export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo "") arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo "") uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null) cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ) gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ) last_output=$(last 2>/dev/null) filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ) echo "UNAME:$uname" echo "ARCH:$arch" echo "UPTIME:$uptime" echo "CPUS:$cpus" echo "CPU_MODEL:$cpu_model" echo "GPU:$gpu_info" echo "LAST:$last_output" echo "FILTER:$filter_output"
./xxxxxx
xxxxxx
printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter
#!/bin/bash echo "xxxxxx"
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
uname -s -v -n -m 2 > /dev/null
/bin/uname -s -v -n -m 2 > /dev/null
/usr/bin/uname -s -v -n -m 2 > /dev/null
/usr/bin/uname -s -v -n -m
busybox uname -s -v -n -m 2 > /dev/null
( [ -f /proc/version ]
[ -f /proc/version ]
head -1 /proc/version | cut -d -f1
[ -f /etc/os-release ]

Fingerprints

1 SSH client banner · 1 HASSH fingerprint

HASSH

2ec37a7cc8daf20b10e1ad6221061ca5

SSH Client

SSH-2.0-Go

Evidence Timeline

Malware Dropper 3b166e31a708 greencloud_phx_01 · 2026-10-19 05:00

7 2 1 100%

Loading events...

Malware Dropper 3f3b4adec46c greencloud_phx_01 · 2026-10-19 04:58

7 2 1 100%

Loading events...

Malware Dropper 804143a0c432 greencloud_phx_01 · 2026-10-19 04:57

7 2 1 100%

Loading events...

Credential Probe 9b35216c25e3 greencloud_phx_01 · 2026-10-19 04:56

1 20%

Loading events...

Scanner bf33e119bd63 greencloud_phx_01 · 2026-10-19 04:46

15%

Loading events...

Interactive Operator 00a9f3c8f441 w4m_singapore_01 · 2026-10-17 18:09

13 1 90%

Loading events...

Interactive Operator a3a90162b8dc w4m_singapore_01 · 2026-10-17 18:08

13 1 90%

Loading events...

Interactive Operator 23cc8cf90a59 w4m_singapore_01 · 2026-10-17 18:06

13 1 90%

Loading events...

Interactive Operator e5d22d3deb3d w4m_singapore_01 · 2026-10-17 18:05

13 1 90%

Loading events...

Interactive Operator b03069866f3b w4m_singapore_01 · 2026-10-17 18:04

13 1 90%

Loading events...

Interactive Operator 638f64da2191 w4m_singapore_01 · 2026-10-17 18:02

13 1 90%

Loading events...

Credential Probe d67f79443f0b w4m_singapore_01 · 2026-10-17 18:01

1 20%

Loading events...

Scanner cfd9de8ad8e4 w4m_singapore_01 · 2026-10-17 17:59

15%

Loading events...

Credential Probe a09d7af61c74 newark_01 · 2026-10-14 08:59

1 20%

Loading events...

Credential Probe 1b6a8c048acf newark_01 · 2026-10-14 08:57

1 20%

Loading events...

Credential Probe 24d53a857410 newark_01 · 2026-10-14 08:56

1 20%

Loading events...

Credential Probe 6619a4bbe805 newark_01 · 2026-10-14 08:55

1 20%

Loading events...

Credential Probe deb4626a0bd9 newark_01 · 2026-10-14 08:54

1 20%

Loading events...

Credential Probe db68825788ac newark_01 · 2026-10-14 08:53

1 20%

Loading events...

Credential Probe 52c3e535344e newark_01 · 2026-10-14 08:52

1 20%

Loading events...

Credential Probe bee62fc98ec2 newark_01 · 2026-10-14 08:50

1 20%

Loading events...

Credential Probe ad844af638c2 newark_01 · 2026-10-14 08:49

1 20%

Loading events...

Credential Probe 1a715ab3afc5 newark_01 · 2026-10-14 08:48

1 20%

Loading events...

Credential Probe 164b7c82f8ec newark_01 · 2026-10-14 08:47

1 20%

Loading events...

Credential Probe 07081bea9dd5 newark_01 · 2026-10-14 08:45

1 20%

Loading events...

Credential Probe 39ccb969cb67 newark_01 · 2026-10-14 08:44

1 20%

Loading events...

Credential Probe a2e4619149bb newark_01 · 2026-10-14 08:43

1 20%

Loading events...

Credential Probe 757af65b4caf newark_01 · 2026-10-14 08:42

1 20%

Loading events...

Credential Probe 194fe521b368 newark_01 · 2026-10-14 08:40

1 20%

Loading events...

Credential Probe ce5d6342e167 newark_01 · 2026-10-14 08:39

1 20%

Loading events...

Credential Probe fcfecab6d436 newark_01 · 2026-10-14 08:37

1 20%

Loading events...

Credential Probe b579863d6b64 newark_01 · 2026-10-14 08:36

1 20%

Loading events...

Credential Probe f86eba2008c2 newark_01 · 2026-10-14 08:35

1 20%

Loading events...

Credential Probe fac1c51a1a0e newark_01 · 2026-10-14 08:34

1 20%

Loading events...

Credential Probe cb1419c80e1b newark_01 · 2026-10-14 08:32

1 20%

Loading events...

Credential Probe 95cda67bf984 newark_01 · 2026-10-14 08:31

1 20%

Loading events...

Credential Probe a8e833ee5821 newark_01 · 2026-10-14 08:30

1 20%

Loading events...

Credential Probe dd8d5d14d828 newark_01 · 2026-10-14 08:29

1 20%

Loading events...

Credential Probe 7b4883e0bfb6 newark_01 · 2026-10-14 08:28

1 20%

Loading events...

Credential Probe 481d521c384f newark_01 · 2026-10-14 08:27

1 20%

Loading events...

Credential Probe a9ed95711d40 newark_01 · 2026-10-14 08:26

1 20%

Loading events...

Credential Probe 46a57125f6b6 newark_01 · 2026-10-14 08:24

1 20%

Loading events...

Credential Probe f7df852246bc newark_01 · 2026-10-14 08:23

1 20%

Loading events...

Credential Probe a7a9ff347bb1 newark_01 · 2026-10-14 08:22

1 20%

Loading events...

Credential Probe 3d17f57c9b1d newark_01 · 2026-10-14 08:20

1 20%

Loading events...

Credential Probe 3c7671b03c1c newark_01 · 2026-10-14 08:19

1 20%

Loading events...

Credential Probe a04207865421 newark_01 · 2026-10-14 08:18

1 20%

Loading events...

Credential Probe 3e36507b41e7 newark_01 · 2026-10-14 08:17

1 20%

Loading events...

Credential Probe 3f8d0ed11a5a newark_01 · 2026-10-14 08:15

1 20%

Loading events...

Credential Probe e0dbb838477f newark_01 · 2026-10-14 08:14

1 20%

Loading events...