165fb59360683122125271d668cfb28c3ad9502d559e491856005178fb22a254

Resubmissions

29-04-2024 17:56

240429-wjgllsgg29 10

17-04-2024 14:59

240417-sc15wsef8y 10

16-04-2024 14:20

240416-rnxq6sdg3t 10

Analysis

max time kernel
1800s
max time network
1802s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29-04-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
Size

8.7MB
MD5

97cfb3c26a12e13792f7d1741309d767
SHA1

a010f85cdda9f83cbc738eb1b41cd621f3d6018e
SHA256

5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
SHA512

162028b9e93bb4718427304a96767880da7094c99ae6145e61a562f09dae0ce6726b2dfac95782990f50fa9bfc9f82b1aacb9e7b12442094137872fa8a3f3379
SSDEEP

98304:yM1SkPCVk8rOmgYcGrr69gRQTI6xmiiLuSESStOAco7Xk:yM1SkPCVkIgcWAQ06xniLuSExR

Score

8^/10

antivm persistence

Malware Config

Signatures

Adds new SSH keys 1 IoCs
Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.
persistence

Processes:

5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

description ioc process

File opened for modification /root/.ssh/authorized_keys 5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
Deletes itself 1 IoCs

Processes:

pid

1578

description	ioc	process
File opened for modification	/root/.ssh/authorized_keys	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

pid
1578

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

Processes:

5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

description	ioc	process
File deleted	/var/log/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

Enumerates running processes
Discovers information about currently running processes on the system
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Processes:

freefreefreefreeuptimeuptimefreeuptimefreefreefreefreefreefreefreeuptimeuptimefreefreefreeuptimeuptimefreefreeuptimefreefreefreefreefreefreeuptimefreeuptimeuptimeuptimeuptimefreeuptimefreefreeuptimefreefreeuptimefreeuptimeuptimeuptimeuptimeuptimeuptimeuptimefreeuptimefreeuptimeuptimeuptimeuptimefreefreeuptimeuptime

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

uptimefreefreeuptimeuptimeuptimefreefreeuptime5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59freeuptimeuptimeuptimeuptimefreeuptimeuptimefreeuptimeuptimeuptimefreefreefreefreeuptimefreeuptimeuptimeuptimefreeuptimefreeuptimeuptimefreeuptimeuptimefreeuptimeuptimeuptimefreeuptimefreefreeuptimeuptime

description	ioc	process
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/9/cmdline	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/1169/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/85/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/1186/cmdline	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/1298/cmdline	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/410/cmdline	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/729/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/2/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/646/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/516/cmdline	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/1148/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/170/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/1129/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/7/cmdline	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/207/stat	5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime

/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
/tmp/The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
1⤵
- Adds new SSH keys
- Deletes log files
- Reads runtime system information
PID:1575

/bin/uname
uname -a
2⤵
PID:1585

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1586

/bin/cat
cat /etc/issue
2⤵
PID:1587

/usr/bin/free
free -m
2⤵
PID:1588

/usr/bin/uptime
uptime
2⤵
PID:1589

/bin/journalctl
journalctl -S "@0" -u sshd
2⤵
PID:1594

/bin/cat
cat "/var/log/auth*"
2⤵
PID:1595

/bin/zcat
zcat "/var/log/auth*"
2⤵
PID:1596

/bin/gzip
gzip -cd "/var/log/auth*"
2⤵
PID:1596

/usr/bin/free
free -m
2⤵
PID:1597

/usr/bin/uptime
uptime
2⤵
PID:1598

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1599

/usr/bin/uptime
uptime
2⤵
PID:1600

/usr/bin/free
free -m
2⤵
PID:1603

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1604

/usr/bin/free
free -m
2⤵
PID:1605

/usr/bin/uptime
uptime
2⤵
PID:1606

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1607

/usr/bin/uptime
uptime
2⤵
PID:1608

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1609

/usr/bin/uptime
uptime
2⤵
PID:1610

/usr/bin/free
free -m
2⤵
PID:1611

/usr/bin/uptime
uptime
2⤵
PID:1612

/usr/bin/free
free -m
2⤵
PID:1613

/usr/bin/uptime
uptime
2⤵
PID:1614

/usr/bin/free
free -m
2⤵
PID:1615

/usr/bin/uptime
uptime
2⤵
PID:1616

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1617

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1618

/usr/bin/free
free -m
2⤵
PID:1619

/usr/bin/uptime
uptime
2⤵
PID:1620

/usr/bin/free
free -m
2⤵
PID:1621

/usr/bin/uptime
uptime
2⤵
PID:1622

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1623

/usr/bin/uptime
uptime
2⤵
PID:1624

/usr/bin/free
free -m
2⤵
PID:1625

/usr/bin/uptime
uptime
2⤵
PID:1626

/usr/bin/free
free -m
2⤵
PID:1627

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1628

/usr/bin/free
free -m
2⤵
PID:1629

/usr/bin/uptime
uptime
2⤵
PID:1630

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1631

/usr/bin/uptime
uptime
2⤵
PID:1632

/usr/bin/free
free -m
2⤵
PID:1635

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1636

/usr/bin/free
free -m
2⤵
PID:1637

/usr/bin/uptime
uptime
2⤵
PID:1638

/usr/bin/free
free -m
2⤵
PID:1639

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1640

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1641

/usr/bin/uptime
uptime
2⤵
PID:1642

/usr/bin/free
free -m
2⤵
PID:1643

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1644

/usr/bin/free
free -m
2⤵
PID:1645

/usr/bin/uptime
uptime
2⤵
PID:1646

/usr/bin/free
free -m
2⤵
PID:1647

/usr/bin/uptime
uptime
2⤵
PID:1648

/usr/bin/free
free -m
2⤵
PID:1649

/usr/bin/uptime
uptime
2⤵
PID:1650

/usr/bin/free
free -m
2⤵
PID:1651

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1652

/usr/bin/free
free -m
2⤵
PID:1653

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1654

/usr/bin/free
free -m
2⤵
PID:1655

/usr/bin/uptime
uptime
2⤵
PID:1656

/usr/bin/free
free -m
2⤵
PID:1657

/usr/bin/uptime
uptime
2⤵
PID:1658

/usr/bin/free
free -m
2⤵
PID:1659

/usr/bin/uptime
uptime
2⤵
PID:1660

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1661

/usr/bin/uptime
uptime
2⤵
PID:1662

/usr/bin/free
free -m
2⤵
PID:1663

/usr/bin/uptime
uptime
2⤵
PID:1664

/usr/bin/free
free -m
2⤵
PID:1665

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1666

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1667

/usr/bin/uptime
uptime
2⤵
PID:1668

/usr/bin/free
free -m
2⤵
PID:1669

/usr/bin/uptime
uptime
2⤵
PID:1670

/usr/bin/free
free -m
2⤵
PID:1671

/usr/bin/uptime
uptime
2⤵
PID:1672

/usr/bin/free
free -m
2⤵
PID:1673

/usr/bin/uptime
uptime
2⤵
PID:1674

/usr/bin/free
free -m
2⤵
PID:1675

/usr/bin/uptime
uptime
2⤵
PID:1676

/usr/bin/free
free -m
2⤵
PID:1677

/usr/bin/uptime
uptime
2⤵
PID:1678

/usr/bin/free
free -m
2⤵
PID:1679

/usr/bin/uptime
uptime
2⤵
PID:1680

/usr/bin/free
free -m
2⤵
PID:1681

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1682

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1683

/usr/bin/uptime
uptime
2⤵
PID:1684

/usr/bin/free
free -m
2⤵
PID:1685

/usr/bin/uptime
uptime
2⤵
PID:1686

/usr/bin/free
free -m
2⤵
PID:1687

/usr/bin/uptime
uptime
2⤵
PID:1688

/usr/bin/free
free -m
2⤵
PID:1689

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1690

/usr/bin/free
free -m
2⤵
PID:1691

/usr/bin/uptime
uptime
2⤵
PID:1692

/usr/bin/free
free -m
2⤵
PID:1693

/usr/bin/uptime
uptime
2⤵
PID:1694

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1716

/usr/bin/uptime
uptime
2⤵
PID:1717

/usr/bin/free
free -m
2⤵
PID:1718

/usr/bin/uptime
uptime
2⤵
PID:1719

/usr/bin/free
free -m
2⤵
PID:1720

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1721

/usr/bin/free
free -m
2⤵
PID:1722

/usr/bin/uptime
uptime
2⤵
PID:1723

/usr/bin/free
free -m
2⤵
PID:1724

/usr/bin/uptime
uptime
2⤵
PID:1725

/usr/bin/free
free -m
2⤵
PID:1726

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1727

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1728

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1729

/usr/bin/free
free -m
2⤵
PID:1730

/usr/bin/uptime
uptime
2⤵
PID:1731

/usr/bin/free
free -m
2⤵
PID:1732

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1733

/usr/bin/free
free -m
2⤵
PID:1734

/usr/bin/uptime
uptime
2⤵
PID:1735

/usr/bin/free
free -m
2⤵
PID:1736

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1737

/usr/bin/free
free -m
2⤵
PID:1738

/usr/bin/uptime
uptime
2⤵
PID:1739

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1740

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1741

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1742

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1743

/usr/bin/free
free -m
2⤵
PID:1744

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1745

/usr/bin/free
free -m
2⤵
PID:1746

/usr/bin/uptime
uptime
2⤵
PID:1747

/usr/bin/free
free -m
2⤵
PID:1748

/usr/bin/uptime
uptime
2⤵
PID:1749

/usr/bin/free
free -m
2⤵
PID:1750

/usr/bin/uptime
uptime
2⤵
PID:1751

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1752

/usr/bin/uptime
uptime
2⤵
PID:1753

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1754

/usr/bin/uptime
uptime
2⤵
PID:1755

/usr/bin/free
free -m
2⤵
PID:1756

/usr/bin/uptime
uptime
2⤵
PID:1757

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1758

/usr/bin/uptime
uptime
2⤵
PID:1759

/usr/bin/free
free -m
2⤵
PID:1760

/usr/bin/uptime
uptime
2⤵
PID:1761

/usr/bin/free
free -m
2⤵
PID:1762

/usr/bin/uptime
uptime
2⤵
PID:1763

/usr/bin/free
free -m
2⤵
PID:1764

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1765

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1766

/usr/bin/uptime
uptime
2⤵
PID:1767

/usr/bin/free
free -m
2⤵
PID:1768

/usr/bin/uptime
uptime
2⤵
PID:1769

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1770

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1771

/usr/bin/free
free -m
2⤵
PID:1772

/usr/bin/uptime
uptime
2⤵
PID:1773

/usr/bin/free
free -m
2⤵
PID:1774

/usr/bin/uptime
uptime
2⤵
PID:1775

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1779

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1780

/usr/bin/free
free -m
2⤵
PID:1781

/usr/bin/uptime
uptime
2⤵
PID:1782

/usr/bin/free
free -m
2⤵
PID:1783

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1784

/usr/bin/free
free -m
2⤵
PID:1785

/usr/bin/uptime
uptime
2⤵
PID:1786

/usr/bin/free
free -m
2⤵
PID:1787

/usr/bin/uptime
uptime
2⤵
PID:1788

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1789

/usr/bin/uptime
uptime
2⤵
PID:1790

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1791

/usr/bin/uptime
uptime
2⤵
PID:1792

/usr/bin/free
free -m
2⤵
PID:1793

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1794

/usr/bin/free
free -m
2⤵
PID:1795

/usr/bin/uptime
uptime
2⤵
PID:1796

/usr/bin/free
free -m
2⤵
PID:1797

/usr/bin/uptime
uptime
2⤵
PID:1798

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1799

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1800

/usr/bin/free
free -m
2⤵
PID:1801

/usr/bin/uptime
uptime
2⤵
PID:1802

/usr/bin/free
free -m
2⤵
PID:1803

/usr/bin/uptime
uptime
2⤵
PID:1804

/usr/bin/free
free -m
2⤵
PID:1805

/usr/bin/uptime
uptime
2⤵
PID:1806

/usr/bin/free
free -m
2⤵
PID:1807

/usr/bin/uptime
uptime
2⤵
PID:1808

/usr/bin/free
free -m
2⤵
PID:1809

/usr/bin/uptime
uptime
2⤵
PID:1810

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1811

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1812

/usr/bin/free
free -m
2⤵
PID:1813

/usr/bin/uptime
uptime
2⤵
PID:1814

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1815

/usr/bin/uptime
uptime
2⤵
PID:1816

/usr/bin/free
free -m
2⤵
PID:1817

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1818

/usr/bin/free
free -m
2⤵
PID:1819

/usr/bin/uptime
uptime
2⤵
PID:1820

/usr/bin/free
free -m
2⤵
PID:1821

/usr/bin/uptime
uptime
2⤵
PID:1822

/usr/bin/free
free -m
2⤵
PID:1823

/usr/bin/uptime
uptime
2⤵
PID:1824

/usr/bin/free
free -m
2⤵
PID:1825

/usr/bin/uptime
uptime
2⤵
PID:1826

/usr/bin/free
free -m
2⤵
PID:1827

/usr/bin/uptime
uptime
2⤵
PID:1828

/usr/bin/free
free -m
2⤵
PID:1829

/usr/bin/uptime
uptime
2⤵
PID:1830

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1831

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1832

/usr/bin/free
free -m
2⤵
PID:1833

/usr/bin/uptime
uptime
2⤵
PID:1834

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1835

/usr/bin/uptime
uptime
2⤵
PID:1836

/usr/bin/free
free -m
2⤵
PID:1837

/usr/bin/uptime
uptime
2⤵
PID:1838

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1842

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1843

/usr/bin/free
free -m
2⤵
PID:1844

/usr/bin/uptime
uptime
2⤵
PID:1845

/usr/bin/free
free -m
2⤵
PID:1846

/usr/bin/uptime
uptime
2⤵
PID:1847

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1848

/usr/bin/uptime
uptime
2⤵
PID:1849

/usr/bin/free
free -m
2⤵
PID:1850

/usr/bin/uptime
uptime
2⤵
PID:1851

/usr/bin/free
free -m
2⤵
PID:1852

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1853

/usr/bin/free
free -m
2⤵
PID:1854

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1855

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1856

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1857

/usr/bin/free
free -m
2⤵
PID:1858

/usr/bin/uptime
uptime
2⤵
PID:1859

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1860

/usr/bin/uptime
uptime
2⤵
PID:1861

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1862

/usr/bin/uptime
uptime
2⤵
PID:1863

/usr/bin/free
free -m
2⤵
PID:1864

/usr/bin/uptime
uptime
2⤵
PID:1865

/usr/bin/free
free -m
2⤵
PID:1866

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1867

/usr/bin/free
free -m
2⤵
PID:1868

/usr/bin/uptime
uptime
2⤵
PID:1869

/usr/bin/free
free -m
2⤵
PID:1870

/usr/bin/uptime
uptime
2⤵
PID:1871

/usr/bin/free
free -m
2⤵
PID:1872

/usr/bin/uptime
uptime
2⤵
PID:1873

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1874

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1875

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1876

/usr/bin/uptime
uptime
2⤵
PID:1877

/usr/bin/free
free -m
2⤵
PID:1878

/usr/bin/uptime
uptime
2⤵
PID:1879

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1880

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1881

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1882

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1883

/usr/bin/free
free -m
2⤵
PID:1884

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1885

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1886

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1887

/usr/bin/free
free -m
2⤵
PID:1888

/usr/bin/uptime
uptime
2⤵
PID:1889

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1890

/usr/bin/uptime
uptime
2⤵
PID:1891

/usr/bin/free
free -m
2⤵
PID:1892

/usr/bin/uptime
uptime
2⤵
PID:1893

/usr/bin/free
free -m
2⤵
PID:1894

/usr/bin/uptime
uptime
2⤵
PID:1895

/usr/bin/free
free -m
2⤵
PID:1896

/usr/bin/uptime
uptime
2⤵
PID:1897

/usr/bin/free
free -m
2⤵
PID:1898

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1899

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1900

/usr/bin/uptime
uptime
2⤵
PID:1901

/usr/bin/free
free -m
2⤵
PID:1903

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1904

/usr/bin/free
free -m
2⤵
PID:1905

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1906

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1907

/usr/bin/uptime
uptime
2⤵
PID:1908

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1909

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1910

/usr/bin/free
free -m
2⤵
PID:1911

/usr/bin/uptime
uptime
2⤵
PID:1912

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1913

/usr/bin/uptime
uptime
2⤵
PID:1914

/usr/bin/free
free -m
2⤵
PID:1915

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1916

/usr/bin/free
free -m
2⤵
PID:1917

/usr/bin/uptime
uptime
2⤵
PID:1918

/usr/bin/free
free -m
2⤵
PID:1919

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1920

/usr/bin/free
free -m
2⤵
PID:1921

/usr/bin/uptime
uptime
2⤵
PID:1922

/usr/bin/free
free -m
2⤵
PID:1923

/usr/bin/uptime
uptime
2⤵
PID:1924

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1926

/usr/bin/uptime
uptime
2⤵
PID:1927

/usr/bin/free
free -m
2⤵
PID:1928

/usr/bin/uptime
uptime
2⤵
PID:1929

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1930

/usr/bin/uptime
uptime
2⤵
PID:1931

/usr/bin/free
free -m
2⤵
PID:1932

/usr/bin/uptime
uptime
2⤵
PID:1933

/usr/bin/free
free -m
2⤵
PID:1934

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1935

/usr/bin/free
free -m
2⤵
PID:1936

/usr/bin/uptime
uptime
2⤵
PID:1937

/usr/bin/free
free -m
2⤵
PID:1938

/usr/bin/uptime
uptime
2⤵
PID:1939

/usr/bin/free
free -m
2⤵
PID:1940

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1941

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1942

/usr/bin/uptime
uptime
2⤵
PID:1943

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1944

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1945

/usr/bin/free
free -m
2⤵
PID:1946

/usr/bin/uptime
uptime
2⤵
PID:1947

/usr/bin/free
free -m
2⤵
PID:1948

/usr/bin/uptime
uptime
2⤵
PID:1949

/usr/bin/free
free -m
2⤵
PID:1950

/usr/bin/uptime
uptime
2⤵
PID:1951

/usr/bin/free
free -m
2⤵
PID:1952

/usr/bin/uptime
uptime
2⤵
PID:1953

/usr/bin/free
free -m
2⤵
PID:1954

/usr/bin/uptime
uptime
2⤵
PID:1955

/usr/bin/free
free -m
2⤵
PID:1956

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1957

/usr/bin/free
free -m
2⤵
PID:1958

/usr/bin/uptime
uptime
2⤵
PID:1959

/usr/bin/free
free -m
2⤵
PID:1960

/usr/bin/uptime
uptime
2⤵
PID:1961

/usr/bin/free
free -m
2⤵
PID:1962

/usr/bin/uptime
uptime
2⤵
PID:1963

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1966

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1967

/usr/bin/free
free -m
2⤵
- Reads runtime system information
PID:1968

/usr/bin/uptime
uptime
2⤵
PID:1969

/usr/bin/free
free -m
2⤵
PID:1970

/usr/bin/uptime
uptime
2⤵
PID:1971

/usr/bin/free
free -m
2⤵
PID:1972

/usr/bin/uptime
uptime
2⤵
PID:1973

/usr/bin/free
free -m
2⤵
PID:1974

/usr/bin/uptime
uptime
2⤵
PID:1975

/usr/bin/free
free -m
2⤵
PID:1976

/usr/bin/uptime
uptime
2⤵
PID:1977

/usr/bin/free
free -m
2⤵
PID:1978

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1979

/usr/bin/free
free -m
2⤵
PID:1980

/usr/bin/uptime
uptime
2⤵
PID:1981

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
PID:1982

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:1983

/usr/bin/free
free -m
2⤵
PID:1984

/usr/bin/uptime
uptime
2⤵
- Reads runtime system information
PID:1985

/usr/bin/free
free -m
2⤵
PID:1986

/usr/bin/uptime
uptime
2⤵
PID:1987

/usr/bin/free
free -m
2⤵
PID:2071

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
PID:2072

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.ssh/authorized_keys
Filesize
381B

MD5
9da18d38b6dd4c4aa84642378d63fa89

SHA1
c5a976691e4b5963b5e760044f22cc9685268db6

SHA256
43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf

SHA512
222b20b5b2ff8956c13dbac1f8d3f81435613b751913d65f4c4082ea9c1a7c8ae91be17a24ef4ae0c708bfe09daab552bb209615714d70acfaaed89c536c71b3

Download Submit