80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
Size 74KB
Sample260820-dfapsadp9z
SHA256 80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4
MD5 548130fffb462075da54f3a55a6b0fe7
SHA1 fec51cbc625fc727b79a39e8d5854bffafd9cc99
SHA512 818650354cdf2c97257a5f39807d6628925b80fe328492edf3da33b80a55a5fe7504482f523ff0f73482455c39ed09865253002277527e70b636ff379610450c
SSDEEP 1536:WHiD82bcJMcC3juaGVEaycX/EmkJd7YRPv81c1Oi+Zr7dTZb6VJu8:WHiD8rJMczaGVmcXRv31Oi+Zr736VQ8
TLSH
T1697301AA184315EED4F5667423CE876ABF168952F513FC0E58C0BE478952036E903EA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Deletes itself 1 IoCs

pid	Process
722	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Deletes system logs 1 TTPs 4 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/messages	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/syslog	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File truncated	/var/log/syslog	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/messages	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Deletes log files 1 TTPs 12 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/kern.log	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/wtmp	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File truncated	/var/log/wtmp	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/btmp	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File truncated	/var/log/btmp	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File truncated	/var/log/lastlog	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/faillog	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/auth.log	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File truncated	/var/log/auth.log	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/lastlog	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File truncated	/var/log/faillog	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File deleted	/var/log/kern.log	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	722	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
Changes the process name, possibly in an attempt to hide itself	kworker/0:0	736	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/net/tcp6	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/7/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/11/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/18/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/251/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/716/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/74/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/21/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/718/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/736/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/82/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/77/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/724/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/739/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/740/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/16/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/37/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/680/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/335/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/753/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/127/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/160/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/37/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/671/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/675/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/36/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/75/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/382/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/671/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/20/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/335/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/82/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/712/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/738/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/3/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/678/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/723/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/809/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/73/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/337/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/self/maps	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/76/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/342/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/72/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/160/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/341/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/707/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/753/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/13/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/17/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/69/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/72/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/71/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/718/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/729/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/737/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/19/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/712/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/21/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/36/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/768/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/12/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/678/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/707/comm	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
File opened for reading	/proc/11/cmdline	80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf

/tmp/80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
/tmp/80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4.elf
1⤵
- Deletes Audit logs
- Deletes itself
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Enumerates active TCP sockets
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:716
- /sbin/iptables
  iptables -w -D INPUT -j LOCKER_INPUT
  2⤵
  PID:727
- /sbin/iptables
  iptables -w -X LOCKER_INPUT
  2⤵
  PID:734
- /sbin/iptables
  iptables --version
  2⤵
  PID:741
- /sbin/iptables
  iptables -w -N LOCKER_INPUT
  2⤵
  PID:743
- /sbin/iptables
  iptables -w -C INPUT -j LOCKER_INPUT
  2⤵
  PID:746
- /sbin/iptables
  iptables -w -I INPUT -j LOCKER_INPUT
  2⤵
  PID:748
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 22 -j DROP
  2⤵
  PID:750
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 23 -j DROP
  2⤵
  PID:757
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 2323 -j DROP
  2⤵
  PID:758
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 21 -j DROP
  2⤵
  PID:760
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5900 -j DROP
  2⤵
  PID:762
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 3389 -j DROP
  2⤵
  PID:763
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5901 -j DROP
  2⤵
  PID:765
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5902 -j DROP
  2⤵
  PID:767
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5800 -j DROP
  2⤵
  PID:769
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5801 -j DROP
  2⤵
  PID:770
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 2222 -j DROP
  2⤵
  PID:771
- /sbin/iptables
  iptables --version
  2⤵
  PID:777

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.disabled.list

Path /run/.disabled.list
Size 14B
SHA256 b3b4bc539eea47e08c2e2edf6c248844696e3eae3ce03dce9dd2e859f7267621
MD5 e6265a2aeb179498cca95ff510cd39de
SHA1 19c6f358af2a0586855ece0b6d19a13530bff4a2
SHA512 89f2f646611fc833b5ae2b447978a38a3387b5ae4a6610c4fbc32b9e190e17bbdd144c3978ade179696e9b7e579ac41fc95da9588769dc9530ffb727a70b7088
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 28B
SHA256 ee1b8469298c3a0f7893092a0b87371dcc76970f494298339d5eaf9a73113a46
MD5 5f5d3495c4a2d24b2511d9cd8de2785d
SHA1 72cb0c68cd5cd3ba2ab6dcd073c9330ec9b3a900
SHA512 d969c34eb7fa3203ba23b2c6d5912e858c405d44039a22276ba8522dd425740360c485eade9b5ed558fc8ac1f394a8c3381a128648e9d62e029d188cb7146338
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 41B
SHA256 ddab54ca35d96e1c3afcc58ce601be7b1774912d9fe94d2b5e22a76002d9bd40
MD5 925293a5b07f8e77c16593071f181923
SHA1 9cb1478d392643a6607120e8c03d401e63570fef
SHA512 f0792a0e9d01b2087240a7110c9fa1279e24522cc073c28ef6145c99fa3df6d4360d7524ed7351e2de2416d45c54927704868accc2534ce792ea328f4c011e8c
MD5 SHA1 SHA512

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 170B
SHA256 3778f3541894a52d8cafb7deb6c034bb4c5c3df11455fcd17e373754da4c3d9c
MD5 9e9ae04e21777a6063f3074bcc62da95
SHA1 e1692161c20ec660727ed47c05daf1f3220e43b4
SHA512 4c684e456468b66cff510947daafc1ae21d76d218e4c14fb2094f67b8c725ebe5dc5c16adc9df6999923570bc3d5780dc68c1a1602796c034b444b16d956f661
TLSH
T139C00251CC4548B1756920012827CF999B241551481744149866D6586E4C8E65945B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 214B
SHA256 3f9b65a7c79f48e5dd88f2e0fedd5c35725f33ebf30c9ec26610bd8ea6ed192f
MD5 bf6cd64e6cf1c951fe11966eccae256b
SHA1 f1cf9332cea0b052e4cb155b9f3844105365d969
SHA512 7d25819382cc4963114d55b6aa2da3935861b796c11aadb97c07ba24926f7860f1277a9c1045be514ddc04d480b069e6772558afafe2cc61562460d827355eed
TLSH
T173D0A210CC084871749920013823CF999B241541481B04549866D65C2E4C8E65941B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 478B
SHA256 30654cd5cbadbd3423a33215f05c06cc7ba77d3c8879c96c8ec68ab6ebc08561
MD5 9446cb55f55fb88f53c9f42cfed84e9e
SHA1 bcc492e9fc334e570bb64bc83caa89a7a215d025
SHA512 48fdd7d18bfcee0013fe7f4c5fffb5de40b719a456aec478771481e27e8cade2d382121b46387ff63b0f8e030b943d004b1b899794b4d2744cf057a85b8def85
TLSH
T168F09215CC088871799D24013C23CFD99F782841481B045198A6D6AC6E499F65A42B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 42B
SHA256 ea3662f08c78ba53018533d2bf03418163d0f629a10e5b4a93f4b3a9424eaac5
MD5 d35536d363a89490c75d83fd231636c6
SHA1 c64ff3054ff0cc2f4ad141fe5b4320a77a4efdfd
SHA512 923fa528e3faf14fd46c79b25c9b3bc0f29a65f127d13bcb8d8b8de0e2c40a08993cc2295df66d9e143577d2db3dccaacd7293fdaae40b4d439f17e4e4cd9cb9
MD5 SHA1 SHA512

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 84B
SHA256 47dcfb86d6f248a7b6f4f60d87485469a43585b8db1c7fe2856d6e0ef81dd43d
MD5 43ea709a3265d712d0f59ce87b48c17d
SHA1 9ad0e157eccb16f1532de04abdf147b6c3c99d58
SHA512 7148dc65583e336143c2b19b77f981865da411bd7c8e4041bbe60b4b479ce6a016586c53ddcb58134f33880bbd919e1022cc2da0b8746ca07d408448dbee7468
TLSH
T1E8A00210CC454CB1746D30013823CFDDDB3415414C1744145C76C65C7F4C4F75501F41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 128B
SHA256 56c1e3fb3415b8fdc05ed3a61d63618af0c59657e0557b37eb6550daf299ffe2
MD5 9304bbe4917e9118976786ff89e2e8f1
SHA1 22e7028a89bbe67ec1c6a2972be5696bfca25c01
SHA512 99680561c53d3e2754d27beabbe6af2ecd9d6da87befc134e43b3e1a7fde1307251fa5e414c1317c1a39cb78cc9e2a1ea9218fdc1062192204a6787b6948ef76
TLSH
T132B00250CC4548B1746920012827CF999B241551481744145866C6586E4C4E65945B41
MD5 SHA1 SHA512 TLSH

Submit Download

.locker.pid.tmp

Path /run/.locker.pid.tmp
Size 3B
SHA256 2b9449f314bf93145f8122906d8dc56c4ca1f116e6db7ad2768d6f9ade29b31e
MD5 6bc24fc1ab650b25b4114e93a98f1eba
SHA1 4b14fe7493932c29c0d1b85a3ba120bd22079c3e
SHA512 2cd3394822663c34d4fb7316624ca1078919bdab5f77159abb2dd761f79043e2542ec2f54681471c8ae43eac158f09f8160f3b3714c6f8252a446d1dfa249262
MD5 SHA1 SHA512

Submit Download

.locker.ready

Path /run/.locker.ready
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

.watchdog.pid.tmp

Path /run/.watchdog.pid.tmp
Size 3B
SHA256 3daebbc6dfd81355f1cc9d9565ab4a4a53bda47f6117529409acc7acb55556bb
MD5 8c6744c9d42ec2cb9e8885b54ff744d0
SHA1 0aed854dc1ed3c76a4caff5ed4057ff16817cf30
SHA512 c554fc578391dfccd6b13a25415df1f26af74d7bb9b8a1a376fe3e7ee614ff32cd20344a245d2c93ea291c5327ae705084acd879ef7264253f4bdbb6ed63f68f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads