065c3

SHA256
0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354

SHA512
d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb

Download Submit
/etc/sedZhL5j4

Filesize
581B

MD5
9d5ee34149287021622dd9e21c17ec26

SHA1
9d19b6fa77f8f98809ce5fab5b57b62e4d52a8e7

SHA256
3358f609b4bc5c0b50f1dd3cffb3861404027bee127580370cbad3db7cc5b209

SHA512
0640b2053c1d50bcd1f17a572dd7a637d57afe624a6a1a270c43004733358172a39b67f3afd97813f4739238fb9392976d963540aa317f0c5aa0c20c43c9c1e2

Download Submit
/etc/sedaX8KkS

Filesize
219B

MD5
f483993c70d12ecfd5a5fe3ed5b10244

SHA1
386b3c58555b1337c5a2496efdb7436295256796

SHA256
908b62e9f94cc492b2ad465bfae5ba6bb5cfffd9ad7af21cdb79821ee118f409

SHA512
c60a7528f3d5b5b97d79c7973153cb7a915de04fd717e9ca7c8bdf4093a747146d405c15d47f822dc1b72bcd87b19ab276e9069c3f41bc5bb4dbfd88fd469aaa

Download Submit
/var/spool/cron/park

Filesize
47B

MD5
6a976e7f2148d76c675086a45521b44e

SHA1
6a7b0693d058867bb1f27a228097a2cd2ad995a0

SHA256
32dc79f22e6fa691aa085ff39ed515f736a4f6666de0bb9274ffe471f9a95d02

SHA512
6b66bbee333ba7671b6a19b5d6fea54969d8a23503852d80a1ef0490311080b2c8afd2a91caf3908a8e10228b6d27d5bce53de710ee3d8e47709310301cf4cb2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads