085536903727f568126ea37e509f0972f91bb7e7187a2f4b75a6fdfb34fa278b

Analysis

max time kernel
152s
max time network
157s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
17/10/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mipsel.elf
Size 86KB
Sample261017-p5a8dsfz6w
SHA256 085536903727f568126ea37e509f0972f91bb7e7187a2f4b75a6fdfb34fa278b
MD5 7719f191b676d8e4762c86afd6795d79
SHA1 d53075a75ce26077cb4a11b993fa9ddcb93ba230
SHA512 dbbb539fc20289797f6682454856e6050a2d5a63f2df3d24be7c7daa85723a15183719a8d2f50b1521a73113aabd9fd2faea9500b07149f1f319026f8bd4af3c
SSDEEP 1536:l9Zea+bPq4cl696tZwZFCI6aU+C6ZSGzHmatnXZiJxxtASvlhqIp75v2A:7caey4cl3ZC/xUx6TfJiJDtAWB5v2A
TLSH
T11A83024B7559A46ECCED06BA219DD25055397E50F63F8E58D38E48E00B8B83EB41FD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
806	mipsel.elf

Deletes journal logs 1 TTPs 2 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd/system@a5449eae362844589bab5fed94fec9b1-0000000000000001-000651b57d305204.journal	journalctl
File deleted	/var/log/journal/edeb2f80f756429c9aae366fe5ab23dd/system@a5449eae362844589bab5fed94fec9b1-00000000000005c6-00065e08c7425a77.journal	journalctl

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	mipsel.elf

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/killer-helper	mipsel.elf
File opened for modification	/etc/cron.d/sys-network-helper	mipsel.elf

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/wtmp	mipsel.elf
File truncated	/var/log/btmp	mipsel.elf
File truncated	/var/log/lastlog	mipsel.elf
File truncated	/var/log/faillog	mipsel.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	mipsel.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	mipsel.elf

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/killer-helper.service	mipsel.elf
File opened for modification	/etc/systemd/system/sys-network-helper.service	mipsel.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-6.dat	upx

Changes its process name 10 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	orimhhh	806	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	orimhhh	806	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:5]	807	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	812	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	813	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	813	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:2]	814	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	812	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:3]	933	mipsel.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:4]	934	mipsel.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	mipsel.elf

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	mipsel.elf
File opened for reading	/proc/net/tcp6	mipsel.elf

Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
884	sh
939	sh
857	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/815/comm	mipsel.elf
File opened for reading	/proc/818/exe	mipsel.elf
File opened for reading	/proc/840/comm	mipsel.elf
File opened for reading	/proc/894/cmdline	mipsel.elf
File opened for reading	/proc/922/comm	mipsel.elf
File opened for reading	/proc/35/comm	mipsel.elf
File opened for reading	/proc/433/comm	mipsel.elf
File opened for reading	/proc/137/exe	mipsel.elf
File opened for reading	/proc/33/cmdline	mipsel.elf
File opened for reading	/proc/858/cmdline	mipsel.elf
File opened for reading	/proc/869/comm	mipsel.elf
File opened for reading	/proc/892/exe	mipsel.elf
File opened for reading	/proc/911/comm	mipsel.elf
File opened for reading	/proc/114/exe	mipsel.elf
File opened for reading	/proc/2/exe	mipsel.elf
File opened for reading	/proc/5/exe	mipsel.elf
File opened for reading	/proc/20/cmdline	mipsel.elf
File opened for reading	/proc/934/stat	mipsel.elf
File opened for reading	/proc/889/cmdline	mipsel.elf
File opened for reading	/proc/976/exe	mipsel.elf
File opened for reading	/proc/980/comm	mipsel.elf
File opened for reading	/proc/8/exe	mipsel.elf
File opened for reading	/proc/818/comm	mipsel.elf
File opened for reading	/proc/863/cmdline	mipsel.elf
File opened for reading	/proc/965/cmdline	mipsel.elf
File opened for reading	/proc/53/comm	mipsel.elf
File opened for reading	/proc/833/comm	mipsel.elf
File opened for reading	/proc/850/cmdline	mipsel.elf
File opened for reading	/proc/865/exe	mipsel.elf
File opened for reading	/proc/917/comm	mipsel.elf
File opened for reading	/proc/912/cmdline	mipsel.elf
File opened for reading	/proc/111/comm	mipsel.elf
File opened for reading	/proc/889/exe	mipsel.elf
File opened for reading	/proc/956/exe	mipsel.elf
File opened for reading	/proc/981/exe	mipsel.elf
File opened for reading	/proc/812/exe	mipsel.elf
File opened for reading	/proc/863/comm	mipsel.elf
File opened for reading	/proc/896/comm	mipsel.elf
File opened for reading	/proc/14/cmdline	mipsel.elf
File opened for reading	/proc/389/cmdline	mipsel.elf
File opened for reading	/proc/671/cmdline	mipsel.elf
File opened for reading	/proc/4/comm	mipsel.elf
File opened for reading	/proc/42/comm	mipsel.elf
File opened for reading	/proc/840/cmdline	mipsel.elf
File opened for reading	/proc/856/cmdline	mipsel.elf
File opened for reading	/proc/855/comm	mipsel.elf
File opened for reading	/proc/898/exe	mipsel.elf
File opened for reading	/proc/896/cmdline	mipsel.elf
File opened for reading	/proc/773/exe	mipsel.elf
File opened for reading	/proc/23/cmdline	mipsel.elf
File opened for reading	/proc/841/exe	mipsel.elf
File opened for reading	/proc/859/exe	mipsel.elf
File opened for reading	/proc/876/exe	mipsel.elf
File opened for reading	/proc/931/comm	mipsel.elf
File opened for reading	/proc/self/maps	mipsel.elf
File opened for reading	/proc/24/exe	mipsel.elf
File opened for reading	/proc/9/exe	mipsel.elf
File opened for reading	/proc/48/cmdline	mipsel.elf
File opened for reading	/proc/835/comm	mipsel.elf
File opened for reading	/proc/919/cmdline	mipsel.elf
File opened for reading	/proc/956/comm	mipsel.elf
File opened for reading	/proc/59/exe	mipsel.elf
File opened for reading	/proc/21/cmdline	mipsel.elf
File opened for reading	/proc/846/comm	mipsel.elf

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
920	as
799	mipsel.elf
920	as
920	as
920	as

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.sh7f3a.tmp.814	mipsel.elf

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccJtyMgW.s	gcc
File opened for modification	/tmp/ccJtyMgW.s	cc1
File opened for modification	/tmp/ccsq0m8u.o	gcc
File opened for modification	/tmp/ccsq0m8u.o	as
File opened for modification	/tmp/cch8eFVq.res	gcc
File opened for modification	/tmp/ccDcj9ZU.cdtor.c	collect2
File opened for modification	/tmp/ccpdG4A9.cdtor.o	collect2
File opened for modification	/tmp/.sh7f3a_ps.c	mipsel.elf

/tmp/mipsel.elf
/tmp/mipsel.elf
1⤵
- Deletes itself
- Modifies the /etc/hosts DNS resolution file
- Creates/modifies Cron job
- Deletes log files
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to shm directory
- Writes file to tmp directory
PID:799
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable killer-helper.service 2>/dev/null"
  2⤵
  PID:818
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:822
- - /usr/bin/systemctl
    systemctl enable killer-helper.service
    3⤵
    PID:865
- /bin/sh
  /bin/sh -c "systemctl daemon-reload 2>/dev/null;systemctl enable sys-network-helper 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:857
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:858
- /bin/sh
  /bin/sh -c "gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:884
- - /usr/bin/gcc
    gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c
    3⤵
    - Writes file to tmp directory
    PID:887
  - - /usr/lib/gcc/mipsel-linux-gnu/12/cc1
      /usr/lib/gcc/mipsel-linux-gnu/12/cc1 -quiet -imultiarch mipsel-linux-gnu /tmp/.sh7f3a_ps.c -mel -quiet -dumpdir /usr/lib/.sh7f3a.so- -dumpbase .sh7f3a_ps.c -dumpbase-ext .c "-march=mips32r2" -mfpxx -mllsc -mno-lxc1-sxc1 -mno-madd4 -mips32r2 "-mabi=32" -fPIC -o /tmp/ccJtyMgW.s
      4⤵
      Writes file to tmp directory
      PID:890
  - - /usr/local/sbin/as
      as -EL -mips32r2 -O1 "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccsq0m8u.o /tmp/ccJtyMgW.s
      4⤵
      System Network Configuration Discovery
      PID:920
  - - /usr/local/bin/as
      as -EL -mips32r2 -O1 "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccsq0m8u.o /tmp/ccJtyMgW.s
      4⤵
      System Network Configuration Discovery
      PID:920
  - - /usr/sbin/as
      as -EL -mips32r2 -O1 "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccsq0m8u.o /tmp/ccJtyMgW.s
      4⤵
      System Network Configuration Discovery
      PID:920
  - - /usr/bin/as
      as -EL -mips32r2 -O1 "-mabi=32" "-march=mips32r2" -mfpxx -KPIC -o /tmp/ccsq0m8u.o /tmp/ccJtyMgW.s
      4⤵
      System Network Configuration Discovery
      Writes file to tmp directory
      PID:920
  - - /usr/lib/gcc/mipsel-linux-gnu/12/collect2
      /usr/lib/gcc/mipsel-linux-gnu/12/collect2 -plugin /usr/lib/gcc/mipsel-linux-gnu/12/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/12/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cch8eFVq.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -EL -mips32r2 -shared --as-needed -melf32ltsmip -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/mipsel-linux-gnu/12 -L/usr/lib/gcc/mipsel-linux-gnu/12/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/12/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/12/../../.. /tmp/ccsq0m8u.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state
      4⤵
      Writes file to tmp directory
      PID:931
    - - /usr/bin/ld
        
        /usr/bin/ld -plugin /usr/lib/gcc/mipsel-linux-gnu/12/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/mipsel-linux-gnu/12/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cch8eFVq.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -EL -mips32r2 -shared --as-needed -melf32ltsmip -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/mipsel-linux-gnu/12 -L/usr/lib/gcc/mipsel-linux-gnu/12/../../../mipsel-linux-gnu -L/usr/lib/gcc/mipsel-linux-gnu/12/../../../../lib -L/lib/mipsel-linux-gnu -L/lib/../lib -L/usr/lib/mipsel-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/mipsel-linux-gnu/12/../../.. /tmp/ccsq0m8u.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state
        5⤵
        
        PID:932
- /bin/sh
  /bin/sh -c "journalctl --rotate --vacuum-time=1s 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:939
- - /usr/bin/journalctl
    journalctl --rotate "--vacuum-time=1s"
    3⤵
    - Deletes journal logs
    PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.hosts.tmp.ezb2Lm

Path /etc/.hosts.tmp.ezb2Lm
Size 260B
SHA256 2d451db42819e20705cd5e37451e0295cb803e7f8f387245d991e34268ebcff7
MD5 51b6c4bce8854fd152474463c3f57ed5
SHA1 901ff019a28ec30fddf6be1b9d95adf7fef0e854
SHA512 ba459adb3a0a97bbb122ce781fc0bc2a609f6233c2c4f700f1b8e5b77795dae7a7e9b749d9e134a89630549cb89b552d58658537b03db092a503cc1742f7cc53
TLSH
T10CD0A79B2F03D9BB05D363C47C2E6032DD03C19201580EB65A2D341B63BB6AE3D75A30
MD5 SHA1 SHA512 TLSH

Submit Download

killer-helper

Path /etc/cron.d/killer-helper
Size 45B
SHA256 2401bba8cdbe1b2f259b6bac2acf553ddacea9e3f7e70dbc55a0edbec171794b
MD5 f1d1b650dd60a3e2931672c3e0b0f430
SHA1 e47298d538f1e5016259865a358ca9e2c7997e14
SHA512 460e32c1b093027db381305c5ef9d961f5012f0e3764751e2d139f9ec0d63d3e83290c76cf226c93b0632e99456935e806a242f5955e520781e1c29d1724cb1b
MD5 SHA1 SHA512

Submit Download

sys-network-helper

Path /etc/cron.d/sys-network-helper
Size 150B
SHA256 e7bb309ff17d69ef561d96ecc0ad135f9bab5469ba8191f7af6dccc2e6c37195
MD5 7dad917e963afdb347ea4141ade37d16
SHA1 01ccb9d9baefac0bcfadf8c9b83f19867db75b21
SHA512 003cfddb6440d28de84441bab81e10e667e0f70bffde9cb6946a13f3b74e2662b53dca7e32e05c01415c8553a3e773c392651987135a9381a85732785ef5f92e
TLSH
T181C04CE1D8A50C143066CCF55228A100B6C36D1DA8D5A740B0CF8471871D35BA335FB4
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path /etc/hosts
Size 790B
SHA256 a64e60adb38020455d9eaf9edb069e1de5ce854de2f2c4f9d17959d981fb2b16
MD5 ddad3661099fa17c2b6aa40d7f29b5b8
SHA1 83ad82aa8204a3b4cbc8ba5138d9c9b6c681c790
SHA512 93f138978383694a6e0973f54d53ce4c3c46ca0a541b9d8968f1599f14f6592ff2c7a9f07359e0bfb13de75e642dd4ed358c625559d5c1571f2deecc307ad9b2
TLSH
T1C0013953178EA6FCD91509BCC99FA658E95E436314DFFDC185217F7D814033E21960B1
MD5 SHA1 SHA512 TLSH

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 39c3adba30914b4b1f783d4a6e064a69532f236ef273c9eb0dfdef32a9a7cefd
MD5 05cab4c3f2f96c111c0609bb6f26be3b
SHA1 d389462ae010015ea17f7d97cce38eb8c2ff486c
SHA512 c4b85e3ceb82a8b90af40f8c78739f7ce1c274d4c20a61b029019848fca762d38cdef0c44d1561016dba044d1c2cb1757a38c9632c8487c60f5216ae4bf7a59c
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 82B
SHA256 97d017afb74ffd6d4eed7a79ae899a03c546e5d99c85d0ed79fcdce7aebbd7e1
MD5 00b1c20cff59b0d68e0acfb2e40f62c0
SHA1 c0bcf7c2b109801280ba192fafe4c4190c1e92bb
SHA512 af9dd4b68b2e08e6e4533484d166ad1f70b0d626ce7b1537d6c0179250aaaba73407f6a0cfbf2b8606112bfe80b4f8bd617fff8d67a0d28f3dacb67f605f7c65
TLSH
T14DA0025547951D317111D8D50115B104A2D17919E550564136C14161C10DB495330D74
MD5 SHA1 SHA512 TLSH

Submit Download

killer-helper.service

Path /etc/systemd/system/killer-helper.service
Size 186B
SHA256 84c3b3dd46f76cb9fffee80fda7ebcd57bbe0d5088b3eddff46b1beb3b0cf599
MD5 3b1d58311876396360c9492eed5febc6
SHA1 d8eaa69b7e09d3e7eafb2e4e1b89612efe80fe8d
SHA512 8bf774e336d1fd4b89f186eda1b0232052df36163155a2dd4498e815f05d753cb47c36f5fb48f6b301a0a212ff721f7920c03a9d602a1084cb9b0acea2fc626f
TLSH
T16EC02237572112B0880A28B18EAA3F40883022045BCDA1300FC11102C0D1A460330CB9
MD5 SHA1 SHA512 TLSH

Submit Download

sys-network-helper.service

Path /etc/systemd/system/sys-network-helper.service
Size 210B
SHA256 518382f73b30f63e61911f79eb230ed7e3f3f4b2d78c4ab6a872315bac869bec
MD5 9bfedbe4e309d2d96f84713128821756
SHA1 a69c004c93e845fda4054ea9bd8d669ff8d9a707
SHA512 2a10221ebaec4623fbeded7816ffab0c8682aa7a90d46fea404b60eb55e390e70f0a9d9dd40140c359325e0ef2bd75a78c5270fbd29bc3b80dc00fd3b9c6e60d
TLSH
T19AD02313DF3019D3D92A14754E567F60C45411441FCD553507D51F0246D230A4634A9E
MD5 SHA1 SHA512 TLSH

Submit Download

.killer-wd.pid.tmp.813

Path /run/.killer-wd.pid.tmp.813
Size 23B
SHA256 3a0f1691c3c810402d8a820b66b3f8d53ced64b9c41e62869589198feb30da53
MD5 19508e3a4e215c06a56f1fd34c6cc97d
SHA1 e201c1713247988408721823fd3cf072432bd393
SHA512 131ec76facc47aa093597333097291c7bf58344da17bb7e494bf3cd80ff451d2c3589e3aa6288ece5fc98b1b76607da5f2a50795343ab54860434e10affc6560
MD5 SHA1 SHA512

Submit Download

.killer.pid.tmp.812

Path /run/.killer.pid.tmp.812
Size 23B
SHA256 d393a61906c691977d6460bed45c8d14618fc8e957ff94b5599e456f0d3f3805
MD5 aea5de2563221c593814855f01353bd9
SHA1 c3bbfffec850b7699056e43ae7e9e949951a64f1
SHA512 5e26270f2d5a2e564963b557a1dbddc91c845f2380ba587b24e816e054aa32b0823a19e12de608d348d34d91941a4929612f9e84ed070935554058e51a014386
MD5 SHA1 SHA512

Submit Download

.locker.pid.tmp.814

Path /run/.locker.pid.tmp.814
Size 23B
SHA256 fc2b1652b889988f73934356f63fa9d7aef41ca45c54156e95e68d559a6f8597
MD5 50434a9524c449e1dbc28052bf132045
SHA1 1ef9bbae4469b0037e6080683d93ee53a5f309a9
SHA512 b3ad39387d641175e637c0e9f684ff083147e176b73175530ecd151bea660332e2d2678285829daa82da44e071caea5e294f67c6069b866e333e9bd769ade247
MD5 SHA1 SHA512

Submit Download

.locker.ready

Path /run/.locker.ready
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

.main.pid.tmp.806

Path /run/.main.pid.tmp.806
Size 17B
SHA256 e9fef8d56a24102420d0b79b5624745dd23af0f044a49e85ab12b32afa28ad70
MD5 968001f69117d837c10e369186d6662a
SHA1 7e6eea52fd8e5b52e2697dbd6c168920f3541be9
SHA512 a7bfeefb67ef85d559920847e1a18bf97613cbe1a91db945b8006a6071feae3f092f0548541b9d3d7ed83997159fe6b0ba5d62d08dc7f55e97080bd446ec21ec
MD5 SHA1 SHA512

Submit Download

.sh7f3a.dis.list

Path /run/.sh7f3a.dis.list
Size 62B
SHA256 5774eed03386d2d304b9c233532de7564030ecb2954556224f1e52ec92956b72
MD5 5a455e6e80af9b2f66d12910e73b2e6e
SHA1 db6c87ff5b8f4fea2ac6cada3e78e4edb64732c0
SHA512 fb3dc853b20bfaa9f3b9c9fde3708cd1bf83a87898be823ac8e3b652ee5fe90529346ebf3582c606aae594687d95f732049761fc799b0a3117ceec210817c73d
TLSH
T11BA00203B8482263CF599C123832A30840C04711CD217C70D1800808C1233813D1028C
MD5 SHA1 SHA512 TLSH

Submit Download

.watchdog.pid.tmp.814

Path /run/.watchdog.pid.tmp.814
Size 23B
SHA256 1c8cfe14ff8c45832a6f7d01a1c40b0717af2551036569cd70c4f885cec51cd8
MD5 7d7b81c854385c56b5741f92e789d3cd
SHA1 7fce2476d9fd922673a25548f9dcc533a73b1086
SHA512 d246f6ee1ecd4033b6912ae8e05368f2a636132f663089428fc001fc9fba58a20f47bc10f9d8de94c76350138919b2c9512be10798d5ce65e67e922d21678dea
MD5 SHA1 SHA512

Submit Download

.watchdog2.pid.tmp.934

Path /run/.watchdog2.pid.tmp.934
Size 23B
SHA256 62ec11d12af4ee104478c0d31d0a3d17f7f0ee5ad07b949d7a6b654ee9017b1a
MD5 d2a75c4f46dabaa1b9f04b6602117bd5
SHA1 07f452b36e122007a0b413f95d0fe1e54da1df40
SHA512 b04f61af6957703b7ac8d2a1da319b511ad99bb7e16879aeda990a1926287fcab8757ae28460eb082575821e4c4bf9fd5669c8c7532586ad0c2b4ca2db1d7d92
MD5 SHA1 SHA512

Submit Download

.sh7f3a_ps.c

Path /tmp/.sh7f3a_ps.c
Size 666B
SHA256 c758ddb7e83c86b8a02edcaf11c4b96e1876699775e486301d3061393fc14b6e
MD5 15a6b0fd962edd2d2968841994853c04
SHA1 25db9652d6e62a483db55b5017ab7f12cf539a8c
SHA512 eb2ea8f4e111ad94b7196e1645505277ec4ea9d630b37208898587d19e6a176bd5823e5fe247c31ffc491ec5b04970b713fe8cd8b1ac5368ae812c564982c5c0
TLSH
T1C401A270C9FB9853F47394B75B8B402651457D071142C424BF0F5590EF9C0E527B97D9
MD5 SHA1 SHA512 TLSH

Submit Download

ccJtyMgW.s

Path /tmp/ccJtyMgW.s
Size 2KB
SHA256 d5125aec15cc33c73ba80918e309403e49710d60e3da05353e4b2a516e0d3a63
MD5 4dbcfa9e02fa5aa3b48697b51b162a1b
SHA1 a7fc5eeae25643762f0b65ee0f7f73d4e5d7aca5
SHA512 c7faf105f8fdf2071a38c01fc0a3b413a4984352e9cd8623dd63c2a4654f4c2dfc6024657bc1754e5982e72d99171460226e5afb8bca3e43ef1909c29be753a8
TLSH
T15751DEA0161635FBCC8865BE3DC524121288D09B19D2CF324D2FDD19FBAA1DF82E749C
MD5 SHA1 SHA512 TLSH

Submit Download

ccsq0m8u.o

Path /tmp/ccsq0m8u.o
Size 2KB
SHA256 bfc01c5c2c585d5c81649f6875df4044b0cb2ae24ce2fd62dc1c1051b126f859
MD5 cd0ea351f44e23dd1e65103afb3c1eb9
SHA1 272d5303137e6380d10ffa4801432ef61ead984f
SHA512 0c960838f586ace91da343f327cd6946ba843d4ecc107a705fffdb291e030e9875bd98d9b40a1671f221f4f1f8721327edbe4b463f2f91028aaf18f6be8f33c1
TLSH
T1BF41988EABE18C7BEC9859360152426123BBE9A051CA8BD3219CC4506D0B2CD3E77F85
MD5 SHA1 SHA512 TLSH

Submit Download

.sh7f3a.so

Path /usr/lib/.sh7f3a.so
Size 3KB
SHA256 2e198ad529ecbb016e96b30a0d29b3990f128a29344845cff848cea366d35c0a
MD5 9fb4d20ef020a4d4cd1a544fe84913c7
SHA1 61c1967388eeccdde1b80e7205dadd21909a863a
SHA512 a39479a759f4398564a96e87877e8cf153b1be5e50cd0491ec158a7009e436724452fa629fb4647afc672adf9c426be0ae13d98fb427f5bcdb8e8941652db852
TLSH
T1F371DC8AFFD2CD73D898993421674211237EC8686786D353430CD2A56C4B3DC9EF5E45
MD5 SHA1 SHA512 TLSH

Submit Download

.system-helper

Path /usr/lib/systemd/.system-helper
Size 86KB
SHA256 085536903727f568126ea37e509f0972f91bb7e7187a2f4b75a6fdfb34fa278b
MD5 7719f191b676d8e4762c86afd6795d79
SHA1 d53075a75ce26077cb4a11b993fa9ddcb93ba230
SHA512 dbbb539fc20289797f6682454856e6050a2d5a63f2df3d24be7c7daa85723a15183719a8d2f50b1521a73113aabd9fd2faea9500b07149f1f319026f8bd4af3c
SSDEEP 1536:l9Zea+bPq4cl696tZwZFCI6aU+C6ZSGzHmatnXZiJxxtASvlhqIp75v2A:7caey4cl3ZC/xUx6TfJiJDtAWB5v2A
TLSH
T11A83024B7559A46ECCED06BA219DD25055397E50F63F8E58D38E48E00B8B83EB41FD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads