xorddos | f5b098419bdcd2aee198c074b895e113fb7cac9132ad1b592005d31f1394ad3f

Resubmissions

09-09-2024 19:21

240909-x2vfvsxdmc 10

22-12-2023 13:24

231222-qnwcnsgfhj 10

Analysis

max time kernel
119s
max time network
124s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
09-09-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1da9b563db9056c96523a8727a279e3
Size

603KB
MD5

a1da9b563db9056c96523a8727a279e3
SHA1

264124d50c9c25cea15459acb662b750bd7987c5
SHA256

f5b098419bdcd2aee198c074b895e113fb7cac9132ad1b592005d31f1394ad3f
SHA512

1418a5fc3fd23a0b10533a60ab76cfd71cd0894c0bf8fdc859fdc27a3673a4f5fc63320ab4e0aab81eefeaba933266933a74e60021a3985bb5dbe8ca90a93aaf
SSDEEP

12288:R40XBrnlTCbI5ZBP5IePtqLn4yFeC+oT6ygF9b4elMuThmVF:e01tCbqNNPtqLn4yFmoEbdlH9mn

Score

10^/10

xorddos botnet discovery downloader execution persistence privilege_escalatio

Malware Config

Extracted

Family

xorddos

http://info1.3000uc.com/b/u.php

gh.dsaj2a1.org:2857

navert0p.com:2857

wangzongfacai.com:2857

Attributes

crc_polynomial
EDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 49 IoCs

resource	yara_rule
behavioral1/files/fstream-6.dat	family_xorddos
behavioral1/files/fstream-9.dat	family_xorddos
behavioral1/files/fstream-10.dat	family_xorddos
behavioral1/files/fstream-12.dat	family_xorddos
behavioral1/files/fstream-13.dat	family_xorddos
behavioral1/files/fstream-15.dat	family_xorddos
behavioral1/files/fstream-16.dat	family_xorddos
behavioral1/files/fstream-18.dat	family_xorddos
behavioral1/files/fstream-19.dat	family_xorddos
behavioral1/files/fstream-21.dat	family_xorddos
behavioral1/files/fstream-22.dat	family_xorddos
behavioral1/files/fstream-24.dat	family_xorddos
behavioral1/files/fstream-25.dat	family_xorddos
behavioral1/files/fstream-27.dat	family_xorddos
behavioral1/files/fstream-28.dat	family_xorddos
behavioral1/files/fstream-30.dat	family_xorddos
behavioral1/files/fstream-31.dat	family_xorddos
behavioral1/files/fstream-33.dat	family_xorddos
behavioral1/files/fstream-34.dat	family_xorddos
behavioral1/files/fstream-36.dat	family_xorddos
behavioral1/files/fstream-37.dat	family_xorddos
behavioral1/files/fstream-39.dat	family_xorddos
behavioral1/files/fstream-40.dat	family_xorddos
behavioral1/files/fstream-42.dat	family_xorddos
behavioral1/files/fstream-43.dat	family_xorddos
behavioral1/files/fstream-45.dat	family_xorddos
behavioral1/files/fstream-46.dat	family_xorddos
behavioral1/files/fstream-48.dat	family_xorddos
behavioral1/files/fstream-49.dat	family_xorddos
behavioral1/files/fstream-51.dat	family_xorddos
behavioral1/files/fstream-52.dat	family_xorddos
behavioral1/files/fstream-54.dat	family_xorddos
behavioral1/files/fstream-55.dat	family_xorddos
behavioral1/files/fstream-57.dat	family_xorddos
behavioral1/files/fstream-58.dat	family_xorddos
behavioral1/files/fstream-60.dat	family_xorddos
behavioral1/files/fstream-61.dat	family_xorddos
behavioral1/files/fstream-63.dat	family_xorddos
behavioral1/files/fstream-64.dat	family_xorddos
behavioral1/files/fstream-66.dat	family_xorddos
behavioral1/files/fstream-67.dat	family_xorddos
behavioral1/files/fstream-69.dat	family_xorddos
behavioral1/files/fstream-70.dat	family_xorddos
behavioral1/files/fstream-72.dat	family_xorddos
behavioral1/files/fstream-73.dat	family_xorddos
behavioral1/files/fstream-75.dat	family_xorddos
behavioral1/files/fstream-76.dat	family_xorddos
behavioral1/files/fstream-78.dat	family_xorddos
behavioral1/files/fstream-79.dat	family_xorddos

Executes dropped EXE 64 IoCs

ioc	pid	Process
/usr/bin/rpvcmskktg	1532	rpvcmskktg
/usr/bin/rpvcmskktg	1536	rpvcmskktg
/usr/bin/rpvcmskktg	1538	rpvcmskktg
/usr/bin/rpvcmskktg	1542	rpvcmskktg
/usr/bin/rpvcmskktg	1545	rpvcmskktg
/usr/bin/szcbxrlcrw	1550	szcbxrlcrw
/usr/bin/szcbxrlcrw	1553	szcbxrlcrw
/usr/bin/szcbxrlcrw	1555	szcbxrlcrw
/usr/bin/szcbxrlcrw	1558	szcbxrlcrw
/usr/bin/szcbxrlcrw	1561	szcbxrlcrw
/usr/bin/mieaccpjpk	1565	mieaccpjpk
/usr/bin/mieaccpjpk	1568	mieaccpjpk
/usr/bin/mieaccpjpk	1570	mieaccpjpk
/usr/bin/mieaccpjpk	1573	mieaccpjpk
/usr/bin/mieaccpjpk	1576	mieaccpjpk
/usr/bin/kieucntodw	1580	kieucntodw
/usr/bin/kieucntodw	1583	kieucntodw
/usr/bin/kieucntodw	1586	kieucntodw
/usr/bin/kieucntodw	1589	kieucntodw
/usr/bin/kieucntodw	1592	kieucntodw
/usr/bin/vorsrrxhnk	1595	vorsrrxhnk
/usr/bin/vorsrrxhnk	1598	vorsrrxhnk
/usr/bin/vorsrrxhnk	1600	vorsrrxhnk
/usr/bin/vorsrrxhnk	1603	vorsrrxhnk
/usr/bin/vorsrrxhnk	1606	vorsrrxhnk
/usr/bin/mycydmftyz	1610	mycydmftyz
/usr/bin/mycydmftyz	1613	mycydmftyz
/usr/bin/mycydmftyz	1615	mycydmftyz
/usr/bin/mycydmftyz	1618	mycydmftyz
/usr/bin/mycydmftyz	1621	mycydmftyz
/usr/bin/fujtkiszun	1627	fujtkiszun
/usr/bin/fujtkiszun	1630	fujtkiszun
/usr/bin/fujtkiszun	1632	fujtkiszun
/usr/bin/fujtkiszun	1635	fujtkiszun
/usr/bin/fujtkiszun	1638	fujtkiszun
/usr/bin/tauwlbxhuu	1642	tauwlbxhuu
/usr/bin/tauwlbxhuu	1645	tauwlbxhuu
/usr/bin/tauwlbxhuu	1647	tauwlbxhuu
/usr/bin/tauwlbxhuu	1650	tauwlbxhuu
/usr/bin/tauwlbxhuu	1653	tauwlbxhuu
/usr/bin/ckocjsfjzf	1657	ckocjsfjzf
/usr/bin/ckocjsfjzf	1660	ckocjsfjzf
/usr/bin/ckocjsfjzf	1662	ckocjsfjzf
/usr/bin/ckocjsfjzf	1665	ckocjsfjzf
/usr/bin/ckocjsfjzf	1668	ckocjsfjzf
/usr/bin/okuqbginks	1672	okuqbginks
/usr/bin/okuqbginks	1675	okuqbginks
/usr/bin/okuqbginks	1677	okuqbginks
/usr/bin/okuqbginks	1680	okuqbginks
/usr/bin/okuqbginks	1683	okuqbginks
/usr/bin/itwxwgwhbg	1687	itwxwgwhbg
/usr/bin/itwxwgwhbg	1690	itwxwgwhbg
/usr/bin/itwxwgwhbg	1692	itwxwgwhbg
/usr/bin/itwxwgwhbg	1695	itwxwgwhbg
/usr/bin/itwxwgwhbg	1698	itwxwgwhbg
/usr/bin/lmpwbhwwaq	1702	lmpwbhwwaq
/usr/bin/lmpwbhwwaq	1705	lmpwbhwwaq
/usr/bin/lmpwbhwwaq	1707	lmpwbhwwaq
/usr/bin/lmpwbhwwaq	1710	lmpwbhwwaq
/usr/bin/lmpwbhwwaq	1713	lmpwbhwwaq
/usr/bin/vfdtjrwsia	1717	vfdtjrwsia
/usr/bin/vfdtjrwsia	1720	vfdtjrwsia
/usr/bin/vfdtjrwsia	1722	vfdtjrwsia
/usr/bin/vfdtjrwsia	1725	vfdtjrwsia

Unexpected DNS network traffic destination 15 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228
Destination IP	103.25.9.228

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalatio

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.hourly/udev.sh	a1da9b563db9056c96523a8727a279e3
File opened for modification	/etc/crontab	sh

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/a1da9b563db9056c96523a8727a279e3	a1da9b563db9056c96523a8727a279e3

Write file to user bin folder 24 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/rpvcmskktg	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/ckocjsfjzf	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/itwxwgwhbg	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/myccrnhgvn	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/szfcbssocn	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/rybncvuqbl	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/tauwlbxhuu	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/lmpwbhwwaq	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/pgiwrbzyof	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/nwyoswecfo	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/yvjkkfwyop	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/vorsrrxhnk	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/vfdtjrwsia	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/jmtmhisxek	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/ozsuwiwmco	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/xowzoguejd	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/maiupepzmr	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/szcbxrlcrw	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/mieaccpjpk	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/kieucntodw	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/mycydmftyz	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/fujtkiszun	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/okuqbginks	a1da9b563db9056c96523a8727a279e3
File opened for modification	/usr/bin/ggpujbahem	a1da9b563db9056c96523a8727a279e3

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/stat	a1da9b563db9056c96523a8727a279e3
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl

/tmp/a1da9b563db9056c96523a8727a279e3
/tmp/a1da9b563db9056c96523a8727a279e3
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Write file to user bin folder
- Reads runtime system information
PID:1515
- /bin/sh
  sh -c "sed -i '/\\/etc\\/cron.hourly\\/udev.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/udev.sh' >> /etc/crontab"
  2⤵
  - Creates/modifies Cron job
  PID:1521
- - /bin/sed
    sed -i "/\\/etc\\/cron.hourly\\/udev.sh/d" /etc/crontab
    3⤵
    - Reads runtime system information
    PID:1522

/bin/chkconfig
chkconfig --add a1da9b563db9056c96523a8727a279e3
1⤵
PID:1518

/sbin/chkconfig
chkconfig --add a1da9b563db9056c96523a8727a279e3
1⤵
PID:1518

/usr/bin/chkconfig
chkconfig --add a1da9b563db9056c96523a8727a279e3
1⤵
PID:1518

/usr/sbin/chkconfig
chkconfig --add a1da9b563db9056c96523a8727a279e3
1⤵
PID:1518

/usr/local/bin/chkconfig
chkconfig --add a1da9b563db9056c96523a8727a279e3
1⤵
PID:1518

/usr/local/sbin/chkconfig
chkconfig --add a1da9b563db9056c96523a8727a279e3
1⤵
PID:1518

/usr/X11R6/bin/chkconfig
chkconfig --add a1da9b563db9056c96523a8727a279e3
1⤵
PID:1518

/bin/update-rc.d
update-rc.d a1da9b563db9056c96523a8727a279e3 defaults
1⤵
PID:1520

/sbin/update-rc.d
update-rc.d a1da9b563db9056c96523a8727a279e3 defaults
1⤵
PID:1520

/usr/bin/update-rc.d
update-rc.d a1da9b563db9056c96523a8727a279e3 defaults
1⤵
PID:1520

/usr/sbin/update-rc.d
update-rc.d a1da9b563db9056c96523a8727a279e3 defaults
1⤵
PID:1520
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1525

/usr/bin/rpvcmskktg
/usr/bin/rpvcmskktg uptime 1516
1⤵
- Executes dropped EXE
PID:1532

/usr/bin/rpvcmskktg
/usr/bin/rpvcmskktg "cd /etc" 1516
1⤵
- Executes dropped EXE
PID:1536

/usr/bin/rpvcmskktg
/usr/bin/rpvcmskktg gnome-terminal 1516
1⤵
- Executes dropped EXE
PID:1538

/usr/bin/rpvcmskktg
/usr/bin/rpvcmskktg uptime 1516
1⤵
- Executes dropped EXE
PID:1542

/usr/bin/rpvcmskktg
/usr/bin/rpvcmskktg "route -n" 1516
1⤵
- Executes dropped EXE
PID:1545

/usr/bin/szcbxrlcrw
/usr/bin/szcbxrlcrw pwd 1516
1⤵
- Executes dropped EXE
PID:1550

/usr/bin/szcbxrlcrw
/usr/bin/szcbxrlcrw "netstat -an" 1516
1⤵
- Executes dropped EXE
PID:1553

/usr/bin/szcbxrlcrw
/usr/bin/szcbxrlcrw "ps -ef" 1516
1⤵
- Executes dropped EXE
PID:1555

/usr/bin/szcbxrlcrw
/usr/bin/szcbxrlcrw sh 1516
1⤵
- Executes dropped EXE
PID:1558

/usr/bin/szcbxrlcrw
/usr/bin/szcbxrlcrw sh 1516
1⤵
- Executes dropped EXE
PID:1561

/usr/bin/mieaccpjpk
/usr/bin/mieaccpjpk top 1516
1⤵
- Executes dropped EXE
PID:1565

/usr/bin/mieaccpjpk
/usr/bin/mieaccpjpk id 1516
1⤵
- Executes dropped EXE
PID:1568

/usr/bin/mieaccpjpk
/usr/bin/mieaccpjpk who 1516
1⤵
- Executes dropped EXE
PID:1570

/usr/bin/mieaccpjpk
/usr/bin/mieaccpjpk ifconfig 1516
1⤵
- Executes dropped EXE
PID:1573

/usr/bin/mieaccpjpk
/usr/bin/mieaccpjpk "ls -la" 1516
1⤵
- Executes dropped EXE
PID:1576

/usr/bin/kieucntodw
/usr/bin/kieucntodw uptime 1516
1⤵
- Executes dropped EXE
PID:1580

/usr/bin/kieucntodw
/usr/bin/kieucntodw uptime 1516
1⤵
- Executes dropped EXE
PID:1583

/usr/bin/kieucntodw
/usr/bin/kieucntodw bash 1516
1⤵
- Executes dropped EXE
PID:1586

/usr/bin/kieucntodw
/usr/bin/kieucntodw "ps -ef" 1516
1⤵
- Executes dropped EXE
PID:1589

/usr/bin/kieucntodw
/usr/bin/kieucntodw uptime 1516
1⤵
- Executes dropped EXE
PID:1592

/usr/bin/vorsrrxhnk
/usr/bin/vorsrrxhnk "sleep 1" 1516
1⤵
- Executes dropped EXE
PID:1595

/usr/bin/vorsrrxhnk
/usr/bin/vorsrrxhnk "ls -la" 1516
1⤵
- Executes dropped EXE
PID:1598

/usr/bin/vorsrrxhnk
/usr/bin/vorsrrxhnk sh 1516
1⤵
- Executes dropped EXE
PID:1600

/usr/bin/vorsrrxhnk
/usr/bin/vorsrrxhnk "echo \"find\"" 1516
1⤵
- Executes dropped EXE
PID:1603

/usr/bin/vorsrrxhnk
/usr/bin/vorsrrxhnk pwd 1516
1⤵
- Executes dropped EXE
PID:1606

/usr/bin/mycydmftyz
/usr/bin/mycydmftyz "ifconfig eth0" 1516
1⤵
- Executes dropped EXE
PID:1610

/usr/bin/mycydmftyz
/usr/bin/mycydmftyz pwd 1516
1⤵
- Executes dropped EXE
PID:1613

/usr/bin/mycydmftyz
/usr/bin/mycydmftyz "route -n" 1516
1⤵
- Executes dropped EXE
PID:1615

/usr/bin/mycydmftyz
/usr/bin/mycydmftyz "ps -ef" 1516
1⤵
- Executes dropped EXE
PID:1618

/usr/bin/mycydmftyz
/usr/bin/mycydmftyz who 1516
1⤵
- Executes dropped EXE
PID:1621

/usr/bin/fujtkiszun
/usr/bin/fujtkiszun uptime 1516
1⤵
- Executes dropped EXE
PID:1627

/usr/bin/fujtkiszun
/usr/bin/fujtkiszun "ifconfig eth0" 1516
1⤵
- Executes dropped EXE
PID:1630

/usr/bin/fujtkiszun
/usr/bin/fujtkiszun "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1632

/usr/bin/fujtkiszun
/usr/bin/fujtkiszun "sleep 1" 1516
1⤵
- Executes dropped EXE
PID:1635

/usr/bin/fujtkiszun
/usr/bin/fujtkiszun "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1638

/usr/bin/tauwlbxhuu
/usr/bin/tauwlbxhuu "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1642

/usr/bin/tauwlbxhuu
/usr/bin/tauwlbxhuu "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1645

/usr/bin/tauwlbxhuu
/usr/bin/tauwlbxhuu sh 1516
1⤵
- Executes dropped EXE
PID:1647

/usr/bin/tauwlbxhuu
/usr/bin/tauwlbxhuu "sleep 1" 1516
1⤵
- Executes dropped EXE
PID:1650

/usr/bin/tauwlbxhuu
/usr/bin/tauwlbxhuu "cd /etc" 1516
1⤵
- Executes dropped EXE
PID:1653

/usr/bin/ckocjsfjzf
/usr/bin/ckocjsfjzf "echo \"find\"" 1516
1⤵
- Executes dropped EXE
PID:1657

/usr/bin/ckocjsfjzf
/usr/bin/ckocjsfjzf bash 1516
1⤵
- Executes dropped EXE
PID:1660

/usr/bin/ckocjsfjzf
/usr/bin/ckocjsfjzf "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1662

/usr/bin/ckocjsfjzf
/usr/bin/ckocjsfjzf "echo \"find\"" 1516
1⤵
- Executes dropped EXE
PID:1665

/usr/bin/ckocjsfjzf
/usr/bin/ckocjsfjzf "ps -ef" 1516
1⤵
- Executes dropped EXE
PID:1668

/usr/bin/okuqbginks
/usr/bin/okuqbginks ls 1516
1⤵
- Executes dropped EXE
PID:1672

/usr/bin/okuqbginks
/usr/bin/okuqbginks id 1516
1⤵
- Executes dropped EXE
PID:1675

/usr/bin/okuqbginks
/usr/bin/okuqbginks "netstat -antop" 1516
1⤵
- Executes dropped EXE
PID:1677

/usr/bin/okuqbginks
/usr/bin/okuqbginks "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1680

/usr/bin/okuqbginks
/usr/bin/okuqbginks who 1516
1⤵
- Executes dropped EXE
PID:1683

/usr/bin/itwxwgwhbg
/usr/bin/itwxwgwhbg "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1687

/usr/bin/itwxwgwhbg
/usr/bin/itwxwgwhbg "ps -ef" 1516
1⤵
- Executes dropped EXE
PID:1690

/usr/bin/itwxwgwhbg
/usr/bin/itwxwgwhbg ifconfig 1516
1⤵
- Executes dropped EXE
PID:1692

/usr/bin/itwxwgwhbg
/usr/bin/itwxwgwhbg "ifconfig eth0" 1516
1⤵
- Executes dropped EXE
PID:1695

/usr/bin/itwxwgwhbg
/usr/bin/itwxwgwhbg "netstat -an" 1516
1⤵
- Executes dropped EXE
PID:1698

/usr/bin/lmpwbhwwaq
/usr/bin/lmpwbhwwaq "ifconfig eth0" 1516
1⤵
- Executes dropped EXE
PID:1702

/usr/bin/lmpwbhwwaq
/usr/bin/lmpwbhwwaq su 1516
1⤵
- Executes dropped EXE
PID:1705

/usr/bin/lmpwbhwwaq
/usr/bin/lmpwbhwwaq "echo \"find\"" 1516
1⤵
- Executes dropped EXE
PID:1707

/usr/bin/lmpwbhwwaq
/usr/bin/lmpwbhwwaq who 1516
1⤵
- Executes dropped EXE
PID:1710

/usr/bin/lmpwbhwwaq
/usr/bin/lmpwbhwwaq "cat resolv.conf" 1516
1⤵
- Executes dropped EXE
PID:1713

/usr/bin/vfdtjrwsia
/usr/bin/vfdtjrwsia id 1516
1⤵
- Executes dropped EXE
PID:1717

/usr/bin/vfdtjrwsia
/usr/bin/vfdtjrwsia "ps -ef" 1516
1⤵
- Executes dropped EXE
PID:1720

/usr/bin/vfdtjrwsia
/usr/bin/vfdtjrwsia bash 1516
1⤵
- Executes dropped EXE
PID:1722

/usr/bin/vfdtjrwsia
/usr/bin/vfdtjrwsia whoami 1516
1⤵
- Executes dropped EXE
PID:1725

/usr/bin/vfdtjrwsia
/usr/bin/vfdtjrwsia "netstat -antop" 1516
1⤵
PID:1728

/usr/bin/pgiwrbzyof
/usr/bin/pgiwrbzyof id 1516
1⤵
PID:1732

/usr/bin/pgiwrbzyof
/usr/bin/pgiwrbzyof "netstat -an" 1516
1⤵
PID:1734

/usr/bin/pgiwrbzyof
/usr/bin/pgiwrbzyof "echo \"find\"" 1516
1⤵
PID:1737

/usr/bin/pgiwrbzyof
/usr/bin/pgiwrbzyof "ifconfig eth0" 1516
1⤵
PID:1740

/usr/bin/pgiwrbzyof
/usr/bin/pgiwrbzyof bash 1516
1⤵
PID:1743

/usr/bin/jmtmhisxek
/usr/bin/jmtmhisxek top 1516
1⤵
PID:1747

/usr/bin/jmtmhisxek
/usr/bin/jmtmhisxek "netstat -an" 1516
1⤵
PID:1749

/usr/bin/jmtmhisxek
/usr/bin/jmtmhisxek sh 1516
1⤵
PID:1752

/usr/bin/jmtmhisxek
/usr/bin/jmtmhisxek "netstat -antop" 1516
1⤵
PID:1755

/usr/bin/jmtmhisxek
/usr/bin/jmtmhisxek "ps -ef" 1516
1⤵
PID:1758

/usr/bin/ozsuwiwmco
/usr/bin/ozsuwiwmco "route -n" 1516
1⤵
PID:1762

/usr/bin/ozsuwiwmco
/usr/bin/ozsuwiwmco su 1516
1⤵
PID:1765

/usr/bin/ozsuwiwmco
/usr/bin/ozsuwiwmco ifconfig 1516
1⤵
PID:1767

/usr/bin/ozsuwiwmco
/usr/bin/ozsuwiwmco "grep \"A\"" 1516
1⤵
PID:1770

/usr/bin/ozsuwiwmco
/usr/bin/ozsuwiwmco "cat resolv.conf" 1516
1⤵
PID:1772

/usr/bin/xowzoguejd
/usr/bin/xowzoguejd bash 1516
1⤵
PID:1777

/usr/bin/xowzoguejd
/usr/bin/xowzoguejd sh 1516
1⤵
PID:1779

/usr/bin/xowzoguejd
/usr/bin/xowzoguejd "netstat -an" 1516
1⤵
PID:1782

/usr/bin/xowzoguejd
/usr/bin/xowzoguejd "route -n" 1516
1⤵
PID:1785

/usr/bin/xowzoguejd
/usr/bin/xowzoguejd top 1516
1⤵
PID:1787

/usr/bin/myccrnhgvn
/usr/bin/myccrnhgvn whoami 1516
1⤵
PID:1792

/usr/bin/myccrnhgvn
/usr/bin/myccrnhgvn "echo \"find\"" 1516
1⤵
PID:1794

/usr/bin/myccrnhgvn
/usr/bin/myccrnhgvn "ls -la" 1516
1⤵
PID:1797

/usr/bin/myccrnhgvn
/usr/bin/myccrnhgvn "netstat -antop" 1516
1⤵
PID:1800

/usr/bin/myccrnhgvn
/usr/bin/myccrnhgvn whoami 1516
1⤵
PID:1803

/usr/bin/nwyoswecfo
/usr/bin/nwyoswecfo "ps -ef" 1516
1⤵
PID:1807

/usr/bin/nwyoswecfo
/usr/bin/nwyoswecfo su 1516
1⤵
PID:1810

/usr/bin/nwyoswecfo
/usr/bin/nwyoswecfo "cat resolv.conf" 1516
1⤵
PID:1812

/usr/bin/nwyoswecfo
/usr/bin/nwyoswecfo "ifconfig eth0" 1516
1⤵
PID:1815

/usr/bin/nwyoswecfo
/usr/bin/nwyoswecfo "ps -ef" 1516
1⤵
PID:1818

/usr/bin/szfcbssocn
/usr/bin/szfcbssocn gnome-terminal 1516
1⤵
PID:1822

/usr/bin/szfcbssocn
/usr/bin/szfcbssocn "cd /etc" 1516
1⤵
PID:1824

/usr/bin/szfcbssocn
/usr/bin/szfcbssocn "cat resolv.conf" 1516
1⤵
PID:1827

/usr/bin/szfcbssocn
/usr/bin/szfcbssocn ls 1516
1⤵
PID:1830

/usr/bin/szfcbssocn
/usr/bin/szfcbssocn uptime 1516
1⤵
PID:1832

/usr/bin/maiupepzmr
/usr/bin/maiupepzmr top 1516
1⤵
PID:1837

/usr/bin/maiupepzmr
/usr/bin/maiupepzmr "cd /etc" 1516
1⤵
PID:1840

/usr/bin/maiupepzmr
/usr/bin/maiupepzmr uptime 1516
1⤵
PID:1842

/usr/bin/maiupepzmr
/usr/bin/maiupepzmr "netstat -an" 1516
1⤵
PID:1845

/usr/bin/maiupepzmr
/usr/bin/maiupepzmr "netstat -an" 1516
1⤵
PID:1847

/usr/bin/ggpujbahem
/usr/bin/ggpujbahem sh 1516
1⤵
PID:1852

/usr/bin/ggpujbahem
/usr/bin/ggpujbahem su 1516
1⤵
PID:1855

/usr/bin/ggpujbahem
/usr/bin/ggpujbahem "cd /etc" 1516
1⤵
PID:1857

/usr/bin/ggpujbahem
/usr/bin/ggpujbahem gnome-terminal 1516
1⤵
PID:1860

/usr/bin/ggpujbahem
/usr/bin/ggpujbahem ifconfig 1516
1⤵
PID:1862

/usr/bin/yvjkkfwyop
/usr/bin/yvjkkfwyop "ls -la" 1516
1⤵
PID:1867

/usr/bin/yvjkkfwyop
/usr/bin/yvjkkfwyop bash 1516
1⤵
PID:1870

/usr/bin/yvjkkfwyop
/usr/bin/yvjkkfwyop "netstat -an" 1516
1⤵
PID:1872

/usr/bin/yvjkkfwyop
/usr/bin/yvjkkfwyop "ls -la" 1516
1⤵
PID:1875

/usr/bin/yvjkkfwyop
/usr/bin/yvjkkfwyop id 1516
1⤵
PID:1878

/usr/bin/rybncvuqbl
/usr/bin/rybncvuqbl "cat resolv.conf" 1516
1⤵
PID:1882

/usr/bin/rybncvuqbl
/usr/bin/rybncvuqbl ifconfig 1516
1⤵
PID:1885

/usr/bin/rybncvuqbl
/usr/bin/rybncvuqbl "route -n" 1516
1⤵
PID:1887

/usr/bin/rybncvuqbl
/usr/bin/rybncvuqbl "echo \"find\"" 1516
1⤵
PID:1890

/usr/bin/rybncvuqbl
/usr/bin/rybncvuqbl "route -n" 1516
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/cron.hourly/udev.sh

Filesize
146B

MD5
ddb9a901eadce597284d68ebd9fe9311

SHA1
1d26318bbe55f2f936ae1015df656535427083c2

SHA256
3bb8ebd394bcaea3f083d93daa3c3bcf918a4618f84ab45a1942759d16b070fc

SHA512
e94bd51f02c323d2376e666a9c56a87c2f55d1805b44762d4bc6d5d60ca52e85ce996ba51142213ba783ac858660a3ba254988215b0f4d398b1e99bf132a5d1c

Download Submit
/etc/crontab

Filesize
764B

MD5
f3e8bd962e48c102e0bdb5ed0f238074

SHA1
e68619b47ff95f464071fc9d43103ad667362ceb

SHA256
5bb4b069dbdfc9c5179201b3719642e65495149fbe24081ac0abb5a74b81678f

SHA512
251b688957e1d96293a9980b1b88e34fe1ac3653ed86e850e8d5c778a0ddb72674c031e474deb106ce0ec4b6f5d02202220dd3158129c5f3160d0ebb8f5955dc

Download Submit
/etc/init.d/a1da9b563db9056c96523a8727a279e3

Filesize
425B

MD5
6c83e8fe0dc6e1bd2a698cdaec472a7d

SHA1
8d3e06a0889b168014a30beee67b97af459cd508

SHA256
6e7692f8a3f4c6b1df36181092220e242f524a7dfd2c4ec0890145698ab7f0b1

SHA512
b1d775099fc08c9dd258df41c42327688026ab1a8e477a05af5aca88ab2c501bff01d511b71411e3dfd5177e3150c24fb11515a42adc71e39fea44be71f1d578

Download Submit
/etc/sed9EAwOW

Filesize
722B

MD5
8f111d100ea459f68d333d63a8ef2205

SHA1
077ca9c46a964de67c0f7765745d5c6f9e2065c3

SHA256
0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354

SHA512
d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb

Download Submit
/lib/libgcc4.so

Filesize
603KB

MD5
a1da9b563db9056c96523a8727a279e3

SHA1
264124d50c9c25cea15459acb662b750bd7987c5

SHA256
f5b098419bdcd2aee198c074b895e113fb7cac9132ad1b592005d31f1394ad3f

SHA512
1418a5fc3fd23a0b10533a60ab76cfd71cd0894c0bf8fdc859fdc27a3673a4f5fc63320ab4e0aab81eefeaba933266933a74e60021a3985bb5dbe8ca90a93aaf

Download Submit
/run/udev.pid

Filesize
32B

MD5
8983b747e2e5321a9a6a708b79eaf627

SHA1
752d0e43a586d4f8548e6e9f71cf43e7a7842d95

SHA256
ee95666786582b31ac9827777d22c73df89d5af70cb0b09d7fc7b2637cd07a25

SHA512
24bbabe174198523ddd197b515466ddbdc1f2bea369e9eb22e9d2a3cfccf41d9c6ffb105a2f95165a05666705dd064bf0e2ff6c2fce7e1971b9c55e54747e14c

Download Submit
/usr/bin/ckocjsfjzf

Filesize
603KB

MD5
10d4e2e68fd35dbb298f749e5c46c087

SHA1
64efdf4fa6f5339123ce8d96b3f02ecbaf1db919

SHA256
b4a1a25cb750f2ba7a6e906494aea866721ad3892f57c3355fe7fff2b7b00d53

SHA512
657573ad66f2ad8164f7f21b17e73cbc1432ea845e457aab533e9deef4d5f587c3608d99e46ca8cc476544176867b29785826ebb29a97cd88dc6871a73521daf

Download Submit
/usr/bin/ckocjsfjzf

Filesize
603KB

MD5
4f29f19cfc06822a167d1c1bec62881b

SHA1
01a8ade703bf0f8e375ee1a45b4648794f0a86ab

SHA256
b0f25116f6a85ab5219f08b3019a60ea22486706016f975844800f8ce5b79bfe

SHA512
7659c299294bfff0a1665e90aa7983d76cb5bd6f517d988c4856f46f9960fc507d1560f151c59e99644f2de992eaae76408d0d2ef078903597da22fb0a85a043

Download Submit
/usr/bin/fujtkiszun

Filesize
603KB

MD5
464ae13f779d5c50a3678380a8c68818

SHA1
089f45c292eb26c639d5ff65b03c7afd53a0faf1

SHA256
e2128ca9342adeb907a0adcead4b729edd6c64a60d5ab6de4ac5e44c73350a73

SHA512
85593eb4b24cbd3a0a37602c861d2b07eabc644ed6f142849acf75d697d31a533346136243b3c571e5f9cb54a99620778d19e6194bd77b0fe4be6fcc3ff393f3

Download Submit
/usr/bin/fujtkiszun

Filesize
603KB

MD5
f2401b492ec539d9c37d0d0c8e64c8c5

SHA1
9dce2aced37ebb8e3fcd20ad44b90c19c9bd2422

SHA256
d30632fb1b122b02bcabf8b3dfe73f18676b0c35cdab5924d4849a3d08ad7a11

SHA512
2fc955ed028e84d2f132bfb1e3e07ac4bf62cb5e1b5074909c1a73ec0225883f5efba1956fff15f15973f9075c1ef5e73d18a8bcff360dd5fd19d575dd7910e4

Download Submit
/usr/bin/ggpujbahem

Filesize
603KB

MD5
b81f0a720ebc0857546ecf8b8e57d171

SHA1
71f1f5d4d5e6848a8dc50de7175586f07e01c340

SHA256
cdd2c0795b1d739e8901030f147ab3cb34ba2afdaf6e7eb851870b226c81c98f

SHA512
701f24de8b681060f3fad5d10e6abb76f417a1727fcf629ac90863d39a48fa95e9195ce32d0cb7b78c79748845ccb6d6357bfeb2cae31fa720487df85f66da81

Download Submit
/usr/bin/ggpujbahem

Filesize
603KB

MD5
8bb19eff0834e0111c18c2c8c6c88644

SHA1
653bc92709132d31f8a84450954e940d2d99c0f4

SHA256
00ae607de98908dc7e844c71867c24cf75d7f4d5e1af511a6c1c2c50a62d7b19

SHA512
cea6b85db6e3a06e5c3ac26a6941414a92e64097d3aa41e32737e8e771797218598d51fd773023eb932eb72c508566d775df35e23cf310698e075f8ce0fe60a3

Download Submit
/usr/bin/itwxwgwhbg

Filesize
603KB

MD5
1deb314f6a02c3e16073104b750f10d1

SHA1
20db8ab357981dcb41ecdbb73b2961c7e5f31ef2

SHA256
d29f6a1166b91c81da46b76546647395e3f1455b20d4fdf30079bba75ca813de

SHA512
2ce0008913df2a54eff46f65c1c2e0e8c83062bc19e7e0c0c3757b752e6c9ac66d351a0882673a901943a3cc8f00ea6a145cacb9defbbf7319830ab2b3c5653c

Download Submit
/usr/bin/itwxwgwhbg

Filesize
603KB

MD5
8431f8778cc865969970393abccba0ab

SHA1
e3021a444778b6a43e1c719ca3e5ce78dd912e88

SHA256
ca5a39e46400bc25df6f41f6624b6a76d12ac6a910c6fb4fb7a8843f55eb08d8

SHA512
5f4cbefa9b2350528b837fb0aab6c471851a532462f0a13093b2b39b1706a3b934a6e1c9ac30f6c94cda0e7aae664a84c4d377866102bdc7eb40d5500af5debf

Download Submit
/usr/bin/jmtmhisxek

Filesize
603KB

MD5
81668e516678c750a725278a7957c58f

SHA1
e208674175ce00ab9006691e5e1cba9b7680d8f8

SHA256
f0934ff2b4fb6b7d06777c8658ad7f80826929faae21a75e8b6a131e74661129

SHA512
387c34d8b4ce95ed67e6e357c6815bc04d2f36e385aac24844932dae06540b8a6f7263335796a88678feae5fb4c4e67b7defc5d8bf49ef3d6400ae96089ceca8

Download Submit
/usr/bin/jmtmhisxek

Filesize
603KB

MD5
e505a49ef3b20d4f5d55ef0f5303dc8b

SHA1
49cc983c99940fb97dbcd0604b5e9cd7ed376fff

SHA256
c56dcb7b38883421fc70a2e58e37709faa952bdebf0bb2d6fa2c282d6b61f38c

SHA512
2fd6b23017b8ed46ed1fb59fadc3886246c7fd68a203e57281bff242d98be16a35360d10cd2b1865bf26c7d85160c343f09237fc3f20cd9ff7c20ad38de7a1a9

Download Submit
/usr/bin/kieucntodw

Filesize
603KB

MD5
e0095f0fb1ad5b84397897788bc79632

SHA1
f03a02c05a3fd3e17113e78de25667b8aee85de7

SHA256
c8bf50dea36bed465de32a8232d81e5ee47937106021a63001b1dabd1af6d723

SHA512
d3cd338eec198b9616788d0e94f4baae497322bebeb0036ba5df04f7f2d5512b5b8c0e23aa39abbb7887d21894fbc3fcc01aa1149585d9a17370f35f932b5500

Download Submit
/usr/bin/kieucntodw

Filesize
603KB

MD5
1db33b15711cfe5720df100a176abe12

SHA1
f4ac5c3b2e7cfa33f1e1e973fb075ed72b501f7a

SHA256
7b184b26722cff181c09c57330805df476ad3fc0aacce4ea96b41ed2bf410046

SHA512
7b12d66726f1c9f27ab36274aceffdbfb774b3010c4a7452d0d4df83cbf00036d83620bdd7c2d4fbfcb622ccb3fa310d6f22736cadc791c01c4d386076eebb1f

Download Submit
/usr/bin/lmpwbhwwaq

Filesize
603KB

MD5
126c9f4db8d0385025de07723e3e772d

SHA1
f0cdc0fa02bd6982eeec99b390398b81c48edc0f

SHA256
b0aa7bc91f9562d2721250656d0b0403dc50e417178c6509193bc3f908ce44e6

SHA512
5f28e0efa1f37974b1516f559abc159dc2c07363e080dcc416f1bff2a433637edb2e63e67bd4d1684a1a9783fe76c1a905a9b06c6b3fb00f3bef79795e549faf

Download Submit
/usr/bin/lmpwbhwwaq

Filesize
603KB

MD5
d01020f5a1f9765fc97fee9e0fb295d6

SHA1
db13965a6bcae5d802e758192476880412b36358

SHA256
fd07b27987629a4862b2ad054f565cf66bcf71c05a75b8a51e1ad8852b2bbce3

SHA512
1ee7664b2fc5d977f264fc27a2e8da5e8ddf35a177a27b1d9cc1e0f0868d46b11e673adf243371b9c32d446f1975484245c0f4e0b06bcd5f683a574e4d01b380

Download Submit
/usr/bin/maiupepzmr

Filesize
603KB

MD5
c0889f737d7b8787559e506836dd1455

SHA1
f9b40016ea9926f619234bc1a14763aa87bf233e

SHA256
1df6e5b9ed3f78e61043ccc6f274e3448ac8d2482622d162160703fc95c23304

SHA512
1f4abe093e0ba5fdf123ba7038fa04cb443d08d3d324b97d584931383c9b199819ae87b82f6064b968dbef693c0245c55308d1d707b71b1da745613c23d872e8

Download Submit
/usr/bin/maiupepzmr

Filesize
603KB

MD5
6f1af045ee69ca61512d0a95af57b071

SHA1
e19739ec47407535b9e23dda7d11a5b2e884e5df

SHA256
12fcdeb4c26cfc69dea4c270e78ceaa0a2423365b9af9ea04f98fefada6a5907

SHA512
eace52656189a5329dea28cbbf851ef7e621ac348d32955aae91b308bc0201ff87819e5b8b6dffb6b7072f7cb5c04505b07c3c09ba7f1b4691348a0d5be7c6ef

Download Submit
/usr/bin/mieaccpjpk

Filesize
603KB

MD5
f17e8ae6fc42228ad995fc9f70954529

SHA1
1b9504f1198b361c723383fbe237f93825da8c11

SHA256
adca26f1c880292bb56522b13d2c7d3cdd307a0d0478f2525d8f0106df07d21b

SHA512
38dec2f0b832c1e0c4f2e1f7f6d35a4e4ce51d45c722a72d4c783dbc4ae370b363aa87fd317d202b5ec75a7bafa17ca71eb600966b9e0ecc4bb4a2fa7920649c

Download Submit
/usr/bin/mieaccpjpk

Filesize
603KB

MD5
a11504452d3aa46e251e6e1d6e4c3ea4

SHA1
04c5b1edd16658be7d185ddd5dc8ca4c70fc6351

SHA256
3846fdd65c635ca6bab2813c92e3631055e97805df12c768ada13243c4579ea0

SHA512
dc6b0def5f6968a8e51bf2f5a4ffbaf5738cc04b002cfc9010d23e92ede986770f3ee0171640ccf2a9518477e46ee19a9399684b7818cf585a2f050d43e7bb94

Download Submit
/usr/bin/myccrnhgvn

Filesize
603KB

MD5
02ff4914a95a153865a3af3056de6356

SHA1
bfb42287b3baa6d54233e76f6c1c890b10df6ccd

SHA256
3f4284935ec04cbaefadb168075167cdae7d4157af5bc6c58d3f197e57c4eafe

SHA512
fdb6e2e4edbdbf84f07cb1ae5daa6f8018a16f23174675e09dd89d06e51180953146290b4a5da35ea6210ad3361b85479abd145c48c2ad4f24a37fd59262036a

Download Submit
/usr/bin/myccrnhgvn

Filesize
603KB

MD5
12a83ae0703a6f6e8ed24eb039925143

SHA1
abdebb2965a7cd6d065cbec62992e9cdafa1ea67

SHA256
947cd9aa25868b6617d870d7e4deb2c49058c9c104b7a12c33d1fb3cccfd25c0

SHA512
d5542a8ff967e5d79b45bc2dcd780ea7ec7b336154722177f11c92d130eace4c6f475b52292124e4b242c894406b8bd5d3d1481d1806a878fe74e631fc31719d

Download Submit
/usr/bin/mycydmftyz

Filesize
603KB

MD5
c4e3ee32b4ea08559193d7f724d61dc7

SHA1
1d7785b973145d416cf46d257d9f80836c4771d4

SHA256
a1177de3b297c30a1d136fd67047cffcc87104639f47063dadb4ba3b9237b8fe

SHA512
5f599d114d06860f51cc2df934d850bf588c315b24455cf737737af616a540a016747a1797d6a14f24acf2933ab7ff2e82eb9a50099fda96c16dc4f7a36611b1

Download Submit
/usr/bin/mycydmftyz

Filesize
603KB

MD5
74b9242409586e5e47b1d9caf227445c

SHA1
2d1a80468e6465686c1a4c577af09e9a9c026425

SHA256
ef8ed93ef1e0ad63c54cd1c0b56e8b5743a2c433c0188b5de243605e0492afc6

SHA512
7e7586cb59fb1ee96566fcf63512d13c2beb7474fd05ab3202e038a0e7c4a91eaf065cef85886220da9cfac66d280c339eba35f974a5de101639b5cc73996bf1

Download Submit
/usr/bin/nwyoswecfo

Filesize
603KB

MD5
9b25e4a81945d71934f77dca741b2b3d

SHA1
83a44491840494b99bd47bc029ab100b3d3e02ab

SHA256
89112ca596758226e2985fbd387ec38f7bb051fe3cee6aa077d1a465dc9d9b7d

SHA512
c258ace34e0d5cc0c807233ddd979721d120abe4bef7ebd6b7a59012ad6c2bc41d29e751aae8c75969c39096d942c4a322b0441257f3c316d0f5d8bcbb42fc3f

Download Submit
/usr/bin/nwyoswecfo

Filesize
603KB

MD5
89a78824dde0c62813f14367b4cbb5bd

SHA1
ee744eefce5b27f50881543cdc909473b91384b7

SHA256
d4fb005e26ce58169773ebb0c28a4c9ac1cd81f26749322b466958bb6f2311f2

SHA512
31a193916946d8b67a012fed9a14799d3161332c0337c4616c29acda2fb694df385245103d128aaf2cbe1f4dc4228a58c12b34b55a6d7645fa85326d61a73a21

Download Submit
/usr/bin/okuqbginks

Filesize
603KB

MD5
a7ad2c5946b2cce28e0e4b43406d40af

SHA1
30c8ab6dc9338e58e899117e52b8e1950b63699e

SHA256
9daaf41d4baaf2cdad8a5f54036969fbc3f2f39e7b151ab0b7ac6cce955eee4c

SHA512
da63e324a88b03f86064571c14952f22a8ebd2c0cc8a560f900bccc8cf60a3de5e9cc0dad7afbc884c62602d9045a184c400007a198f86a0babc875e7a172fc6

Download Submit
/usr/bin/okuqbginks

Filesize
603KB

MD5
3c3e285854e0fff9a4de2a171a46a5a5

SHA1
987d4349e772f1c172a5b68ebca653a0e116bb6a

SHA256
a12a12a4c7c504792e060b67d8001e633983e9e7056c475cef82ed5ae64b1ff0

SHA512
d89847db4bfe916d2093e4de7c4afe6fa3cb24aef268de22d716c0397de1f284ded3df144c4c029f390d11c0aadb893139fec9c23688055ac30b8abde0f5135b

Download Submit
/usr/bin/ozsuwiwmco

Filesize
603KB

MD5
34e9fdb637a37ff6f94e42852c467b14

SHA1
e425f2100203560ee545184a0aca8b75e49619f1

SHA256
0ce1522361d1bcfd514bec8b3e6cb2c5c7f1ffe688516b47922a90fe4041b036

SHA512
e9f08a3c996a8737f25dcf1af2e94d5ec59ec73270076d2e63fda8c2bc00dec496e4a13c4e2835321b3203ea070b6209fdcd2dfb1c4784c0e09a3486ca603877

Download Submit
/usr/bin/ozsuwiwmco

Filesize
603KB

MD5
b023fe8a585e39dc32a84f8222b6d321

SHA1
fe0bf40cbaec98964fe36fbf35420e0137f86223

SHA256
704af4ee85ad2423051592275b903706704d65406401fdeb6b711364229f94d7

SHA512
3d69714a40891d12b5a90e514327f791f4356c653e0055bbe5122debe5c4b033fd7e10df7dc932aa712f040218d13cfa7ba489521ee379bdc7b798343ec7b9ef

Download Submit
/usr/bin/pgiwrbzyof

Filesize
603KB

MD5
2e3918a2db3e0525b9bdb971e219bde7

SHA1
a3404af73baccc53573f97b3e12c5fa4269013ff

SHA256
9517aed597b31b8fc0e0f0343cedb878a26ceb2b93c541865865e2b93f44d2cc

SHA512
eaea8a1f6f648613c565346c2e19b181b2d45793ba33cc016a43f3ae518a70565d68faa42443a665b3da78090ed0dff1a3c8284d97e07d7fe8a6851badbfe457

Download Submit
/usr/bin/pgiwrbzyof

Filesize
603KB

MD5
988c4fb6a31f1e12105f3f9d5c628d94

SHA1
1cf1975e29f649f7fdb104b33a3ad4d1ccb5209a

SHA256
73bf3700c0e2db066707fd9a0bae3960e429da6036cd7476b65dc3a9280241a8

SHA512
dd5bbe6d78323809cf05a70daff2180b3fe44208a18b16fb10a69d07c7fee7b5d24f4c501ee5b517d1ab292395a5c451387ba529d993887e5378952dd4606597

Download Submit
/usr/bin/rpvcmskktg

Filesize
603KB

MD5
9b6a8c254e6436052991c23f799c2efc

SHA1
21f293d406c49b3f164e32c476aa7f0a330f4bc7

SHA256
1f7d075f2b484471b3bd02df7f31f6be2d90eafe058693b53e4252845fe89908

SHA512
6f776af172175758b56aaea3a495b0c696996cad11fc5fc1354456a35caaceacede3860e7daeac5aeb44cb4fd04aee5ee4dbcf259aa634e25ae35774e3dcffcd

Download Submit
/usr/bin/rpvcmskktg

Filesize
603KB

MD5
eecaf0ef6224780199d0033bc8a18811

SHA1
ace06c83247b036026aa8de94758db945bb06d6c

SHA256
f282fb1bd7062a4cdeb5a0e66c88dfd82f0fd14ec520273383fdf873a27dd35f

SHA512
29270b11b1adbcd9d9eafbb8c4e956714687de421d3e8143df98fc430224bfbbe98591ae78f2bb765c9d53093bdf69dfe24c606c3be9773a100f0c4b03b4beae

Download Submit
/usr/bin/rybncvuqbl

Filesize
603KB

MD5
48eaca3abac447624df90e3f6d2a3f78

SHA1
711e56d23a553ccd826fef4a755d500be8d72626

SHA256
385cc4b44b88c90b044729792a28574182cd49d8f79402ac361dd75fed28e54d

SHA512
3f1b956d165dbf0731eba796b01bf649f05971cbfdbc6c1fb63cf91f521900b3848ad95a4d2f6b61ca2d667b2427c133d63eaf786967d2f7da8cfa1a62f034bc

Download Submit
/usr/bin/rybncvuqbl

Filesize
603KB

MD5
929110ad791f59494a887e5eae219448

SHA1
8aea0c32d763091082012aaa569400390bb25ada

SHA256
bd0e295508b29c2adacff13d31d2e5d67eb4c73328ace88f9349eed8d36e6681

SHA512
f76d8167e6401715c0f1186acccb5ef8982cea1bb96d4a21c357cf9c7cb90ad33a90395fdfcedca1fb0ae46ac1f99764e0a1cc5eb73cd7a7d13325e3a95376fa

Download Submit
/usr/bin/szcbxrlcrw

Filesize
603KB

MD5
2e36ce3026059ee72c0eef34533aff8b

SHA1
ad564ef4ce2bfbf6311103212f5b6daa802f1d05

SHA256
d9b7bb155ba976a201030dcf5653ac05dea854ef3957c69026235a735202021c

SHA512
c2c40e36ab538d56dadcf7e72d6443485f5575960125cf354d31226fc1853d5c3be6274a91373a691fd916e6f654f269240b99009ae9565b4f2cd25e2d0d74f9

Download Submit
/usr/bin/szcbxrlcrw

Filesize
603KB

MD5
7289e3a625a0e22a65b983454d9fb0a7

SHA1
19f7d19fcd32e1122f0bc77e399cf422a21f3a11

SHA256
0591e60e491a1d99b208336d02d45d5a2fde2336fcf1937c291c1f10af264f92

SHA512
f3c1b23f0f72f51e5c86e910abd2dfa0f79e5d109e20442666fd6836833bfad66ac06844a07308936c38b13771b97004c2e8f2db8d930c7425ea13fa507fe40c

Download Submit
/usr/bin/szfcbssocn

Filesize
603KB

MD5
f66d833c982f5dd2ce3268aed6ee10cb

SHA1
0a9c7843adee7ddc538193365a44383f48b1986f

SHA256
d28022a8fe646dd83b2d20e3982fbdd02bac832f3d78b161357056c3726312bf

SHA512
9b82a4edfed74923d2d4eca81e8cc352c648dcbdc2b915f72d40cf6744c86ccdc21223b62263ee4161cc006438780d92f9661d54f0ea5e0d66e4c7f6235c26a6

Download Submit
/usr/bin/szfcbssocn

Filesize
603KB

MD5
361e56bf810d0908073850629227f255

SHA1
68058e594bc0e52b509ac62917302c017ec680ff

SHA256
bb2bc7f0e01d6e611cf8fca510c7ef001482ac27c6fcbfde0ac80aae379e24d9

SHA512
f5a389ad0c2689a72d80c267ccbd4b4595fff6f4cfd02b536fb488727c0f5699ee5afff2bab8b21adf450893b0e5bd4a2ee929b7ec5ed09aa095082f9725b7d4

Download Submit
/usr/bin/tauwlbxhuu

Filesize
603KB

MD5
406c8716f7621507b4216548dcdf706d

SHA1
a8555884bd1f26ca7112120c0e1c917554c9c461

SHA256
bb807859081c5dc12ced7526abc4bee94f0a0f8e9bd8bd77f4a63eeb4f710295

SHA512
6d78e90a15460af4f2528bc1f56fb093a814b0eaff60a6c8dda727a996694f41df954b473a5e754562728e6f4cc643d762926a4ff3cf5f9286eca5badfd2b028

Download Submit
/usr/bin/tauwlbxhuu

Filesize
603KB

MD5
e31c7d99999597cab8a224d4b00f690b

SHA1
3016bc0438fc0629801d40a9753dc7246d791632

SHA256
93243578ea7bf5ef46fabcf1f23f4379d9e64f4146d1f77523ed84382c85e070

SHA512
62c7b608fabbf749d966d2bb084799d5436790e7089c78bb3bb98d62f6a243ab4cc7fa16c6ed40560a171b3efa58e864a7e253135265e884aa678fce59b2fda9

Download Submit
/usr/bin/vfdtjrwsia

Filesize
603KB

MD5
b4f72433341961f641cf144bfd20cb6a

SHA1
c062fb68861012c26fb32511412018b65607a397

SHA256
6d2782d710738d37b86e38e9e2891c32ce0840ff1f6446f179166dc70bbf952a

SHA512
f1f06cb9da3018d66b79cca9c75280e891d218461944c1a7c1b840a8058a51b3c070653efb290ad25ed18dbc8174ef384d5d0ee86307476a1ad25bf0c9f33ce0

Download Submit
/usr/bin/vfdtjrwsia

Filesize
603KB

MD5
09b8c1e892d9c9678969a8e7c514e499

SHA1
fedfa4f5dcaf0b1eccd8bdea58b5cb8324dee41a

SHA256
c89cd364080909c8cf7f21301c120a4a1503c6aae4acd7793ad6ee97ba97e0d2

SHA512
bd167c0d344ca9e72d085ff1172122ee2f409a5b7d059673c98589dc7698d13c6d04f5589a39ef9b0e92761d27ac591b1012ec8fedcbe7c433422224796f1cb5

Download Submit
/usr/bin/vorsrrxhnk

Filesize
603KB

MD5
95a79fa0ba1be3f04d713c8f2282143b

SHA1
11fe1e85702b25c5f699c8cd8560d6fd2d26eec9

SHA256
0ede4cc0439cd4917aec67b3eefc8d0b9856ae915864a4e43cee1a049658e642

SHA512
96c7dd2d668a13e466140af4c5ba85cb94d9d568d18d9e4d8c3e45ac26e5426cc55ddfe5e859585d66823f8b9ec079ef974942a1ff9f11dcdcdf21713f515d6a

Download Submit
/usr/bin/vorsrrxhnk

Filesize
603KB

MD5
facd3c01ab9debbb750a7bda778a770a

SHA1
dca9c694e8fe29a7121933e592f4b921381552bc

SHA256
67e3b15ca54363b6d94b95aa21e5f9ff0e61bdc8be71d4a8f9093b394aa27c17

SHA512
f00fb7b028f7d4ec1ed7cfeec49acf661d1da4b042416370cf49c295da112e99ea06fa039ffdf2d719ea47c5f4eeb37344375a351a0841b54ca652e0a9f56b3f

Download Submit
/usr/bin/xowzoguejd

Filesize
603KB

MD5
fe75a19ab9e862a0a4154f9540312963

SHA1
8ff4b5c490617b82076cd5ac1b4cc39485cf6370

SHA256
3edc55c43a5ba4d031862432917b3ac5147a443a33b7508965193616993a0669

SHA512
1cabc1662a2444eb21b06d7d921a5e602461d4010cd1d6f456e8c8c23c540648ea0b85c2aaa33f646e4c39ed9588a5e82ecf68ac16e418f6228fab36827d08a0

Download Submit
/usr/bin/xowzoguejd

Filesize
603KB

MD5
c489c9072c475a5f80fccb697a2bea55

SHA1
88b487480b00c455699ea8e2c3f21674c720ba5f

SHA256
c3f04b275c576bacd33421540746e8a1c4316781491326837b8b9d29d0ae7549

SHA512
4e078a78f107363377e466767f1031e4df70e6fc0d5f3a6a29f2c2032733d5f0ebf8a7bb7313fe358acc137800c7e197fce154814b885a05d102276bdab1403f

Download Submit
/usr/bin/yvjkkfwyop

Filesize
603KB

MD5
ab2256880daa69a145e5954c8aaa4ed3

SHA1
959f234611e280a565d1ed3111a2e8bb1cf12db7

SHA256
d3fc173f535f98976b50e794a5fa38c4e7f88fa750e8840e3b8cd57d0b843661

SHA512
a5de31b96f65662362d6843b58c474caa2ddf73d0fcd93aa9662e46b56e8f4e945d1817a5e696e47f1309833aef311a9661212bf2c3a0ea48de9999a37e5910f

Download Submit
/usr/bin/yvjkkfwyop

Filesize
603KB

MD5
6206991a115cee351d9b7d3ecf2c4c4e

SHA1
25600d2b12b37a49f2876ea41c4b094f6e9d1bc2

SHA256
8a796f9082e43644d2f57875ae17ce62b036508bfec25c5677fec7bbb8dd2461

SHA512
deffd7321ba6ee86e42b885905ac7ab8e7f736bafc0eda8f9fa4143925b391ba5dafbcc9b16d47aa0dc9d444ac9b68287acf3aceb8f1969e9961090497648021

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads