Analysis
-
max time kernel
0s -
max time network
154s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
submitted
17-02-2022 19:13
Static task
static1
Behavioral task
behavioral1
Sample
960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a
-
Size
1.1MB
-
MD5
fba111160d27811f538ffcee8eb0c1b7
-
SHA1
629f9828d8f88197e528a49390f478aecdcd1f08
-
SHA256
960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a
-
SHA512
43aef2b5ec18cf13757b5ed79f667f5b941d298687215fdf482456be77e093812e91be2471031c88688b88c56d9afee73641d472a404d90d856cadcc66009fe0
Malware Config
Signatures
-
Processes:
rmrmdescription ioc process /etc/init.d/IptabLex /etc/init.d/IptabLex rm /etc/init.d/IptabLes /etc/init.d/IptabLes rm -
Modifies rc script 1 TTPs 22 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
Processes:
rmrmrmrmrmrmrmrmrmrmrmrmrmrmdescription ioc /etc/rc5.d/S55IptabLes /etc/rc5.d/S55IptabLes /etc/rc2.d/*IptabLex /etc/rc2.d/*IptabLex rm /etc/rc3.d/*IptabLex /etc/rc3.d/*IptabLex rm /etc/rc5.d/*IptabLex /etc/rc5.d/*IptabLex rm /etc/rc2.d/S55IptabLex /etc/rc2.d/S55IptabLex /etc/rc5.d/S55IptabLex /etc/rc5.d/S55IptabLex /etc/rc4.d/S55IptabLex /etc/rc4.d/S55IptabLex /etc/rc4.d/*IptabLex /etc/rc4.d/*IptabLex rm /etc/rc4.d/*IptabLes /etc/rc4.d/*IptabLes rm /etc/rc0.d/*IptabLex /etc/rc0.d/*IptabLex rm /etc/rc6.d/*IptabLes /etc/rc6.d/*IptabLes rm /etc/rc3.d/S55IptabLes /etc/rc3.d/S55IptabLes /etc/rc5.d/*IptabLes /etc/rc5.d/*IptabLes rm /etc/rc6.d/*IptabLex /etc/rc6.d/*IptabLex rm /etc/rc2.d/S55IptabLes /etc/rc2.d/S55IptabLes /etc/rc1.d/*IptabLex /etc/rc1.d/*IptabLex rm /etc/rc1.d/*IptabLes /etc/rc1.d/*IptabLes rm /etc/rc2.d/*IptabLes /etc/rc2.d/*IptabLes rm /etc/rc3.d/*IptabLes /etc/rc3.d/*IptabLes rm /etc/rc0.d/*IptabLes /etc/rc0.d/*IptabLes rm /etc/rc3.d/S55IptabLex /etc/rc3.d/S55IptabLex /etc/rc4.d/S55IptabLes /etc/rc4.d/S55IptabLes -
Reads CPU attributes 1 TTPs 24 IoCs
Processes:
pspspskillpskillpspskillpspskillpskillpspspspskillkillkillpspspsdescription ioc process /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online kill /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps /sys/devices/system/cpu/online /sys/devices/system/cpu/online ps -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pspspspspspspspspspspspspspspspsdescription ioc process /proc/165/status /proc/165/status ps /proc/157/stat /proc/157/stat ps /proc/155/stat /proc/155/stat ps /proc/19/status /proc/19/status ps /proc/1/cmdline /proc/1/cmdline ps /proc/83/stat /proc/83/stat ps /proc/309/stat /proc/309/stat ps /proc/12/stat /proc/12/stat ps /proc/127/stat /proc/127/stat ps /proc/612/cmdline /proc/612/cmdline ps /proc/27/status /proc/27/status ps /proc/17/status /proc/17/status ps /proc/18/stat /proc/18/stat ps /proc/10/stat /proc/10/stat ps /proc/16/cmdline /proc/16/cmdline ps /proc/26/cmdline /proc/26/cmdline ps /proc/158/cmdline /proc/158/cmdline ps /proc/332/stat /proc/332/stat ps /proc/584/status /proc/584/status ps /proc/643/cmdline /proc/643/cmdline ps /proc/156/status /proc/156/status ps /proc/7/cmdline /proc/7/cmdline ps /proc/8/status /proc/8/status ps /proc/332/cmdline /proc/332/cmdline ps /proc/584/stat /proc/584/stat ps /proc/89/status /proc/89/status ps /proc/160/stat /proc/160/stat ps /proc/98/cmdline /proc/98/cmdline ps /proc/154/cmdline /proc/154/cmdline ps /proc/161/cmdline /proc/161/cmdline ps /proc/98/cmdline /proc/98/cmdline ps /proc/334/cmdline /proc/334/cmdline ps /proc/81/stat /proc/81/stat ps /proc/604/cmdline /proc/604/cmdline ps /proc/156/stat /proc/156/stat ps /proc/12/cmdline /proc/12/cmdline ps /proc/24/stat /proc/24/stat ps /proc/36/stat /proc/36/stat ps /proc/578/status /proc/578/status ps /proc/170/stat /proc/170/stat ps /proc/6/cmdline /proc/6/cmdline ps /proc/18/stat /proc/18/stat ps /proc/332/stat /proc/332/stat ps /proc/32/status /proc/32/status ps /proc/634/stat /proc/634/stat ps /proc/422/cmdline /proc/422/cmdline ps /proc/115/status /proc/115/status ps /proc/164/cmdline /proc/164/cmdline ps /proc/160/cmdline /proc/160/cmdline ps /proc/156/cmdline /proc/156/cmdline ps /proc/24/cmdline /proc/24/cmdline ps /proc/599/status /proc/599/status ps /proc/636/stat /proc/636/stat ps /proc/7/cmdline /proc/7/cmdline ps /proc/85/stat /proc/85/stat ps /proc/10/stat /proc/10/stat ps /proc/350/cmdline /proc/350/cmdline ps /proc/17/status /proc/17/status ps /proc/32/cmdline /proc/32/cmdline ps /proc/17/stat /proc/17/stat ps /proc/160/cmdline /proc/160/cmdline ps /proc/155/status /proc/155/status ps /proc/252/status /proc/252/status ps /proc/193/stat /proc/193/stat ps -
Writes file to tmp directory 6 IoCs
Malware often drops required files in the /tmp directory.
Processes:
cpcprmrmrmrmdescription ioc process /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a cp /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED cp /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a rm /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED rm /tmp/IptabLex /tmp/IptabLex rm /tmp/IptabLes /tmp/IptabLes rm
Processes
-
./960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a./960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a1⤵
-
/bin/shsh -c /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED2⤵
-
/tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED/tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED3⤵
-
/bin/shsh -c "/delallmykkks>/dev/null"1⤵
-
/delallmykkks/delallmykkks2⤵
-
/usr/bin/awkawk "{print \$3}"3⤵
-
/bin/psps -f -C .IptabLex3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/xargsxargs /delallmykkks 23⤵
-
/delallmykkks/delallmykkks 24⤵
-
/bin/grepgrep .IptabLex3⤵
-
/bin/grepgrep .IptabLex3⤵
-
/bin/psps -f -C .IptabLex3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$3}"3⤵
-
/usr/bin/xargsxargs /delallmykkks 23⤵
-
/delallmykkks/delallmykkks 24⤵
-
/bin/grepgrep .IptabLex3⤵
-
/bin/psps -f -C .IptabLex3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/usr/bin/xargsxargs /delallmykkks 23⤵
-
/delallmykkks/delallmykkks 24⤵
-
/bin/grepgrep .IptabLex3⤵
-
/bin/psps -f -C .IptabLex3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/xargsxargs /delallmykkks 23⤵
-
/delallmykkks/delallmykkks 24⤵
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/bin/grepgrep .IptabLex3⤵
-
/bin/psps -axu3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 6314⤵
-
/usr/local/bin/killkill -9 6314⤵
-
/usr/sbin/killkill -9 6314⤵
-
/usr/bin/killkill -9 6314⤵
-
/sbin/killkill -9 6314⤵
-
/bin/killkill -9 6314⤵
- Reads CPU attributes
-
/bin/psps -axu3⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep .IptabLex3⤵
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 6414⤵
-
/usr/local/bin/killkill -9 6414⤵
-
/usr/sbin/killkill -9 6414⤵
-
/usr/bin/killkill -9 6414⤵
-
/sbin/killkill -9 6414⤵
-
/bin/killkill -9 6414⤵
- Reads CPU attributes
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/local/bin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/bin/killkill -9 PID TTY TIME CMD4⤵
-
/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/bin/killkill -9 PID TTY TIME CMD4⤵
- Reads CPU attributes
-
/bin/psps -C .IptabLex3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/local/bin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/bin/killkill -9 PID TTY TIME CMD4⤵
-
/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/bin/killkill -9 PID TTY TIME CMD4⤵
- Reads CPU attributes
-
/bin/psps -C .IptabLex3⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/rmrm -f /boot/.stabip3⤵
-
/bin/rmrm -f /boot/.IptabLex3⤵
-
/bin/rmrm -f /etc/rc.d/init.d/IptabLex3⤵
-
/bin/rmrm -f /boot/IptabLex3⤵
-
/bin/rmrm -f /tmp/IptabLex3⤵
- Writes file to tmp directory
-
/bin/rmrm -f /usr/IptabLex3⤵
-
/bin/rmrm -f /usr/.IptabLex3⤵
-
/bin/rmrm -f /boot/.IptabLex3⤵
-
/bin/rmrm -f /.IptabLex3⤵
-
/bin/rmrm -f /boot/IptabLex3⤵
-
/bin/rmrm -f /IptabLex3⤵
-
/bin/rmrm -f "/etc/rc.d/rc4.d/*IptabLex"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc1.d/*IptabLex"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc2.d/*IptabLex"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc3.d/*IptabLex"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc0.d/*IptabLex"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc5.d/*IptabLex"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc6.d/*IptabLex"3⤵
-
/bin/rmrm -f /etc/init.d/IptabLex3⤵
- Modifies init.d
-
/bin/rmrm -f "/etc/rc4.d/*IptabLex"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc1.d/*IptabLex"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc2.d/*IptabLex"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc3.d/*IptabLex"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc0.d/*IptabLex"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc5.d/*IptabLex"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc6.d/*IptabLex"3⤵
- Modifies rc script
-
/bin/rmrm -rf /delallmykkks3⤵
-
/bin/shsh -c "/delallmykkk>/dev/null"1⤵
-
/delallmykkk/delallmykkk2⤵
-
/bin/psps -f -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep .IptabLes3⤵
-
/usr/bin/awkawk "{print \$3}"3⤵
-
/usr/bin/xargsxargs /delallmykkk 23⤵
-
/delallmykkk/delallmykkk 24⤵
-
/bin/psps -f -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep .IptabLes3⤵
-
/usr/bin/awkawk "{print \$3}"3⤵
-
/usr/bin/xargsxargs /delallmykkk 23⤵
-
/delallmykkk/delallmykkk 24⤵
-
/bin/psps -f -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep .IptabLes3⤵
-
/usr/bin/xargsxargs /delallmykkk 23⤵
-
/delallmykkk/delallmykkk 24⤵
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/bin/psps -f -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/bin/grepgrep .IptabLes3⤵
-
/usr/bin/xargsxargs /delallmykkk 23⤵
-
/delallmykkk/delallmykkk 24⤵
-
/bin/grepgrep .IptabLes3⤵
-
/bin/psps -axu3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 6344⤵
-
/usr/local/bin/killkill -9 6344⤵
-
/usr/sbin/killkill -9 6344⤵
-
/usr/bin/killkill -9 6344⤵
-
/sbin/killkill -9 6344⤵
-
/bin/killkill -9 6344⤵
- Reads CPU attributes
-
/bin/grepgrep .IptabLes3⤵
-
/usr/bin/awkawk "{print \$2}"3⤵
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 6444⤵
-
/usr/local/bin/killkill -9 6444⤵
-
/usr/sbin/killkill -9 6444⤵
-
/usr/bin/killkill -9 6444⤵
-
/sbin/killkill -9 6444⤵
-
/bin/killkill -9 6444⤵
- Reads CPU attributes
-
/bin/psps -axu3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/local/bin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/usr/bin/killkill -9 PID TTY TIME CMD4⤵
-
/sbin/killkill -9 PID TTY TIME CMD4⤵
-
/bin/killkill -9 PID TTY TIME CMD4⤵
- Reads CPU attributes
-
/bin/psps -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/grepgrep .IptabLes3⤵
-
/bin/psps -C .IptabLes3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/xargsxargs kill -93⤵
-
/usr/local/sbin/killkill -94⤵
-
/usr/local/bin/killkill -94⤵
-
/usr/sbin/killkill -94⤵
-
/usr/bin/killkill -94⤵
-
/sbin/killkill -94⤵
-
/bin/killkill -94⤵
- Reads CPU attributes
-
/bin/rmrm -f /boot/.stabip3⤵
-
/bin/rmrm -f /boot/.IptabLes3⤵
-
/bin/rmrm -f /etc/rc.d/init.d/IptabLes3⤵
-
/bin/rmrm -f /boot/IptabLes3⤵
-
/bin/rmrm -f /tmp/IptabLes3⤵
- Writes file to tmp directory
-
/bin/rmrm -f /usr/IptabLes3⤵
-
/bin/rmrm -f /usr/.IptabLes3⤵
-
/bin/rmrm -f /boot/.IptabLes3⤵
-
/bin/rmrm -f /.IptabLes3⤵
-
/bin/rmrm -f /boot/IptabLes3⤵
-
/bin/rmrm -f /IptabLes3⤵
-
/bin/rmrm -f "/etc/rc.d/rc4.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc1.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc2.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc3.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc0.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc5.d/*IptabLes"3⤵
-
/bin/rmrm -f "/etc/rc.d/rc6.d/*IptabLes"3⤵
-
/bin/rmrm -f /etc/init.d/IptabLes3⤵
- Modifies init.d
-
/bin/rmrm -f "/etc/rc4.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc1.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc2.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc3.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc0.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc5.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -f "/etc/rc6.d/*IptabLes"3⤵
- Modifies rc script
-
/bin/rmrm -rf /delallmykkk3⤵
-
/bin/shsh -c "cp /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a /boot/.IptabLes>/dev/null"1⤵
-
/bin/cpcp /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a /boot/.IptabLes2⤵
- Writes file to tmp directory
-
/bin/shsh -c "cp /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED /boot/.IptabLex>/dev/null"1⤵
-
/bin/cpcp /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED /boot/.IptabLex2⤵
- Writes file to tmp directory
-
/bin/shsh -c /etc/rc2.d/S55IptabLes1⤵
-
/etc/rc2.d/S55IptabLes/etc/rc2.d/S55IptabLes2⤵
-
/bin/shsh -c /etc/rc2.d/S55IptabLex1⤵
-
/etc/rc2.d/S55IptabLex/etc/rc2.d/S55IptabLex2⤵
-
/bin/shsh -c /etc/rc3.d/S55IptabLex1⤵
-
/etc/rc3.d/S55IptabLex/etc/rc3.d/S55IptabLex2⤵
-
/bin/shsh -c /etc/rc3.d/S55IptabLes1⤵
-
/etc/rc3.d/S55IptabLes/etc/rc3.d/S55IptabLes2⤵
-
/bin/shsh -c /etc/rc4.d/S55IptabLex1⤵
-
/etc/rc4.d/S55IptabLex/etc/rc4.d/S55IptabLex2⤵
-
/bin/shsh -c /etc/rc4.d/S55IptabLes1⤵
-
/etc/rc4.d/S55IptabLes/etc/rc4.d/S55IptabLes2⤵
-
/bin/shsh -c /etc/rc5.d/S55IptabLex1⤵
-
/etc/rc5.d/S55IptabLex/etc/rc5.d/S55IptabLex2⤵
-
/bin/shsh -c /etc/rc5.d/S55IptabLes1⤵
-
/etc/rc5.d/S55IptabLes/etc/rc5.d/S55IptabLes2⤵
-
/bin/shsh -c /boot/IptabLex1⤵
-
/boot/IptabLex/boot/IptabLex2⤵
-
/boot/.IptabLex/boot/.IptabLex3⤵
-
/bin/shsh -c /boot/IptabLes1⤵
-
/boot/IptabLes/boot/IptabLes2⤵
-
/boot/.IptabLes/boot/.IptabLes3⤵
-
/bin/shsh -c "sh /delxxaazzx"1⤵
-
/bin/shsh /delxxaazzx2⤵
-
/bin/sleepsleep 33⤵
-
/bin/sleepsleep 13⤵
-
/bin/rmrm -f /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44aBCfWrED3⤵
- Writes file to tmp directory
-
/bin/rmrm -rf /delxxaazzx3⤵
-
/bin/shsh -c "sh /delxxaazz"1⤵
-
/bin/shsh /delxxaazz2⤵
-
/bin/sleepsleep 33⤵
-
/bin/sleepsleep 13⤵
-
/bin/rmrm -f /tmp/960cb322998f273c7c30ea05f58284a5bf749dc32240d1ecbe533b091148a44a3⤵
- Writes file to tmp directory
-
/bin/rmrm -rf /delxxaazz3⤵