xorddos | a89c8ef292c00472850398e72e2bfa6beb9e5e460d52863faf6cefa7c6d723f5

Analysis

max time kernel
299s
max time network
300s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/02/2025, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mdmnpygceatyeq
Size

544KB
MD5

f44ae424e83e10004380f6aadceebb15
SHA1

173c9062c3326d4940cf7b6cc70c1a750dda2a49
SHA256

a89c8ef292c00472850398e72e2bfa6beb9e5e460d52863faf6cefa7c6d723f5
SHA512

e05aca5a978932c4b842e04d77c717e88a82fae00e99edb7ed7c2569fbdc9b1dc70a812c21b386f3ee1535a799296e6ecbcda15d0a5e9e73afcfcff6c47bd326
SSDEEP

12288:JbinNy0Y1nvEtXBx6DkkJmAGyPexU279WnjVZ6ySWKZ:1iNy0evmxvkJmApPexUm9cVEb

Score

10^/10

xorddos botnet discovery downloader execution persistence privilege_escalation

Malware Config

Extracted

Family

xorddos

topbannersun.com:8623

wowapplecar.com:8623

Attributes

crc_polynomial
CDB88320

xor.plain

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 6 IoCs

resource	yara_rule
behavioral1/files/fstream-3.dat	family_xorddos
behavioral1/files/fstream-221.dat	family_xorddos
behavioral1/files/fstream-223.dat	family_xorddos
behavioral1/files/fstream-225.dat	family_xorddos
behavioral1/files/fstream-227.dat	family_xorddos
behavioral1/files/fstream-229.dat	family_xorddos

Xorddos family
xorddos

Deletes itself 64 IoCs

pid	Process
1508	duquhvtcg
1509	fasyeir
1512	ggljum
1515	swreywkj
1518	vcgmmnpglvoem
1528	tkltevfxkabx
1529	oacqgxg
1530	ycprjdr
1535	dmrqhylmvxo
1536	wtnwyd
1539	uilmysho
1545	pxxqjp
1544	drtcgitgkli
1548	hnsqzeqtl
1551	jabitmagq
1558	tzizyosyey
1559	krziptlvr
1560	sdeyvbdjmhmiym
1565	wuidgses
1566	xrfyrvqr
1571	porkcimpelqkb
1574	tknhixutweg
1577	mxevitjbglludr
1578	tcjrxve
1581	ebyzzfixrf
1584	rwepigcjfna
1591	nnadpjc
1592	ylgebmpfflpy
1594	npbrbiebzuq
1596	zfldvjodppp
1601	arwmwkxpahtsdh
1602	fdlhdh
1609	iucgeawfjrxma
1610	efqxxfl
1611	uezbjjqpohpoo
1620	kzquppvmc
1621	bvwhcanzfr
1624	qovsooqrxcqnzg
1626	usizvgveiwrjbl
1628	wdmrwaiorfrj
1633	adtiuefgi
1634	uvyoordmyxegp
1637	kysvxavb
1642	fvaldkgkebk
1643	rcxecuikloujh
1650	qkhxrhldmpk
1654	grxfbzup
1657	wocqrhqbeprq
1658	kecnst
1661	pzrmhumbknzarr
1666	bnwoynglyxx
1669	jchmoiemvz
1670	cemjdmhfbdv
1675	qdmqbjzmsdvhr
1676	fbkafqp
1681	pdsjzpzz
1682	fspoqwyn
1687	etwttmhvoa
1690	qzpvtywixwv
1691	qktigrwqxrotm
1698	entngubpvesgnb
1699	pdcygloejkuu
1700	mxrbqejngykmt
1703	buqqzvqggfmsp

Executes dropped EXE 64 IoCs

ioc	pid
/bin/duquhvtcg	1505
/bin/fasyeir	1507
/bin/ggljum	1511
/bin/swreywkj	1514
/bin/vcgmmnpglvoem	1517
/bin/tkltevfxkabx	1523
/bin/oacqgxg	1525
/bin/ycprjdr	1527
/bin/dmrqhylmvxo	1532
/bin/wtnwyd	1534
/bin/uilmysho	1538
/bin/drtcgitgkli	1543
/bin/pxxqjp	1541
/bin/hnsqzeqtl	1547
/bin/jabitmagq	1550
/bin/krziptlvr	1557
/bin/tzizyosyey	1555
/bin/sdeyvbdjmhmiym	1553
/bin/wuidgses	1562
/bin/xrfyrvqr	1564
/bin/porkcimpelqkb	1568
/bin/tknhixutweg	1570
/bin/mxevitjbglludr	1573
/bin/tcjrxve	1576
/bin/ebyzzfixrf	1580
/bin/rwepigcjfna	1583
/bin/nnadpjc	1586
/bin/ylgebmpfflpy	1588
/bin/npbrbiebzuq	1590
/bin/zfldvjodppp	1595
/bin/arwmwkxpahtsdh	1598
/bin/fdlhdh	1600
/bin/iucgeawfjrxma	1606
/bin/efqxxfl	1604
/bin/uezbjjqpohpoo	1608
/bin/kzquppvmc	1615
/bin/bvwhcanzfr	1617
/bin/qovsooqrxcqnzg	1619
/bin/usizvgveiwrjbl	1623
/bin/wdmrwaiorfrj	1627
/bin/adtiuefgi	1630
/bin/uvyoordmyxegp	1632
/bin/kysvxavb	1636
/bin/fvaldkgkebk	1639
/bin/rcxecuikloujh	1641
/bin/qkhxrhldmpk	1648
/bin/grxfbzup	1651
/bin/wocqrhqbeprq	1653
/bin/kecnst	1656
/bin/pzrmhumbknzarr	1660
/bin/bnwoynglyxx	1663
/bin/jchmoiemvz	1665
/bin/cemjdmhfbdv	1668
/bin/qdmqbjzmsdvhr	1672
/bin/fbkafqp	1674
/bin/pdsjzpzz	1678
/bin/fspoqwyn	1680
/bin/etwttmhvoa	1684
/bin/qzpvtywixwv	1686
/bin/qktigrwqxrotm	1689
/bin/entngubpvesgnb	1693
/bin/pdcygloejkuu	1695
/bin/mxrbqejngykmt	1697
/bin/buqqzvqggfmsp	1702

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.hourly/qeytaecgypnmdm.sh	Process not Found
File opened for modification	/etc/cron.hourly/pgabfhdynuykzr.sh	rzkyunydhfbagp

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/qeytaecgypnmdm	Process not Found
File opened for modification	/etc/init.d/pgabfhdynuykzr	rzkyunydhfbagp

Writes file to system bin folder 64 IoCs

description	ioc	Process
File opened for modification	/bin/azswwoginavcnc	rzkyunydhfbagp
File opened for modification	/bin/gabzbwfxogsrqy	rzkyunydhfbagp
File opened for modification	/bin/xocygmyqopohjx	rzkyunydhfbagp
File opened for modification	/bin/qxysgvztbqf	sysrogclap
File opened for modification	/bin/plufjlufl	rzkyunydhfbagp
File opened for modification	/bin/cptjfxscgxebfe	rzkyunydhfbagp
File opened for modification	/bin/rzkyunydhfbagp	ncrohcjamnoxqh
File opened for modification	/bin/qktigrwqxrotm	Process not Found
File opened for modification	/bin/svmttisfghock	rzkyunydhfbagp
File opened for modification	/bin/opvassritdcj	rzkyunydhfbagp
File opened for modification	/bin/slpfutpq	rzkyunydhfbagp
File opened for modification	/bin/nhkwiunawzxuza	rzkyunydhfbagp
File opened for modification	/bin/jchmoiemvz	Process not Found
File opened for modification	/bin/pdsjzpzz	Process not Found
File opened for modification	/bin/ixrork	Process not Found
File opened for modification	/bin/kwtqzrjuaflakt	rzkyunydhfbagp
File opened for modification	/bin/gaaxizuikgujwi	rzkyunydhfbagp
File opened for modification	/bin/esrtobx	rzkyunydhfbagp
File opened for modification	/bin/vszluda	Process not Found
File opened for modification	/bin/qzvdkexgye	rzkyunydhfbagp
File opened for modification	/bin/ghleemdl	rzkyunydhfbagp
File opened for modification	/bin/krziptlvr	Process not Found
File opened for modification	/bin/ylgebmpfflpy	Process not Found
File opened for modification	/bin/dtnendbiqos	Process not Found
File opened for modification	/bin/pgjumwijkfzw	Process not Found
File opened for modification	/bin/pcbdyikyrnrb	pqdkpsnh
File opened for modification	/bin/vlhrigrmvwhgjj	rzkyunydhfbagp
File opened for modification	/bin/fxsibb	rzkyunydhfbagp
File opened for modification	/bin/qkhxrhldmpk	Process not Found
File opened for modification	/bin/msdzxcxveaqhm	Process not Found
File opened for modification	/bin/ojctnapdynojv	Process not Found
File opened for modification	/bin/qgwxuc	rzkyunydhfbagp
File opened for modification	/bin/kuqzeruaqrmc	rzkyunydhfbagp
File opened for modification	/bin/bkihcdjiphco	rzkyunydhfbagp
File opened for modification	/bin/icqvaxzixjgqva	rzkyunydhfbagp
File opened for modification	/bin/xujgrhqd	rzkyunydhfbagp
File opened for modification	/bin/yvtbhocfdxxbuv	rzkyunydhfbagp
File opened for modification	/bin/xtrhblktvmz	rzkyunydhfbagp
File opened for modification	/bin/zvlrtazkvhrto	rzkyunydhfbagp
File opened for modification	/bin/wouufdrzzriscs	rzkyunydhfbagp
File opened for modification	/bin/jabitmagq	Process not Found
File opened for modification	/bin/wdmrwaiorfrj	Process not Found
File opened for modification	/bin/jtqeayyj	Process not Found
File opened for modification	/bin/yogcnr	rzkyunydhfbagp
File opened for modification	/bin/kozthrsec	rzkyunydhfbagp
File opened for modification	/bin/kxohqafaszdcrj	rzkyunydhfbagp
File opened for modification	/bin/owaosxfuzjsd	rzkyunydhfbagp
File opened for modification	/bin/pdcygloejkuu	Process not Found
File opened for modification	/bin/hcioawdkfdogjg	rzkyunydhfbagp
File opened for modification	/bin/yyjfhwqy	rzkyunydhfbagp
File opened for modification	/bin/zojprygssze	rzkyunydhfbagp
File opened for modification	/bin/pljbpk	rzkyunydhfbagp
File opened for modification	/bin/qxkshvulic	rzkyunydhfbagp
File opened for modification	/bin/mfhtvlxuazyw	rzkyunydhfbagp
File opened for modification	/bin/psqoowoeec	Process not Found
File opened for modification	/bin/gfajhlfx	Process not Found
File opened for modification	/bin/qiceaqi	rzkyunydhfbagp
File opened for modification	/bin/tnmewemrbou	rzkyunydhfbagp
File opened for modification	/bin/qqzkxwxck	rzkyunydhfbagp
File opened for modification	/bin/efqxxfl	Process not Found
File opened for modification	/bin/wrujwrxfgwcg	rzkyunydhfbagp
File opened for modification	/bin/rsaomlpbxurxx	rzkyunydhfbagp
File opened for modification	/bin/ajwjykfv	rzkyunydhfbagp
File opened for modification	/bin/tfjkamjgccxhq	rzkyunydhfbagp

Writes file to shm directory 7 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/sem.ihrgag	Process not Found
File opened for modification	/dev/shm/sem.S3bKBi	Process not Found
File opened for modification	/dev/shm/sem.ihrgag	rzkyunydhfbagp
File opened for modification	/dev/shm/sem.ihrgag	qxysgvztbqf
File opened for modification	/dev/shm/sem.ihrgag	pcbdyikyrnrb
File opened for modification	/dev/shm/sem.ihrgag	qllcbabksdtnmk
File opened for modification	/dev/shm/sem.ihrgag	kepnnmwdqixxma

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/qeytaecgypnmdm.sh
File opened for modification	/tmp/qeytaecgypnmdm

/bin/duquhvtcg
/bin/duquhvtcg -d 1501
1⤵
- Deletes itself
PID:1505

/bin/fasyeir
/bin/fasyeir -d 1501
1⤵
- Deletes itself
PID:1507

/bin/ggljum
/bin/ggljum -d 1501
1⤵
- Deletes itself
PID:1511

/bin/swreywkj
/bin/swreywkj -d 1501
1⤵
- Deletes itself
PID:1514

/bin/vcgmmnpglvoem
/bin/vcgmmnpglvoem -d 1501
1⤵
- Deletes itself
PID:1517

/bin/tkltevfxkabx
/bin/tkltevfxkabx -d 1501
1⤵
- Deletes itself
PID:1523

/bin/oacqgxg
/bin/oacqgxg -d 1501
1⤵
- Deletes itself
PID:1525

/bin/ycprjdr
/bin/ycprjdr -d 1501
1⤵
- Deletes itself
PID:1527

/bin/dmrqhylmvxo
/bin/dmrqhylmvxo -d 1501
1⤵
- Deletes itself
PID:1532

/bin/wtnwyd
/bin/wtnwyd -d 1501
1⤵
- Deletes itself
PID:1534

/bin/uilmysho
/bin/uilmysho -d 1501
1⤵
- Deletes itself
PID:1538

/bin/drtcgitgkli
/bin/drtcgitgkli -d 1501
1⤵
- Deletes itself
PID:1543

/bin/pxxqjp
/bin/pxxqjp -d 1501
1⤵
- Deletes itself
PID:1541

/bin/hnsqzeqtl
/bin/hnsqzeqtl -d 1501
1⤵
- Deletes itself
PID:1547

/bin/jabitmagq
/bin/jabitmagq -d 1501
1⤵
- Deletes itself
PID:1550

/bin/krziptlvr
/bin/krziptlvr -d 1501
1⤵
- Deletes itself
PID:1557

/bin/tzizyosyey
/bin/tzizyosyey -d 1501
1⤵
- Deletes itself
PID:1555

/bin/sdeyvbdjmhmiym
/bin/sdeyvbdjmhmiym -d 1501
1⤵
- Deletes itself
PID:1553

/bin/wuidgses
/bin/wuidgses -d 1501
1⤵
- Deletes itself
PID:1562

/bin/xrfyrvqr
/bin/xrfyrvqr -d 1501
1⤵
- Deletes itself
PID:1564

/bin/porkcimpelqkb
/bin/porkcimpelqkb -d 1501
1⤵
- Deletes itself
PID:1568

/bin/tknhixutweg
/bin/tknhixutweg -d 1501
1⤵
- Deletes itself
PID:1570

/bin/mxevitjbglludr
/bin/mxevitjbglludr -d 1501
1⤵
- Deletes itself
PID:1573

/bin/tcjrxve
/bin/tcjrxve -d 1501
1⤵
- Deletes itself
PID:1576

/bin/ebyzzfixrf
/bin/ebyzzfixrf -d 1501
1⤵
- Deletes itself
PID:1580

/bin/rwepigcjfna
/bin/rwepigcjfna -d 1501
1⤵
- Deletes itself
PID:1583

/bin/nnadpjc
/bin/nnadpjc -d 1501
1⤵
- Deletes itself
PID:1586

/bin/ylgebmpfflpy
/bin/ylgebmpfflpy -d 1501
1⤵
- Deletes itself
PID:1588

/bin/npbrbiebzuq
/bin/npbrbiebzuq -d 1501
1⤵
- Deletes itself
PID:1590

/bin/zfldvjodppp
/bin/zfldvjodppp -d 1501
1⤵
- Deletes itself
PID:1595

/bin/arwmwkxpahtsdh
/bin/arwmwkxpahtsdh -d 1501
1⤵
- Deletes itself
PID:1598

/bin/fdlhdh
/bin/fdlhdh -d 1501
1⤵
- Deletes itself
PID:1600

/bin/iucgeawfjrxma
/bin/iucgeawfjrxma -d 1501
1⤵
- Deletes itself
PID:1606

/bin/efqxxfl
/bin/efqxxfl -d 1501
1⤵
- Deletes itself
PID:1604

/bin/uezbjjqpohpoo
/bin/uezbjjqpohpoo -d 1501
1⤵
- Deletes itself
PID:1608

/bin/kzquppvmc
/bin/kzquppvmc -d 1501
1⤵
- Deletes itself
PID:1615

/bin/bvwhcanzfr
/bin/bvwhcanzfr -d 1501
1⤵
- Deletes itself
PID:1617

/bin/qovsooqrxcqnzg
/bin/qovsooqrxcqnzg -d 1501
1⤵
- Deletes itself
PID:1619

/bin/usizvgveiwrjbl
/bin/usizvgveiwrjbl -d 1501
1⤵
- Deletes itself
PID:1623

/bin/wdmrwaiorfrj
/bin/wdmrwaiorfrj -d 1501
1⤵
- Deletes itself
PID:1627

/bin/adtiuefgi
/bin/adtiuefgi -d 1501
1⤵
- Deletes itself
PID:1630

/bin/uvyoordmyxegp
/bin/uvyoordmyxegp -d 1501
1⤵
- Deletes itself
PID:1632

/bin/kysvxavb
/bin/kysvxavb -d 1501
1⤵
- Deletes itself
PID:1636

/bin/fvaldkgkebk
/bin/fvaldkgkebk -d 1501
1⤵
- Deletes itself
PID:1639

/bin/rcxecuikloujh
/bin/rcxecuikloujh -d 1501
1⤵
- Deletes itself
PID:1641

/bin/qkhxrhldmpk
/bin/qkhxrhldmpk -d 1501
1⤵
- Deletes itself
PID:1648

/bin/grxfbzup
/bin/grxfbzup -d 1501
1⤵
- Deletes itself
PID:1651

/bin/wocqrhqbeprq
/bin/wocqrhqbeprq -d 1501
1⤵
- Deletes itself
PID:1653

/bin/kecnst
/bin/kecnst -d 1501
1⤵
- Deletes itself
PID:1656

/bin/pzrmhumbknzarr
/bin/pzrmhumbknzarr -d 1501
1⤵
- Deletes itself
PID:1660

/bin/bnwoynglyxx
/bin/bnwoynglyxx -d 1501
1⤵
- Deletes itself
PID:1663

/bin/jchmoiemvz
/bin/jchmoiemvz -d 1501
1⤵
- Deletes itself
PID:1665

/bin/cemjdmhfbdv
/bin/cemjdmhfbdv -d 1501
1⤵
- Deletes itself
PID:1668

/bin/qdmqbjzmsdvhr
/bin/qdmqbjzmsdvhr -d 1501
1⤵
- Deletes itself
PID:1672

/bin/fbkafqp
/bin/fbkafqp -d 1501
1⤵
- Deletes itself
PID:1674

/bin/pdsjzpzz
/bin/pdsjzpzz -d 1501
1⤵
- Deletes itself
PID:1678

/bin/fspoqwyn
/bin/fspoqwyn -d 1501
1⤵
- Deletes itself
PID:1680

/bin/etwttmhvoa
/bin/etwttmhvoa -d 1501
1⤵
- Deletes itself
PID:1684

/bin/qzpvtywixwv
/bin/qzpvtywixwv -d 1501
1⤵
- Deletes itself
PID:1686

/bin/qktigrwqxrotm
/bin/qktigrwqxrotm -d 1501
1⤵
- Deletes itself
PID:1689

/bin/entngubpvesgnb
/bin/entngubpvesgnb -d 1501
1⤵
- Deletes itself
PID:1693

/bin/pdcygloejkuu
/bin/pdcygloejkuu -d 1501
1⤵
- Deletes itself
PID:1695

/bin/mxrbqejngykmt
/bin/mxrbqejngykmt -d 1501
1⤵
- Deletes itself
PID:1697

/bin/buqqzvqggfmsp
/bin/buqqzvqggfmsp -d 1501
1⤵
- Deletes itself
PID:1702

/bin/mqranidfpm
/bin/mqranidfpm -d 1501
1⤵
PID:1705

/bin/mnlhzrlck
/bin/mnlhzrlck -d 1501
1⤵
PID:1708

/bin/sstahw
/bin/sstahw -d 1501
1⤵
PID:1713

/bin/uzmhegggbhxt
/bin/uzmhegggbhxt -d 1501
1⤵
PID:1711

/bin/ulxdnrqpbmo
/bin/ulxdnrqpbmo -d 1501
1⤵
PID:1717

/bin/oagshobkw
/bin/oagshobkw -d 1501
1⤵
PID:1720

/bin/rvkbfotw
/bin/rvkbfotw -d 1501
1⤵
PID:1725

/bin/igcrxtxtximrdp
/bin/igcrxtxtximrdp -d 1501
1⤵
PID:1727

/bin/duoxgkqd
/bin/duoxgkqd -d 1501
1⤵
PID:1731

/bin/tilmektoswgqrd
/bin/tilmektoswgqrd -d 1501
1⤵
PID:1734

/bin/oxkrolujbtr
/bin/oxkrolujbtr -d 1501
1⤵
PID:1737

/bin/msdzxcxveaqhm
/bin/msdzxcxveaqhm -d 1501
1⤵
PID:1740

/bin/vszluda
/bin/vszluda -d 1501
1⤵
PID:1743

/bin/psqoowoeec
/bin/psqoowoeec -d 1501
1⤵
PID:1748

/bin/ruedqdzjqt
/bin/ruedqdzjqt -d 1501
1⤵
PID:1746

/bin/yxvzjpelg
/bin/yxvzjpelg -d 1501
1⤵
PID:1751

/bin/yynsau
/bin/yynsau -d 1501
1⤵
PID:1757

/bin/dtnendbiqos
/bin/dtnendbiqos -d 1501
1⤵
PID:1755

/bin/brxhqlwt
/bin/brxhqlwt -d 1501
1⤵
PID:1760

/bin/fvkkqzoddslvi
/bin/fvkkqzoddslvi -d 1501
1⤵
PID:1764

/bin/jeqbgma
/bin/jeqbgma -d 1501
1⤵
PID:1767

/bin/jwasswsjnh
/bin/jwasswsjnh -d 1501
1⤵
PID:1771

/bin/bghzilierqmm
/bin/bghzilierqmm -d 1501
1⤵
PID:1774

/bin/hvlneewdgqve
/bin/hvlneewdgqve -d 1501
1⤵
PID:1777

/bin/erslsatti
/bin/erslsatti -d 1501
1⤵
PID:1779

/bin/bmxtylq
/bin/bmxtylq -d 1501
1⤵
PID:1783

/bin/nylirrcs
/bin/nylirrcs -d 1501
1⤵
PID:1786

/bin/ibafnkt
/bin/ibafnkt -d 1501
1⤵
PID:1788

/bin/pgjumwijkfzw
/bin/pgjumwijkfzw -d 1501
1⤵
PID:1791

/bin/jcbtvsvomfrmkf
/bin/jcbtvsvomfrmkf -d 1501
1⤵
PID:1795

/bin/fbolmiyiq
/bin/fbolmiyiq -d 1501
1⤵
PID:1797

/bin/tumkdcf
/bin/tumkdcf -d 1501
1⤵
PID:1803

/bin/fgujohlc
/bin/fgujohlc -d 1501
1⤵
PID:1801

/bin/gfajhlfx
/bin/gfajhlfx -d 1501
1⤵
PID:1807

/bin/jtqeayyj
/bin/jtqeayyj -d 1501
1⤵
PID:1809

/bin/ixrork
/bin/ixrork -d 1501
1⤵
PID:1813

/bin/ojctnapdynojv
/bin/ojctnapdynojv -d 1501
1⤵
PID:1816

/bin/mwnztt
/bin/mwnztt -d 1501
1⤵
PID:1819

/bin/ncrohcjamnoxqh
/bin/ncrohcjamnoxqh -d 1501
1⤵
- Writes file to system bin folder
PID:1821

/bin/sysrogclap
/bin/sysrogclap -d 1501
1⤵
- Writes file to system bin folder
PID:1824

/bin/pqdkpsnh
/bin/pqdkpsnh -d 1501
1⤵
- Writes file to system bin folder
PID:1828

/bin/pcbdyikyrnrb
/bin/pcbdyikyrnrb
1⤵
- Writes file to shm directory
PID:1842

/bin/rzkyunydhfbagp
/bin/rzkyunydhfbagp
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Writes file to system bin folder
- Writes file to shm directory
PID:1838

/bin/qxysgvztbqf
/bin/qxysgvztbqf
1⤵
- Writes file to shm directory
PID:1834

/bin/qllcbabksdtnmk
/bin/qllcbabksdtnmk
1⤵
- Writes file to shm directory
PID:1836

/bin/kepnnmwdqixxma
/bin/kepnnmwdqixxma
1⤵
- Writes file to shm directory
PID:1840

/bin/svmttisfghock
/bin/svmttisfghock -d 1844
1⤵
PID:1855

/bin/vlhrigrmvwhgjj
/bin/vlhrigrmvwhgjj -d 1844
1⤵
PID:1857

/bin/cdzoytwqaezoi
/bin/cdzoytwqaezoi -d 1844
1⤵
PID:1860

/bin/tcffmyp
/bin/tcffmyp -d 1844
1⤵
PID:1864

/bin/polwxxazcbqbw
/bin/polwxxazcbqbw -d 1844
1⤵
PID:1866

/bin/beqhcppma
/bin/beqhcppma -d 1844
1⤵
PID:1870

/bin/mzjgbotf
/bin/mzjgbotf -d 1844
1⤵
PID:1872

/bin/hcioawdkfdogjg
/bin/hcioawdkfdogjg -d 1844
1⤵
PID:1874

/bin/lvhyxizjk
/bin/lvhyxizjk -d 1844
1⤵
PID:1878

/bin/lzlqkusuit
/bin/lzlqkusuit -d 1844
1⤵
PID:1881

/bin/hwzcshxks
/bin/hwzcshxks -d 1844
1⤵
PID:1887

/bin/ncbkiizms
/bin/ncbkiizms -d 1844
1⤵
PID:1885

/bin/xujgrhqd
/bin/xujgrhqd -d 1844
1⤵
PID:1891

/bin/coqvxphpugjg
/bin/coqvxphpugjg -d 1844
1⤵
PID:1896

/bin/asgbdomedee
/bin/asgbdomedee -d 1844
1⤵
PID:1894

/bin/nohhdw
/bin/nohhdw -d 1844
1⤵
PID:1900

/bin/puhyrdblgyg
/bin/puhyrdblgyg -d 1844
1⤵
PID:1905

/bin/rizodehmsrk
/bin/rizodehmsrk -d 1844
1⤵
PID:1903

/bin/luqsxmnqw
/bin/luqsxmnqw -d 1844
1⤵
PID:1909

/bin/easnmme
/bin/easnmme -d 1844
1⤵
PID:1911

/bin/kjopuuycon
/bin/kjopuuycon -d 1844
1⤵
PID:1917

/bin/pbjoyt
/bin/pbjoyt -d 1844
1⤵
PID:1915

/bin/grietsch
/bin/grietsch -d 1844
1⤵
PID:1921

/bin/bzappdad
/bin/bzappdad -d 1844
1⤵
PID:1923

/bin/vhoewfyqdaesjm
/bin/vhoewfyqdaesjm -d 1844
1⤵
PID:1927

/bin/nnpugeulhite
/bin/nnpugeulhite -d 1844
1⤵
PID:1932

/bin/wrujwrxfgwcg
/bin/wrujwrxfgwcg -d 1844
1⤵
PID:1930

/bin/kwtqzrjuaflakt
/bin/kwtqzrjuaflakt -d 1844
1⤵
PID:1934

/bin/szdwjnuedwv
/bin/szdwjnuedwv -d 1844
1⤵
PID:1941

/bin/mbnbpcvvjr
/bin/mbnbpcvvjr -d 1844
1⤵
PID:1939

/bin/akqlmgi
/bin/akqlmgi -d 1844
1⤵
PID:1945

/bin/ugvcceexhj
/bin/ugvcceexhj -d 1844
1⤵
PID:1947

/bin/rqmswt
/bin/rqmswt -d 1844
1⤵
PID:1949

/bin/vqikok
/bin/vqikok -d 1844
1⤵
PID:1954

/bin/gxgofj
/bin/gxgofj -d 1844
1⤵
PID:1957

/bin/szzosv
/bin/szzosv -d 1844
1⤵
PID:1960

/bin/kxjfjjrevujanm
/bin/kxjfjjrevujanm -d 1844
1⤵
PID:1962

/bin/qybltpzmqrnr
/bin/qybltpzmqrnr -d 1844
1⤵
PID:1964

/bin/rsaomlpbxurxx
/bin/rsaomlpbxurxx -d 1844
1⤵
PID:1971

/bin/hmxrkgz
/bin/hmxrkgz -d 1844
1⤵
PID:1969

/bin/opvassritdcj
/bin/opvassritdcj -d 1844
1⤵
PID:1998

/bin/ykmaufgtofbm
/bin/ykmaufgtofbm -d 1844
1⤵
PID:2000

/bin/plufjlufl
/bin/plufjlufl -d 1844
1⤵
PID:2004

/bin/fxsibb
/bin/fxsibb -d 1844
1⤵
PID:2006

/bin/zmbziig
/bin/zmbziig -d 1844
1⤵
PID:2009

/bin/dnhrxjn
/bin/dnhrxjn -d 1844
1⤵
PID:2015

/bin/qgwxuc
/bin/qgwxuc -d 1844
1⤵
PID:2013

/bin/mtawptrwxwilre
/bin/mtawptrwxwilre -d 1844
1⤵
PID:2017

/bin/klcjhgfnupg
/bin/klcjhgfnupg -d 1844
1⤵
PID:2022

/bin/yvtbhocfdxxbuv
/bin/yvtbhocfdxxbuv -d 1844
1⤵
PID:2025

/bin/hcobbuyn
/bin/hcobbuyn -d 1844
1⤵
PID:2030

/bin/mqftdy
/bin/mqftdy -d 1844
1⤵
PID:2028

/bin/dgrxgz
/bin/dgrxgz -d 1844
1⤵
PID:2032

/bin/rypzenlb
/bin/rypzenlb -d 1844
1⤵
PID:2037

/bin/biuggz
/bin/biuggz -d 1844
1⤵
PID:2040

/bin/hgcfwqtgqoluq
/bin/hgcfwqtgqoluq -d 1844
1⤵
PID:2043

/bin/mufghkdmdurcz
/bin/mufghkdmdurcz -d 1844
1⤵
PID:2045

/bin/qftyja
/bin/qftyja -d 1844
1⤵
PID:2049

/bin/ztariooaffm
/bin/ztariooaffm -d 1844
1⤵
PID:2052

/bin/muizxueuoht
/bin/muizxueuoht -d 1844
1⤵
PID:2055

/bin/grgevraok
/bin/grgevraok -d 1844
1⤵
PID:2065

/bin/tircrv
/bin/tircrv -d 1844
1⤵
PID:2067

/bin/tiqkihwbps
/bin/tiqkihwbps -d 1844
1⤵
PID:2073

/bin/azswwoginavcnc
/bin/azswwoginavcnc -d 1844
1⤵
PID:2071

/bin/iucdvcenbbeh
/bin/iucdvcenbbeh -d 1844
1⤵
PID:2077

/bin/mmvobygctq
/bin/mmvobygctq -d 1844
1⤵
PID:2080

/bin/yyjfhwqy
/bin/yyjfhwqy -d 1844
1⤵
PID:2083

/bin/agmebfq
/bin/agmebfq -d 1844
1⤵
PID:2085

/bin/twpgjmwkmcof
/bin/twpgjmwkmcof -d 1844
1⤵
PID:2088

/bin/iftrkdqcbmeiyi
/bin/iftrkdqcbmeiyi -d 1844
1⤵
PID:2091

/bin/lgrfobixhdb
/bin/lgrfobixhdb -d 1844
1⤵
PID:2096

/bin/qiceaqi
/bin/qiceaqi -d 1844
1⤵
PID:2098

/bin/cptjfxscgxebfe
/bin/cptjfxscgxebfe -d 1844
1⤵
PID:2101

/bin/xtrhblktvmz
/bin/xtrhblktvmz -d 1844
1⤵
PID:2105

/bin/diahzts
/bin/diahzts -d 1844
1⤵
PID:2107

/bin/tdpewlytont
/bin/tdpewlytont -d 1844
1⤵
PID:2111

/bin/jiowwsg
/bin/jiowwsg -d 1844
1⤵
PID:2113

/bin/kikyspnmsx
/bin/kikyspnmsx -d 1844
1⤵
PID:2117

/bin/nchszuqsifneow
/bin/nchszuqsifneow -d 1844
1⤵
PID:2119

/bin/lumtjxdtxy
/bin/lumtjxdtxy -d 1844
1⤵
PID:2122

/bin/xhienfjww
/bin/xhienfjww -d 1844
1⤵
PID:2126

/bin/gaaxizuikgujwi
/bin/gaaxizuikgujwi -d 1844
1⤵
PID:2129

/bin/hfrnbl
/bin/hfrnbl -d 1844
1⤵
PID:2131

/bin/itqvabuxm
/bin/itqvabuxm -d 1844
1⤵
PID:2135

/bin/zmzjlwrwclf
/bin/zmzjlwrwclf -d 1844
1⤵
PID:2137

/bin/ihlswtzvf
/bin/ihlswtzvf -d 1844
1⤵
PID:2141

/bin/qzvdkexgye
/bin/qzvdkexgye -d 1844
1⤵
PID:2143

/bin/pvpqtiiyvt
/bin/pvpqtiiyvt -d 1844
1⤵
PID:2147

/bin/gabzbwfxogsrqy
/bin/gabzbwfxogsrqy -d 1844
1⤵
PID:2149

/bin/ywswlpndixlitg
/bin/ywswlpndixlitg -d 1844
1⤵
PID:2153

/bin/okvhqkgwzauf
/bin/okvhqkgwzauf -d 1844
1⤵
PID:2295

/bin/osyegynqtnb
/bin/osyegynqtnb -d 1844
1⤵
PID:2291

/bin/chsjzsulha
/bin/chsjzsulha -d 1844
1⤵
PID:2293

/bin/vszofckjlcsnwn
/bin/vszofckjlcsnwn -d 1844
1⤵
PID:2300

/bin/pdtaac
/bin/pdtaac -d 1844
1⤵
PID:2303

/bin/enarpy
/bin/enarpy -d 1844
1⤵
PID:2306

/bin/sxfxhmwnojgq
/bin/sxfxhmwnojgq -d 1844
1⤵
PID:2309

/bin/xbdrksymbsrovk
/bin/xbdrksymbsrovk -d 1844
1⤵
PID:2311

/bin/teyqlva
/bin/teyqlva -d 1844
1⤵
PID:2315

/bin/tnmewemrbou
/bin/tnmewemrbou -d 1844
1⤵
PID:2318

/bin/gyvtvqvokwb
/bin/gyvtvqvokwb -d 1844
1⤵
PID:2321

/bin/jdbrwqsqdvpmtq
/bin/jdbrwqsqdvpmtq -d 1844
1⤵
PID:2323

/bin/wvyobwkwucti
/bin/wvyobwkwucti -d 1844
1⤵
PID:2326

/bin/pljbpk
/bin/pljbpk -d 1844
1⤵
PID:2330

/bin/landfksrdjab
/bin/landfksrdjab -d 1844
1⤵
PID:2333

/bin/xocygmyqopohjx
/bin/xocygmyqopohjx -d 1844
1⤵
PID:2336

/bin/wxmknpiztuzv
/bin/wxmknpiztuzv -d 1844
1⤵
PID:2338

/bin/moicqijfgb
/bin/moicqijfgb -d 1844
1⤵
PID:2342

/bin/ypdhmcvk
/bin/ypdhmcvk -d 1844
1⤵
PID:2344

/bin/kuqzeruaqrmc
/bin/kuqzeruaqrmc -d 1844
1⤵
PID:2348

/bin/zktwaaxjxvzx
/bin/zktwaaxjxvzx -d 1844
1⤵
PID:2354

/bin/uofuvwd
/bin/uofuvwd -d 1844
1⤵
PID:2352

/bin/ndfdiecrnjn
/bin/ndfdiecrnjn -d 1844
1⤵
PID:2358

/bin/qiwmnjoxek
/bin/qiwmnjoxek -d 1844
1⤵
PID:2361

/bin/ghleemdl
/bin/ghleemdl -d 1844
1⤵
PID:2364

/bin/ctibxtu
/bin/ctibxtu -d 1844
1⤵
PID:2367

/bin/yogcnr
/bin/yogcnr -d 1844
1⤵
PID:2369

/bin/fkodgvzovziigb
/bin/fkodgvzovziigb -d 1844
1⤵
PID:2372

/bin/iudmuxg
/bin/iudmuxg -d 1844
1⤵
PID:2376

/bin/wazmrsizcyckt
/bin/wazmrsizcyckt -d 1844
1⤵
PID:2378

/bin/bkzambvdcwt
/bin/bkzambvdcwt -d 1844
1⤵
PID:2383

/bin/bfowsihghs
/bin/bfowsihghs -d 1844
1⤵
PID:2385

/bin/npnmixrmyb
/bin/npnmixrmyb -d 1844
1⤵
PID:2387

/bin/bnpwtrs
/bin/bnpwtrs -d 1844
1⤵
PID:2392

/bin/wtuslect
/bin/wtuslect -d 1844
1⤵
PID:2394

/bin/ajwjykfv
/bin/ajwjykfv -d 1844
1⤵
PID:2398

/bin/ljceujz
/bin/ljceujz -d 1844
1⤵
PID:2400

/bin/umkmdrigdgrb
/bin/umkmdrigdgrb -d 1844
1⤵
PID:2406

/bin/uordcq
/bin/uordcq -d 1844
1⤵
PID:2404

/bin/wyfkijqctrw
/bin/wyfkijqctrw -d 1844
1⤵
PID:2410

/bin/psihyetktx
/bin/psihyetktx -d 1844
1⤵
PID:2413

/bin/bfhhwkzvjght
/bin/bfhhwkzvjght -d 1844
1⤵
PID:2415

/bin/zvlrtazkvhrto
/bin/zvlrtazkvhrto -d 1844
1⤵
PID:2418

/bin/ghlmiqtrpf
/bin/ghlmiqtrpf -d 1844
1⤵
PID:2421

/bin/kozthrsec
/bin/kozthrsec -d 1844
1⤵
PID:2425

/bin/dfivjffagud
/bin/dfivjffagud -d 1844
1⤵
PID:2430

/bin/afsert
/bin/afsert -d 1844
1⤵
PID:2428

/bin/tyflitwczhr
/bin/tyflitwczhr -d 1844
1⤵
PID:2433

/bin/qqlwrus
/bin/qqlwrus -d 1844
1⤵
PID:2439

/bin/iygmraxvh
/bin/iygmraxvh -d 1844
1⤵
PID:2437

/bin/rakfwj
/bin/rakfwj -d 1844
1⤵
PID:2445

/bin/bnozivhanuye
/bin/bnozivhanuye -d 1844
1⤵
PID:2443

/bin/ydggwld
/bin/ydggwld -d 1844
1⤵
PID:2448

/bin/bpdodcyalyoizs
/bin/bpdodcyalyoizs -d 1844
1⤵
PID:2451

/bin/svizrtf
/bin/svizrtf -d 1844
1⤵
PID:2455

/bin/ruwrwimjuaq
/bin/ruwrwimjuaq -d 1844
1⤵
PID:2459

/bin/jvrssyfmezrpo
/bin/jvrssyfmezrpo -d 1844
1⤵
PID:2461

/bin/lwybzrvxisg
/bin/lwybzrvxisg -d 1844
1⤵
PID:2465

/bin/dcxvpgq
/bin/dcxvpgq -d 1844
1⤵
PID:2467

/bin/ajhfxneoe
/bin/ajhfxneoe -d 1844
1⤵
PID:2470

/bin/awdfdzptxskv
/bin/awdfdzptxskv -d 1844
1⤵
PID:2476

/bin/yduxaawfxxnue
/bin/yduxaawfxxnue -d 1844
1⤵
PID:2474

/bin/subisgerhfno
/bin/subisgerhfno -d 1844
1⤵
PID:2479

/bin/nbytfarji
/bin/nbytfarji -d 1844
1⤵
PID:2483

/bin/kxohqafaszdcrj
/bin/kxohqafaszdcrj -d 1844
1⤵
PID:2485

/bin/cwfpofzhzuy
/bin/cwfpofzhzuy -d 1844
1⤵
PID:2489

/bin/azbjrmrnj
/bin/azbjrmrnj -d 1844
1⤵
PID:2491

/bin/fabnakoxmkeda
/bin/fabnakoxmkeda -d 1844
1⤵
PID:2495

/bin/einaiuahyly
/bin/einaiuahyly -d 1844
1⤵
PID:2498

/bin/cnxqtcqwsq
/bin/cnxqtcqwsq -d 1844
1⤵
PID:2501

/bin/suljgjadjnhg
/bin/suljgjadjnhg -d 1844
1⤵
PID:2507

/bin/zojprygssze
/bin/zojprygssze -d 1844
1⤵
PID:2505

/bin/iwcooxizgpkju
/bin/iwcooxizgpkju -d 1844
1⤵
PID:2513

/bin/aebcisdxduqb
/bin/aebcisdxduqb -d 1844
1⤵
PID:2511

/bin/wdajfe
/bin/wdajfe -d 1844
1⤵
PID:2515

/bin/flpvwelvea
/bin/flpvwelvea -d 1844
1⤵
PID:2522

/bin/zygdnyp
/bin/zygdnyp -d 1844
1⤵
PID:2520

/bin/ibblguorxzqy
/bin/ibblguorxzqy -d 1844
1⤵
PID:2525

/bin/qecderljeafc
/bin/qecderljeafc -d 1844
1⤵
PID:2529

/bin/qxkshvulic
/bin/qxkshvulic -d 1844
1⤵
PID:2532

/bin/ajjxxodcerc
/bin/ajjxxodcerc -d 1844
1⤵
PID:2538

/bin/tfjkamjgccxhq
/bin/tfjkamjgccxhq -d 1844
1⤵
PID:2536

/bin/oiocgjjptl
/bin/oiocgjjptl -d 1844
1⤵
PID:2542

/bin/crfepoxaogmnfa
/bin/crfepoxaogmnfa -d 1844
1⤵
PID:2544

/bin/filfyuvaaemryx
/bin/filfyuvaaemryx -d 1844
1⤵
PID:2548

/bin/xgjlhlj
/bin/xgjlhlj -d 1844
1⤵
PID:2553

/bin/bkihcdjiphco
/bin/bkihcdjiphco -d 1844
1⤵
PID:2551

/bin/pmsang
/bin/pmsang -d 1844
1⤵
PID:2556

/bin/zoeayojarulgb
/bin/zoeayojarulgb -d 1844
1⤵
PID:2560

/bin/wckcnxjbjpqv
/bin/wckcnxjbjpqv -d 1844
1⤵
PID:2563

/bin/wouufdrzzriscs
/bin/wouufdrzzriscs -d 1844
1⤵
PID:2566

/bin/esrtobx
/bin/esrtobx -d 1844
1⤵
PID:2568

/bin/vmtaez
/bin/vmtaez -d 1844
1⤵
PID:2572

/bin/fxpctx
/bin/fxpctx -d 1844
1⤵
PID:2574

/bin/lwgegyiysmsm
/bin/lwgegyiysmsm -d 1844
1⤵
PID:2578

/bin/icqvaxzixjgqva
/bin/icqvaxzixjgqva -d 1844
1⤵
PID:2581

/bin/dgtkcgbqu
/bin/dgtkcgbqu -d 1844
1⤵
PID:2583

/bin/gkfusqcwhzzgyh
/bin/gkfusqcwhzzgyh -d 1844
1⤵
PID:2587

/bin/jqvfqzkzvub
/bin/jqvfqzkzvub -d 1844
1⤵
PID:2589

/bin/xrzxzkfuevyaey
/bin/xrzxzkfuevyaey -d 1844
1⤵
PID:2593

/bin/kvrpslorm
/bin/kvrpslorm -d 1844
1⤵
PID:2599

/bin/yjqizlprnb
/bin/yjqizlprnb -d 1844
1⤵
PID:2597

/bin/rbrqogkbhaneuc
/bin/rbrqogkbhaneuc -d 1844
1⤵
PID:2605

/bin/yieuhhahgl
/bin/yieuhhahgl -d 1844
1⤵
PID:2601

/bin/hrqtto
/bin/hrqtto -d 1844
1⤵
PID:2609

/bin/isytgnvm
/bin/isytgnvm -d 1844
1⤵
PID:2614

/bin/qgionf
/bin/qgionf -d 1844
1⤵
PID:2616

/bin/zrowgpiba
/bin/zrowgpiba -d 1844
1⤵
PID:2612

/bin/dzitshmggv
/bin/dzitshmggv -d 1844
1⤵
PID:2621

/bin/owygeqgxyv
/bin/owygeqgxyv -d 1844
1⤵
PID:2624

/bin/jxenhykargpgp
/bin/jxenhykargpgp -d 1844
1⤵
PID:2629

/bin/vfvebcu
/bin/vfvebcu -d 1844
1⤵
PID:2627

/bin/aeijeumxabdpx
/bin/aeijeumxabdpx -d 1844
1⤵
PID:2635

/bin/hqbkbp
/bin/hqbkbp -d 1844
1⤵
PID:2633

/bin/hyxipegbjli
/bin/hyxipegbjli -d 1844
1⤵
PID:2639

/bin/mfhtvlxuazyw
/bin/mfhtvlxuazyw -d 1844
1⤵
PID:2644

/bin/owaosxfuzjsd
/bin/owaosxfuzjsd -d 1844
1⤵
PID:2646

/bin/aacxdgvtfc
/bin/aacxdgvtfc -d 1844
1⤵
PID:2642

/bin/pwuryiwf
/bin/pwuryiwf -d 1844
1⤵
PID:2650

/bin/scqsbrrn
/bin/scqsbrrn -d 1844
1⤵
PID:2653

/bin/ymesevwjo
/bin/ymesevwjo -d 1844
1⤵
PID:2718

/bin/hsprgslhdekdme
/bin/hsprgslhdekdme -d 1844
1⤵
PID:2720

/bin/xxdohpovwgc
/bin/xxdohpovwgc -d 1844
1⤵
PID:2724

/bin/elhjuzzogt
/bin/elhjuzzogt -d 1844
1⤵
PID:2727

/bin/pwdczqglpgqfpi
/bin/pwdczqglpgqfpi -d 1844
1⤵
PID:2730

/bin/fjxlthbtb
/bin/fjxlthbtb -d 1844
1⤵
PID:2877

/bin/zcmnjdsnrsbfhi
/bin/zcmnjdsnrsbfhi -d 1844
1⤵
PID:2880

/bin/rornvvufu
/bin/rornvvufu -d 1844
1⤵
PID:2883

/bin/ycitdit
/bin/ycitdit -d 1844
1⤵
PID:2886

/bin/wirccetwhaeppv
/bin/wirccetwhaeppv -d 1844
1⤵
PID:2888

/bin/slpfutpq
/bin/slpfutpq -d 1844
1⤵
PID:2920

/bin/esndha
/bin/esndha -d 1844
1⤵
PID:2922

/bin/qqzkxwxck
/bin/qqzkxwxck -d 1844
1⤵
PID:2925

/bin/ktntiggxlaratu
/bin/ktntiggxlaratu -d 1844
1⤵
PID:2928

/bin/nhkwiunawzxuza
/bin/nhkwiunawzxuza -d 1844
1⤵
PID:2931

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/bin/kepnnmwdqixxma

Filesize
544KB

MD5
572ecc952cb7aa04d8e0a90beefa61cc

SHA1
e7a63ba5e61f41e9bd2d935a042fa1016992ec90

SHA256
26e61a23af7cb07bffeb7039b740bbfa95c0248b0afc5f72c892c31991548b0b

SHA512
ccf9cbd4cfc7d6c2f3c1e2e18577bfa0e6e14f9234bf2f3920584f503d3c08b4fe6b3746368c9da8df31d33488f438afbd615d9d36dd1addd7053ef5d75ece1b

Download Submit
/bin/pcbdyikyrnrb

Filesize
544KB

MD5
44a2316aced2e0809f2d1f207d2cb2b5

SHA1
1ab15d537bb88f5244005c811615806a9795aa23

SHA256
c135c1109fa467e32f948af200b6928e40bb0973556ea4c9057a758a8cf8a889

SHA512
9862ecfb14400eafb8110386bb6027b99cb7cc5edb5921c7042cbef3a37f461ec2b8b212df25259e0cff9563a723e30a80a8390456716a1f9b29bca3d4929f1e

Download Submit
/bin/qllcbabksdtnmk

Filesize
544KB

MD5
8ea99d814d678a5ba5bbf8071207d593

SHA1
317810fc4e3218a50087b51cd324eadf31e5ff1f

SHA256
d1ed730f6747358e2bdfeb67c9be79eb410758a5beff648fb30aece32c0d42cd

SHA512
79eac2fc1fa875341d4593d4e5e88768f43e321ec709c56bbc56447ea9e6d5682aea7647064c402779422d4493afbd0bcb83c32700c8b75d88b67f70493fd8b5

Download Submit
/bin/qxysgvztbqf

Filesize
544KB

MD5
1bee584eaf65d3788907ebbaf3e4f964

SHA1
0e34624c1f4903c0a9b603f8b92024b497f37a26

SHA256
b76a9f6e96c490e74fa8dd83b2c74c0f7a60ca1eca2278cc9a589d8a0ede8aa9

SHA512
21210abf6093cbae279ca7f10c635c0e92404bcdc83127d673d40581acb16c8ae5bb9546df04f524270990ba7258d8bdfb687855eb4fa15c45133a41e44ee55f

Download Submit
/bin/rzkyunydhfbagp

Filesize
544KB

MD5
cfe8aed5ac1832cac8fef7fe588a3122

SHA1
6b2aba001b76a826343b3723ddb41e6bf9d66a75

SHA256
8a8515b5a27dcdeac2c7be38871fd94c4452447378d6ccb1f3c0e3f7300fa439

SHA512
01cc1c80a130470ba7da56d6358dcf172dba5a083804b0a837b070e3ca6c2e527e986778878b5138e6e0ee29d91724a4d015059476ce1bc8fa81e1884c3acc61

Download Submit
/dev/shm/sem.S3bKBi

Filesize
16B

MD5
076933ff9904d1110d896e2c525e39e5

SHA1
4188442577fa77f25820d9b2d01cc446e30684ac

SHA256
4cbbd8ca5215b8d161aec181a74b694f4e24b001d5b081dc0030ed797a8973e0

SHA512
6fcee9a7b7a7b821d241c03c82377928bc6882e7a08c78a4221199bfa220cdc55212273018ee613317c8293bb8d1ce08d1e017508e94e06ab85a734c99c7cc34

Download Submit
/etc/cron.hourly/pgabfhdynuykzr.sh

Filesize
151B

MD5
632742ba70c8421d6274e98cc222c686

SHA1
3237b92f9782ffae7c8a632236b856cb109ce455

SHA256
f2b2ba5d3c8f8aa62e7922831aeb225c411f1f670580e8900a6538a784cdd4b0

SHA512
530dc4b32af5aadd5a67fd2ea7cf74ec1d74639bbac17aa6e8371cbdb5446bd4227d60978fd892377001ccace5e5c2a4352ebfb76f3439090790d5ae1b1636e0

Download Submit
/etc/cron.hourly/qeytaecgypnmdm.sh

Filesize
151B

MD5
3449534429c87151b29efbcfb8273fa6

SHA1
003eecd9425486249af0ee7622f22bad8d25e3ce

SHA256
acbaae1ce315d55e2749385e03386167f35d7fee5697eedc7feeb81fe30f23de

SHA512
1ad50fd9dd87148fbfa85c1170f96d497760c29c0e51c10f4bcc5ffdabb947db8e93307f79cca29ae591f21fe9f425a1c8745a080569de3fa53ee56877c2eec2

Download Submit
/etc/daemon.cfg

Filesize
32B

MD5
771f3346d1f54bf2e4379837391313df

SHA1
6c27c322b628e615b5cbd048df62f4ecea395a29

SHA256
6d89d1c3fbd33da101b403567aa8675043a83b3fed32bffb2b973623fb74348a

SHA512
c0f0e8507bb30f76d439ba6199587edcba3ebc97efdf3c8997f05c9a19b836e9601cbdd4790fa0a2631abea182d57c564a9371533362ba5bc38ee0a6e18108d7

Download Submit
/etc/init.d/pgabfhdynuykzr

Filesize
358B

MD5
b33646fcb26058442fec1f35145c2b50

SHA1
0035d1171ffa0933ff62d7df5b0b0a29c9ec390c

SHA256
a10d76cfc79ff1cbf07f97d9e2a289f143aea03e62fc27b0d0b589f4944be473

SHA512
7d0f88e2756e7db3898ac2bb9b29051e475d1d0a9337c6c08ebdd90fd97aefcd040f77668eea143bcd153bdfc8c253d5a141f34d8b2a8c8e4f0308477ec37c01

Download Submit
/etc/init.d/qeytaecgypnmdm

Filesize
358B

MD5
748dcd1f19fb850730db87eef1688ca2

SHA1
a05af553e88c6d9a372fd7e9c6c763ed1fc114a2

SHA256
35de86fe6a71b637072b088f021c94acc222f963cb3935a2837752a51f74f27f

SHA512
df53238793b7ef1250456eac5054c3605c44c55af923d92cbe97d43330cfcc79e17f2a172ea215f75abfd5e4e81b4f20ab69b66d327787430a00e449dbc00948

Download Submit
/tmp/qeytaecgypnmdm

Filesize
544KB

MD5
f44ae424e83e10004380f6aadceebb15

SHA1
173c9062c3326d4940cf7b6cc70c1a750dda2a49

SHA256
a89c8ef292c00472850398e72e2bfa6beb9e5e460d52863faf6cefa7c6d723f5

SHA512
e05aca5a978932c4b842e04d77c717e88a82fae00e99edb7ed7c2569fbdc9b1dc70a812c21b386f3ee1535a799296e6ecbcda15d0a5e9e73afcfcff6c47bd326

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads