Resubmissions

25/06/2026, 09:19

260625-lajphaay3q10

25/09/2025, 14:52

250925-r8xa5sbn6z10

General

  • Target
    d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81.bin
  • Size 9.6MB
  • Sample260625-lajphaay3q
  • SHA256 d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: FireWood

    FireWood is a backdoor that shares similarities with ProjectWood malware.

  • Detects FireWood Payload 1 IoCs

File Explorer

  • d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81.bin
    .zip 9.6MB
  • etc/init.d/dlump
    .sh 30B
  • etc/ld.so.preload
    22B
  • etc/rc.d/rc1.d/S60dlump
    .sh 30B
  • etc/rc.d/rc2.d/S60dlump
    .sh 30B
  • etc/rc.d/rc3.d/S60dlump
    .sh 30B
  • etc/rc.d/rc4.d/S60dlump
    .sh 30B
  • etc/rc.d/rc5.d/S60dlump
    .sh 30B
  • home/www/.Xl1/ccc
    .elf 8KB
  • home/www/.Xl1/conf
    1KB
  • home/www/.Xl1/data/gphoto2
    3.3MB
  • home/www/.Xl1/data/icuio
    136KB
  • home/www/.Xl1/f1
    4B
  • home/www/.Xl1/f2
    4B
  • home/www/.Xl1/kde
    .elf 123KB
  • home/www/.Xl1/list
    128B
  • home/www/.Xl1/udevd
    .elf 3.4MB
  • home/www/.bashrc
    174B
  • home/www/.profile.sh
    .sh 45B
  • home/www/tomcat/webapps/WEB-INF/attache_temp/a.jsp
    .js 2KB
  • home/www/tomcat/webapps/img/yy1.jsp
    .js 57KB
  • home/www/tomcat/webapps/login.jsp
    .js 1KB
  • usr/bin/.Xl1/conf
    1KB
  • usr/bin/.Xl1/data/gphoto2
    3.3MB
  • usr/bin/.Xl1/data/icuio
    136KB
  • usr/bin/.Xl1/f1
    4B
  • usr/bin/.Xl1/f2
    4B
  • usr/bin/.Xl1/kde
    .elf 123KB
  • usr/bin/.Xl1/list
    128B
  • usr/bin/.Xl1/udevd
    .elf 3.4MB
  • usr/lib/libselinux.so
    .elf 22KB
  • usr/lib64/gdm/.gdm/dbus
    .elf 190KB
  • usr/lib64/gdm/.gdm/kdeinit
    904B
  • usr/lib64/gdm/.gdm/pid
    6B

d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81.bin

  • SHA256 d17a1b1f15b6a8f2d1ef92c81ea0b3d4c95ffe3fc97f4000cb77e8c625ed4e81
  • MD5 SHA1 SHA512 SSDEEP TLSH