mrblack | 3e41e4b985ab8bd091888cd43446a4cf36fd87cc5dbf2c437e2b79cfc297b170

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
28-07-2024 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
Size

1.2MB
MD5

0d7916ed53af023a360cd8b6788b9517
SHA1

e2673bbd4e9ec794db03c414b113db58c53009fe
SHA256

3e41e4b985ab8bd091888cd43446a4cf36fd87cc5dbf2c437e2b79cfc297b170
SHA512

85dc18b4e86d6131fb896bbac601a20c99cf9c20d706f26586bbb4ddf928a277622632281266e83686d796ac9d375081ce5686246bfae0d15207d022de717194
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWIX4f2y1q2rJp0:745vRVJKGtSA0VWIoeu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1380	getty
/usr/bin/.sshd	1404	.sshd

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/DbSecuritySpt	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for modification	/etc/init.d/selinux	getty

Write file to user bin folder 1 TTPs 11 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/getty.lock	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/udevd.lock	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	getty
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/ss	cp

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	getty
File opened for reading	/proc/cpuinfo	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/dev	getty
File opened for reading	/proc/net/dev	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118

Reads runtime system information 37 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	.sshd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	getty
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/moni.lod	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for modification	/tmp/bill.lock	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for modification	/tmp/gates.lod	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for modification	/tmp/notify.file	0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
File opened for modification	/tmp/moni.lod	.sshd
File opened for modification	/tmp/notify.file	.sshd
File opened for modification	/tmp/gates.lod	.sshd

/tmp/0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
/tmp/0d7916ed53af023a360cd8b6788b9517_JaffaCakes118
1⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1356
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
  2⤵
  PID:1362
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
    3⤵
    PID:1363
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
  2⤵
  PID:1364
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
    3⤵
    PID:1365
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
  2⤵
  PID:1366
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
    3⤵
    PID:1367
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
  2⤵
  PID:1368
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
    3⤵
    PID:1369
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
  2⤵
  PID:1370
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
    3⤵
    PID:1371
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1372
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1373
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1374
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1375
- /bin/sh
  sh -c "cp -f /tmp/0d7916ed53af023a360cd8b6788b9517_JaffaCakes118 /usr/bin/bsd-port/getty"
  2⤵
  PID:1376
- - /usr/bin/cp
    cp -f /tmp/0d7916ed53af023a360cd8b6788b9517_JaffaCakes118 /usr/bin/bsd-port/getty
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1377
- /bin/sh
  sh -c /usr/bin/bsd-port/getty
  2⤵
  PID:1379
- - /usr/bin/bsd-port/getty
    /usr/bin/bsd-port/getty
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1380
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1388
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1389
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1390
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1391
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1392
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1393
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1394
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1395
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1396
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1397
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1398
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1399
  - - /bin/sh
      sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1400
    - - /usr/bin/cp
        
        cp -f /bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1401
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1405
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1406
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1407
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1408
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"
      4⤵
      PID:1409
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/lsof
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1410
  - - /bin/sh
      sh -c "chmod 0755 /bin/lsof"
      4⤵
      PID:1411
    - - /usr/bin/chmod
        
        chmod 0755 /bin/lsof
        5⤵
        
        PID:1412
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1413
    - - /usr/bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1414
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1415
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1416
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1417
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1418
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
      4⤵
      PID:1419
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1420
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1421
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1422
  - - /bin/sh
      sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
      4⤵
      PID:1423
    - - /usr/bin/cp
        
        cp -f /bin/ss /usr/bin/dpkgd/ss
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1424
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1425
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1426
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1427
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1428
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
      4⤵
      PID:1429
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/ss
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1430
  - - /bin/sh
      sh -c "chmod 0755 /bin/ss"
      4⤵
      PID:1431
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ss
        5⤵
        
        PID:1432
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1433
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1434
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1435
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1436
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
      4⤵
      PID:1437
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1438
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1439
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1440
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1441
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1442
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1443
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1444
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"
      4⤵
      PID:1445
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1446
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ps"
      4⤵
      PID:1447
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ps
        5⤵
        
        PID:1448
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1449
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1450
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1451
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1452
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ss"
      4⤵
      PID:1453
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/ss
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1454
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ss"
      4⤵
      PID:1455
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ss
        5⤵
        
        PID:1456
  - - /bin/sh
      sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
      4⤵
      PID:1459
    - - /usr/sbin/insmod
        
        insmod /usr/bin/bsd-port/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1460
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1382
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1383
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1384
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1385
- /bin/sh
  sh -c "cp -f /tmp/0d7916ed53af023a360cd8b6788b9517_JaffaCakes118 /usr/bin/.sshd"
  2⤵
  PID:1386
- - /usr/bin/cp
    cp -f /tmp/0d7916ed53af023a360cd8b6788b9517_JaffaCakes118 /usr/bin/.sshd
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1387
- /bin/sh
  sh -c /usr/bin/.sshd
  2⤵
  PID:1403
- - /usr/bin/.sshd
    /usr/bin/.sshd
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1404
- /bin/sh
  sh -c "insmod /tmp/xpacket.ko"
  2⤵
  PID:1466
- - /usr/sbin/insmod
    insmod /tmp/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1467

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
6d352fd79f2ca880867e36fff45ec74e

SHA1
8a2b3388e13a8aac1f03197849a19f5f13239a54

SHA256
e0e4199256d643b364418ba8b6d36df66d53b74f0ec05775f253225e82a42267

SHA512
57a05443caa2a339b254216bb5eb89f74fa1d4921d3217eb0365724a6e7ecc3aecf1fef22468c98748d83462a88ea0596b5d8731399fce8e8c367b4761b314d9

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
c26820b8a4c1b3c2aa868d6d57e14a79

SHA1
69dd0d17085451edc7a356c689407429fc6cea46

SHA256
f3e055913a0b1eb0f07317896f9a1bc466b9a50db85a7f882f3ffde9ffb23aca

SHA512
81a48e69437024a9df44b11e68d5a86e65ae9150d34e9c2955bc47ff007309511cac643c367eb68b7328481d67a5227699dc1adc66af5597c3fddceeec51c06c

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
01d8bae291b1e4724443375634ccfa0e

SHA1
3e997b2dba11df9b67d2f6d85b1f3c3ba2753f45

SHA256
63fd44eec460feb25809df9182b23432d590259750995df7fbf4e9c7913963cc

SHA512
d68174a47f6faddfeb90219dddb8b0c648d752f73b8ffd0e03f49fc9f1d6841ab688437d4b54e3e1900f373579338d0d4e67af57804488488596dab83fcd23c4

Download Submit
/tmp/notify.file

Filesize
51B

MD5
fac49dab9548774b557dc398e05827ca

SHA1
310925158003b19bc546b430f502f50d58e19ef1

SHA256
63b5e53d90cbbcf17ebb499a772829552cecae621a0d7ce3e8d9b9330e231c18

SHA512
8d8b7292db48e90010ceeebfb1c45369180be586dc2c075275665cd4e3fee2fba2dc7bf63e0fe5ebb534a9b309b4f0215d53d0598cd8445a266fdac8daf75f97

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
0d7916ed53af023a360cd8b6788b9517

SHA1
e2673bbd4e9ec794db03c414b113db58c53009fe

SHA256
3e41e4b985ab8bd091888cd43446a4cf36fd87cc5dbf2c437e2b79cfc297b170

SHA512
85dc18b4e86d6131fb896bbac601a20c99cf9c20d706f26586bbb4ddf928a277622632281266e83686d796ac9d375081ce5686246bfae0d15207d022de717194

Download Submit
/usr/bin/dpkgd/lsof

Filesize
171KB

MD5
061386937ec7acf924438a2643a32be0

SHA1
01a044b9e58839bea3e58c66cb32acc16241bf91

SHA256
8a26bbae9eb85aa98ef29cfe5b0a291234db6eb394c3e0c2841983dcf7dda959

SHA512
2de2e56ac4c32f47b4a1945ccfb0db378e6d59019ee8004e3e5d2ec8935efb5aa8ee14b8a0b21c61a267e195d42a3232a6dcade8720de06118fd579277f59db7

Download Submit
/usr/bin/dpkgd/ps

Filesize
134KB

MD5
d194576b899af45b1d2a448612ec21e5

SHA1
492f7d8f28cd4397ce22fcf0d8bf3304ea93465a

SHA256
a8cf81f3a1137c999c3cf336507ce120b3065e633ade01db6280d427b7d986ca

SHA512
b323babd9580b91772cde29c9f22ae75b27f5ce8ce0268a48ca41713c3545dd72409932a5c48f6af66ac6e43127eb5461d1f686bd667fa1b0e56a1564db3c539

Download Submit
/usr/bin/dpkgd/ss

Filesize
164KB

MD5
51d83131b398a97dd38555ba57084721

SHA1
7d392a87f7db787dfa85fbcdf2a5ba6f0b59b4ed

SHA256
e429f9d16a4cd64593b94dee8309a427fe8ca57765bf0d2e7b822efd123fe768

SHA512
adc7137df75410c2535986c1e86c2e92e58f9bee70094f72f1f7adf3db125720ce281eb3f48474b0e192d672e96cbb1bc6e1ef6b26b10bf76a412c4516948216

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads