firewood | d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81 | Triage™

Login
Reports

Overview

overview

Static

static

etc/init.d/dlump

ubuntu-18.04-amd64

etc/init.d/dlump

debian-9-armhf

etc/init.d/dlump

debian-9-mips

etc/init.d/dlump

debian-9-mipsel

etc/rc.d/r...0dlump

ubuntu-18.04-amd64

etc/rc.d/r...0dlump

debian-9-armhf

etc/rc.d/r...0dlump

debian-9-mips

etc/rc.d/r...0dlump

debian-9-mipsel

etc/rc.d/r...0dlump

ubuntu-18.04-amd64

etc/rc.d/r...0dlump

debian-9-armhf

etc/rc.d/r...0dlump

debian-9-mips

etc/rc.d/r...0dlump

debian-9-mipsel

etc/rc.d/r...0dlump

ubuntu-18.04-amd64

etc/rc.d/r...0dlump

debian-9-armhf

etc/rc.d/r...0dlump

debian-9-mips

etc/rc.d/r...0dlump

debian-9-mipsel

etc/rc.d/r...0dlump

ubuntu-18.04-amd64

etc/rc.d/r...0dlump

debian-9-armhf

etc/rc.d/r...0dlump

debian-9-mips

etc/rc.d/r...0dlump

debian-9-mipsel

etc/rc.d/r...0dlump

ubuntu-18.04-amd64

etc/rc.d/r...0dlump

debian-9-armhf

etc/rc.d/r...0dlump

debian-9-mips

etc/rc.d/r...0dlump

debian-9-mipsel

home/www/.Xl1/ccc

ubuntu-18.04-amd64

1

home/www/.Xl1/kde

ubuntu-18.04-amd64

6

home/www/.Xl1/udevd

ubuntu-18.04-amd64

7

home/www/.profile.sh

ubuntu-18.04-amd64

home/www/.profile.sh

debian-9-armhf

home/www/.profile.sh

debian-9-mips

home/www/.profile.sh

debian-9-mipsel

home/www/t...p/a.js

windows10-2004-x64

3

Resubmissions

25/06/2026, 09:19

260625-lajphaay3q10

25/09/2025, 14:52

250925-r8xa5sbn6z10

Sharing

Copy URL Twitter E-mail

General

Target
d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81.bin
Size 9.6MB
Sample260625-lajphaay3q
SHA256 d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81
MD5 ecc96e25a5700cedaedcbe553142ab80
SHA1 843d6b0054d066845628e2d5db95201b20e12cd2
SHA512 01bfef39d7277c1995f6e5ea11401201882d5763ad6088c582c5951ed4167fb64e744863fed00965e073acd2d0619e96f7896127ef750fe655475e9207ba9c29
SSDEEP 196608:SEhlwnz+BdrV2qKcTz362WdEhlwnz+BdrV2GKcTz362WT:9lwz+BdhacTT5nlwz+Bdh0cTT5G
TLSH
T1B4A6332083B6B451FFF90C7B43D45D1103229B83B187D626645616A1ECA7EEF0899EFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

firewood gelsemium apt backdoor discovery execution linux persistence

Static task

static1

2 signatures

backdoor apt gelsemium firewood

Behavioral task

behavioral1

Sample

etc/init.d/dlump

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

etc/init.d/dlump

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

etc/init.d/dlump

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

etc/init.d/dlump

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

etc/rc.d/rc1.d/S60dlump

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

etc/rc.d/rc1.d/S60dlump

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

etc/rc.d/rc1.d/S60dlump

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

etc/rc.d/rc1.d/S60dlump

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

etc/rc.d/rc2.d/S60dlump

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

etc/rc.d/rc2.d/S60dlump

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

etc/rc.d/rc2.d/S60dlump

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

etc/rc.d/rc2.d/S60dlump

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

etc/rc.d/rc3.d/S60dlump

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

etc/rc.d/rc3.d/S60dlump

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

etc/rc.d/rc3.d/S60dlump

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

etc/rc.d/rc3.d/S60dlump

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

etc/rc.d/rc4.d/S60dlump

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

etc/rc.d/rc4.d/S60dlump

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

etc/rc.d/rc4.d/S60dlump

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

etc/rc.d/rc4.d/S60dlump

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

etc/rc.d/rc5.d/S60dlump

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

etc/rc.d/rc5.d/S60dlump

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

etc/rc.d/rc5.d/S60dlump

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

etc/rc.d/rc5.d/S60dlump

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

home/www/.Xl1/ccc

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

home/www/.Xl1/kde

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

home/www/.Xl1/udevd

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

4 signatures

150 seconds

discovery persistence

Behavioral task

behavioral28

Sample

home/www/.profile.sh

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

home/www/.profile.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

home/www/.profile.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

home/www/.profile.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

home/www/tomcat/webapps/WEB-INF/attache_temp/a.js

Resource

win10v2004-20260513-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  etc/init.d/dlump
- Size 30B
- SHA256 bdd986bd1e3202772113fb79f8885598ea109cfacab9372a70bfca60aad69d65
- MD5 c4be6d26325eaf0454e93f5b2400146a
- SHA1 552675a89bd1420dae70b6c27458b754ee55cd01
- SHA512 ee29d892ed110027450d6a9a54fc1ab2f6bdebff5f592317e2b62c732ccf2786cc3e16d9c6cb7087ae46b6e81929300be51ce1ddd867bb9b507d1b72d04aa07a
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  etc/rc.d/rc1.d/S60dlump
- Size 30B
- SHA256 bdd986bd1e3202772113fb79f8885598ea109cfacab9372a70bfca60aad69d65
- MD5 c4be6d26325eaf0454e93f5b2400146a
- SHA1 552675a89bd1420dae70b6c27458b754ee55cd01
- SHA512 ee29d892ed110027450d6a9a54fc1ab2f6bdebff5f592317e2b62c732ccf2786cc3e16d9c6cb7087ae46b6e81929300be51ce1ddd867bb9b507d1b72d04aa07a
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  etc/rc.d/rc2.d/S60dlump
- Size 30B
- SHA256 bdd986bd1e3202772113fb79f8885598ea109cfacab9372a70bfca60aad69d65
- MD5 c4be6d26325eaf0454e93f5b2400146a
- SHA1 552675a89bd1420dae70b6c27458b754ee55cd01
- SHA512 ee29d892ed110027450d6a9a54fc1ab2f6bdebff5f592317e2b62c732ccf2786cc3e16d9c6cb7087ae46b6e81929300be51ce1ddd867bb9b507d1b72d04aa07a
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  etc/rc.d/rc3.d/S60dlump
- Size 30B
- SHA256 bdd986bd1e3202772113fb79f8885598ea109cfacab9372a70bfca60aad69d65
- MD5 c4be6d26325eaf0454e93f5b2400146a
- SHA1 552675a89bd1420dae70b6c27458b754ee55cd01
- SHA512 ee29d892ed110027450d6a9a54fc1ab2f6bdebff5f592317e2b62c732ccf2786cc3e16d9c6cb7087ae46b6e81929300be51ce1ddd867bb9b507d1b72d04aa07a
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  etc/rc.d/rc4.d/S60dlump
- Size 30B
- SHA256 bdd986bd1e3202772113fb79f8885598ea109cfacab9372a70bfca60aad69d65
- MD5 c4be6d26325eaf0454e93f5b2400146a
- SHA1 552675a89bd1420dae70b6c27458b754ee55cd01
- SHA512 ee29d892ed110027450d6a9a54fc1ab2f6bdebff5f592317e2b62c732ccf2786cc3e16d9c6cb7087ae46b6e81929300be51ce1ddd867bb9b507d1b72d04aa07a
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  etc/rc.d/rc5.d/S60dlump
- Size 30B
- SHA256 bdd986bd1e3202772113fb79f8885598ea109cfacab9372a70bfca60aad69d65
- MD5 c4be6d26325eaf0454e93f5b2400146a
- SHA1 552675a89bd1420dae70b6c27458b754ee55cd01
- SHA512 ee29d892ed110027450d6a9a54fc1ab2f6bdebff5f592317e2b62c732ccf2786cc3e16d9c6cb7087ae46b6e81929300be51ce1ddd867bb9b507d1b72d04aa07a
- MD5 SHA1 SHA512
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  home/www/.Xl1/ccc
- Size 8KB
- SHA256 c26d239f415bec27125862acafdeac267be398bc9208e27f09217dc8ecf64225
- MD5 5789e8b1a31d7117b05143cec4a85378
- SHA1 209c4994a42af7832f526e09238fb55d5aab34e5
- SHA512 5ab5798811c6b83e2d85cdb1ad2b6bdbf2981f9381159eb2038203254e3ac8775477792400645e250fcba62598c47c31a82a599e439be057b8f400dd3e278820
- SSDEEP 96:GFTxGzOqifdFb+zboSSR+Whu47J2lyIAf7QTa4B2woB9x:GFV0QFKzboS0fCnoF
- TLSH
  T130020E87F7E08E6BCCA8537D449B033572B3E472835383171A06A6751E43BD51F6A5C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  home/www/.Xl1/kde
- Size 123KB
- SHA256 1ec286f2194199206e4ce345f1bf322b6b0b4c947b1cf32db59cca2d89370738
- MD5 87e437cf74ce4b1330b8af9ff71edae2
- SHA1 8532eca04c0f58172d80d8a446ae33907d509377
- SHA512 856a3140d54ec86f8cdac4b35f7a2266c800f75cbbcf075650e75fbc6e5f4e104c231aafecd8658a061439395a1131a5e2f075e1051550117fed6c3db8eb1446
- SSDEEP 3072:oKV6YwUaoJwfg+uKsdzUNtklICvOqAXby0:oKwYwUaEwfY+kI3Xu0
- TLSH
  T1DBC33A0376474C78C4DB8F7401FF947A9562787EC931271EA5A0DB26189BF48AF1EB82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Write file to user bin folder
  persistence
behavioral26
- Target
  home/www/.Xl1/udevd
- Size 3.4MB
- SHA256 ccf8e4d6e661ceaea598851923bb8b983bd820ffd02448b8245e6ac780977784
- MD5 1418fe9a743226b9661a2b6decb19db0
- SHA1 0ab53321bb9699d354a032259423175c08fec1a4
- SHA512 548cedaa7e100ca49800878a164989fabe101c58d3dea316efe13b368b18e00899664167b533c3556d6e82697677529cbd1e73cdd87aacac87c12363322042a4
- SSDEEP 98304:UdgXuBCAPGHGXqiCz6eH+USFUFJYX25Ot:OPmhSWYL
- TLSH
  T1F1F57E5BB96A446DC4EEC730866FC6765930B45C87212F6B3090E6302D53F686F1EBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Write file to user bin folder
  persistence
behavioral27
- Target
  home/www/.profile.sh
- Size 45B
- SHA256 83a9d271c5d7f7bc8a1582348897674047aeb242c4457274bd241293201303be
- MD5 c6bc4e21447f4d69306d2aa2a4712c0f
- SHA1 b6ffbe6b788432215d3ce22a4f6c4a1dbe64721b
- SHA512 199f63623155c91777a4a0c4c09160dddedb26b1b3c47a86e0e6a9240422ffd5dfd6babcc00b15a869e292711bf0dd9350d6b95d04b02ecebcfb1d6f9c518f45
- MD5 SHA1 SHA512
Score

1^/10
behavioral28 behavioral29 behavioral30 behavioral31
- Target
  home/www/tomcat/webapps/WEB-INF/attache_temp/a.jsp
- Size 2KB
- SHA256 d2e1ee14a424bf350d263ff68561e18da88c68db54d02a7f277a70d1a68c75aa
- MD5 7e811bb05983460dcacfffa60adaeaaa
- SHA1 fd601a54bc622c041df0242662964a7ed31c6b9c
- SHA512 9ef0ef2d5a70bd46cf7eb4e66a51ac74c7c3e949a0e75decf74430d4953da5d266f3abbd11a19e3f1e04cb1a854e8d08353179241b2d392301fcd617dc31eb9f
- TLSH
  T10E51D06A47E61DFC9A335A021E778824F1759873218BF826F70FB944DF5C0F163902AA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

backdooraptgelsemiumfirewood

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

discoverypersistence

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy