mrblack | 85b18a45a5f12da6da29c734f8120baf0278ea742545861bda7cc8cff161ef85

Analysis

max time kernel
150s
max time network
151s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
29-08-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
Size

1.2MB
MD5

c8a06a490fc859f2f3d5876ffb93a01a
SHA1

e209828fe9ae7f0ac8011db43f1b62e079f10c6b
SHA256

85b18a45a5f12da6da29c734f8120baf0278ea742545861bda7cc8cff161ef85
SHA512

a47b74dee1e047fa9f74b90e806a2d412f43aa8542e6c52da84211fca7f87424f0ef4700cebf45205bbbc0ac3df4edf40b0fa50c9819c79c8561683e99f6143f
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWIX4E2y1q2rJp0:745vRVJKGtSA0VWIoLu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/getty	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

getty.sshd

ioc pid process

/usr/bin/bsd-port/getty 1461 getty
/usr/bin/.sshd 1485 .sshd

ioc	pid	process
/usr/bin/bsd-port/getty	1461	getty
/usr/bin/.sshd	1485	.sshd

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118getty

description	ioc	process
File opened for modification	/etc/init.d/DbSecuritySpt	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for modification	/etc/init.d/selinux	getty

Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

description ioc process

File opened for reading /proc/net/route c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

Write file to user bin folder 1 TTPs 11 IoCs

Hijack Execution Flow

T1574

Processes:

cpc8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118cpcpcpcpcpgettycpcp

description	ioc	process
File opened for modification	/usr/bin/ss	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/bsd-port/udevd.lock	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/getty.lock	getty
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/dpkgd/ps	cp

Writes file to system bin folder 1 TTPs 3 IoCs

Hijack Execution Flow
T1574

Processes:

cpcpcp

description ioc process

File opened for modification /bin/ss cp
File opened for modification /bin/lsof cp
File opened for modification /bin/ps cp
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

gettyc8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

description ioc process

File opened for reading /proc/cpuinfo getty
File opened for reading /proc/cpuinfo c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

description	ioc	process
File opened for modification	/bin/ss	cp
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp

description	ioc	process
File opened for reading	/proc/cpuinfo	getty
File opened for reading	/proc/cpuinfo	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

Processes:

gettyc8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/dev	getty
File opened for reading	/proc/net/dev	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for reading	/proc/net/route	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for reading	/proc/net/arp	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

Reads runtime system information 37 IoCs

Reads data from /proc virtual filesystem.

Processes:

mkdirmkdirmkdirmkdircpcpcpmkdirinsmodcpcpmkdircpcpcpmkdirmkdirc8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118mkdirmkdirmkdirmkdircpgettymkdirmkdircpcp.sshdmkdirmkdirmkdirinsmod

description	ioc	process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	getty
File opened for reading	/proc/sys/kernel/version	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	.sshd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	getty
File opened for reading	/proc/stat	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for reading	/proc/cmdline	insmod

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

Processes:

.sshdc8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

description	ioc	process
File opened for modification	/tmp/moni.lod	.sshd
File opened for modification	/tmp/notify.file	.sshd
File opened for modification	/tmp/conf.n	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for modification	/tmp/gates.lod	.sshd
File opened for modification	/tmp/moni.lod	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for modification	/tmp/bill.lock	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for modification	/tmp/gates.lod	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
File opened for modification	/tmp/notify.file	c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118

/tmp/c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
/tmp/c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118
1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1402
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
  2⤵
  PID:1443
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
    3⤵
    PID:1444
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
  2⤵
  PID:1445
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
    3⤵
    PID:1446
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
  2⤵
  PID:1447
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
    3⤵
    PID:1448
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
  2⤵
  PID:1449
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
    3⤵
    PID:1450
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
  2⤵
  PID:1451
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
    3⤵
    PID:1452
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1453
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1454
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1455
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1456
- /bin/sh
  sh -c "cp -f /tmp/c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118 /usr/bin/bsd-port/getty"
  2⤵
  PID:1457
- - /usr/bin/cp
    cp -f /tmp/c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118 /usr/bin/bsd-port/getty
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1458
- /bin/sh
  sh -c /usr/bin/bsd-port/getty
  2⤵
  PID:1460
- - /usr/bin/bsd-port/getty
    /usr/bin/bsd-port/getty
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1461
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1469
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1470
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1471
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1472
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1473
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1474
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1475
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1476
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1477
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1478
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1479
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1480
  - - /bin/sh
      sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1481
    - - /usr/bin/cp
        
        cp -f /bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1482
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1486
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1487
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1488
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1489
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"
      4⤵
      PID:1490
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/lsof
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1491
  - - /bin/sh
      sh -c "chmod 0755 /bin/lsof"
      4⤵
      PID:1492
    - - /usr/bin/chmod
        
        chmod 0755 /bin/lsof
        5⤵
        
        PID:1493
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1494
    - - /usr/bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1495
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1496
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1497
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1498
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1499
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
      4⤵
      PID:1500
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1501
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1502
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1503
  - - /bin/sh
      sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
      4⤵
      PID:1504
    - - /usr/bin/cp
        
        cp -f /bin/ss /usr/bin/dpkgd/ss
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1505
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1506
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1507
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1508
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1509
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
      4⤵
      PID:1510
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/ss
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1511
  - - /bin/sh
      sh -c "chmod 0755 /bin/ss"
      4⤵
      PID:1512
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ss
        5⤵
        
        PID:1513
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1514
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1515
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1516
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1517
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
      4⤵
      PID:1518
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1519
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1520
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1521
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1522
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1523
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1524
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1525
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"
      4⤵
      PID:1526
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1527
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ps"
      4⤵
      PID:1528
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ps
        5⤵
        
        PID:1529
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1530
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1531
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1532
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1533
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ss"
      4⤵
      PID:1534
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/ss
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1535
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ss"
      4⤵
      PID:1536
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ss
        5⤵
        
        PID:1537
  - - /bin/sh
      sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
      4⤵
      PID:1540
    - - /usr/sbin/insmod
        
        insmod /usr/bin/bsd-port/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1543
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1463
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1464
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1465
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1466
- /bin/sh
  sh -c "cp -f /tmp/c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118 /usr/bin/.sshd"
  2⤵
  PID:1467
- - /usr/bin/cp
    cp -f /tmp/c8a06a490fc859f2f3d5876ffb93a01a_JaffaCakes118 /usr/bin/.sshd
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1468
- /bin/sh
  sh -c /usr/bin/.sshd
  2⤵
  PID:1484
- - /usr/bin/.sshd
    /usr/bin/.sshd
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1485
- /bin/sh
  sh -c "insmod /tmp/xpacket.ko"
  2⤵
  PID:1544
- - /usr/sbin/insmod
    insmod /tmp/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1545

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
9d8902f76df12f5799b9875b15fa9bf5

SHA1
21473f75957fb62a1b824ad109bc4a2d8a08d0b1

SHA256
88eb7f415be3caeb31a0a2721566c6540ea378525938e231e10bbb0f36c3e765

SHA512
e8d55f5b20a588f2fed66e0f6c766b3e0b95a5c4ed1fb2f12bbb21936209647ac20efba988cc0bf5477f17a6eadb7509b21151a4b1b0ee7db940fa605f2980ca

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
4edaa105d5f53590338791951e38c3ad

SHA1
84cbb8cb3aaa7a5a5f98ab30b5b0c948cca74f93

SHA256
e8026bda3ea2eedc7dc7bce9daa640f8cc0f33e335bd73d986a872b3ba789c71

SHA512
4ba97143cecd7c930f04399ee510c97ecb6db989aea923bac4d98deffe8310ed21f8928adc3438fe31206e6a0880ee3fccc9121d1fe8bb500c6bd874b37a7c41

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
b60c5ab647a27045b462934977ccad9a

SHA1
aff60c26ab00f0ad980af68c68a926fa11795ef9

SHA256
0f8e631d28e2a339b435ea55da61c718da28902056ed719e576ff1c1b4cb2baf

SHA512
d8e0a85d197bbd49b2c4586c3e6e29dcdfa203b80c4d3480a4f48f0aeefd87ce3261e56bae531551d6eb007afd221a16df4447d1d4882c846a144754d16b8431

Download Submit
/tmp/notify.file

Filesize
51B

MD5
ba53297425c722d6b3514db55a85e250

SHA1
cefa3ac30e55cc860cec71ab26f37233ac9c7ddc

SHA256
4497d3919069b3e92a0af3c00d315b3a9c56ff68a3235b0464f1dddb0717a201

SHA512
99eb28e0e67e63874f4c1295343eef1e84c41b993673a7686e98043be1bb1d4acc2c6902d169a76d17c22bdef6b1b75086433130d27e3562d6fb7713b09e58d0

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
c8a06a490fc859f2f3d5876ffb93a01a

SHA1
e209828fe9ae7f0ac8011db43f1b62e079f10c6b

SHA256
85b18a45a5f12da6da29c734f8120baf0278ea742545861bda7cc8cff161ef85

SHA512
a47b74dee1e047fa9f74b90e806a2d412f43aa8542e6c52da84211fca7f87424f0ef4700cebf45205bbbc0ac3df4edf40b0fa50c9819c79c8561683e99f6143f

Download Submit
/usr/bin/dpkgd/lsof

Filesize
171KB

MD5
061386937ec7acf924438a2643a32be0

SHA1
01a044b9e58839bea3e58c66cb32acc16241bf91

SHA256
8a26bbae9eb85aa98ef29cfe5b0a291234db6eb394c3e0c2841983dcf7dda959

SHA512
2de2e56ac4c32f47b4a1945ccfb0db378e6d59019ee8004e3e5d2ec8935efb5aa8ee14b8a0b21c61a267e195d42a3232a6dcade8720de06118fd579277f59db7

Download Submit
/usr/bin/dpkgd/ps

Filesize
134KB

MD5
d194576b899af45b1d2a448612ec21e5

SHA1
492f7d8f28cd4397ce22fcf0d8bf3304ea93465a

SHA256
a8cf81f3a1137c999c3cf336507ce120b3065e633ade01db6280d427b7d986ca

SHA512
b323babd9580b91772cde29c9f22ae75b27f5ce8ce0268a48ca41713c3545dd72409932a5c48f6af66ac6e43127eb5461d1f686bd667fa1b0e56a1564db3c539

Download Submit
/usr/bin/dpkgd/ss

Filesize
164KB

MD5
51d83131b398a97dd38555ba57084721

SHA1
7d392a87f7db787dfa85fbcdf2a5ba6f0b59b4ed

SHA256
e429f9d16a4cd64593b94dee8309a427fe8ca57765bf0d2e7b822efd123fe768

SHA512
adc7137df75410c2535986c1e86c2e92e58f9bee70094f72f1f7adf3db125720ce281eb3f48474b0e192d672e96cbb1bc6e1ef6b26b10bf76a412c4516948216

Download Submit