7d7d0b4353401225e8da8424a7e1c5edaa091b256bdd48b7dcb158befca0b205

Resubmissions

01/10/2024, 16:14

241001-tp164aycqp10

31/03/2022, 14:02

220331-rb4c7ahaek9

Analysis

max time kernel
0s
max time network
77s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
submitted
31/03/2022, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cronb.sh
Size 79KB
Sample220331-rb4c7ahaek
SHA256 7d7d0b4353401225e8da8424a7e1c5edaa091b256bdd48b7dcb158befca0b205
MD5 2ac000e26102885305d056a5ee418faf
SHA1 73716825db3b5a4f6fee892a3f3a7cfe7a9907d0
SHA512 5f4a3c45f018062bb4e8ce5759db2d780076b247f2e9a7adf983f252fa1423af2ee053ef379c9d0cfe3d2ae33b608670046cfb32e1e1e97b9a77a34de8a432e6
MD5 SHA1 SHA512

Score

9^/10

persistence

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Indicator Removal on Host

T1070

description	ioc	Process
/var/log/syslog	/var/log/syslog	rm

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
/etc/hosts	/etc/hosts	sudo

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc	Process
/etc/resolv.conf	/etc/resolv.conf	sudo

Modifies rc script 1 TTPs 7 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
/etc/rc0.d/	/etc/rc0.d/	update-rc.d
/etc/rc5.d/	/etc/rc5.d/	update-rc.d
/etc/rc4.d/	/etc/rc4.d/	update-rc.d
/etc/rc3.d/	/etc/rc3.d/	update-rc.d
/etc/rc2.d/	/etc/rc2.d/	update-rc.d
/etc/rc6.d/	/etc/rc6.d/	update-rc.d
/etc/rc1.d/	/etc/rc1.d/	update-rc.d

Write file to user bin folder 1 TTPs 4 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/bin/pyvenv.cfg	/usr/bin/pyvenv.cfg	ufw
/usr/sbin/ufw	/usr/sbin/ufw	ufw
/usr/sbin/service	/usr/sbin/service	service
/usr/sbin/update-rc.d	/usr/sbin/update-rc.d	update-rc.d

Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
/sys/module/ip6_tables/initstate	/sys/module/ip6_tables/initstate	modprobe
/sys/module/x_tables/initstate	/sys/module/x_tables/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/6/cmdline	/proc/6/cmdline	ps
/proc/341/stat	/proc/341/stat	ps
/proc/21/stat	/proc/21/stat	ps
/proc/26/cmdline	/proc/26/cmdline	ps
/proc/153/status	/proc/153/status	ps
/proc/28/stat	/proc/28/stat	ps
/proc/341/cmdline	/proc/341/cmdline	ps
/proc/filesystems	/proc/filesystems	systemctl
/proc/2/status	/proc/2/status	ps
/proc/164/status	/proc/164/status	ps
/proc/604/stat	/proc/604/stat	ps
/proc/5/status	/proc/5/status	ps
/proc/83/stat	/proc/83/stat	ps
/proc/1/sched	/proc/1/sched	systemctl
/proc/1/environ	/proc/1/environ	systemctl
/proc/83/status	/proc/83/status	ps
/proc/self/stat	/proc/self/stat	sudo
/proc/1/status	/proc/1/status	ps
/proc/18/cmdline	/proc/18/cmdline	ps
/proc/332/status	/proc/332/status	ps
/proc/1/environ	/proc/1/environ	systemctl
/proc/1/sched	/proc/1/sched	systemctl
/proc/164/stat	/proc/164/stat	ps
/proc/11/stat	/proc/11/stat	ps
/proc/286/cmdline	/proc/286/cmdline	ps
/proc/575/cmdline	/proc/575/cmdline	ps
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/158/status	/proc/158/status	ps
/proc/154/status	/proc/154/status	ps
/proc/193/cmdline	/proc/193/cmdline	ps
/proc/420/status	/proc/420/status	ps
/proc/30/status	/proc/30/status	ps
/proc/85/stat	/proc/85/stat	ps
/proc/15/status	/proc/15/status	ps
/proc/26/status	/proc/26/status	ps
/proc/165/stat	/proc/165/stat	ps
/proc/223/cmdline	/proc/223/cmdline	ps
/proc/352/status	/proc/352/status	ps
/proc/1/environ	/proc/1/environ	systemctl
/proc/26/stat	/proc/26/stat	ps
/proc/352/cmdline	/proc/352/cmdline	ps
/proc/self/stat	/proc/self/stat	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/16/cmdline	/proc/16/cmdline	ps
/proc/80/status	/proc/80/status	ps
/proc/286/stat	/proc/286/stat	ps
/proc/169/cmdline	/proc/169/cmdline	ps
/proc/filesystems	/proc/filesystems	systemctl
/proc/self/stat	/proc/self/stat	systemctl
/proc/cmdline	/proc/cmdline	systemctl
/proc/3/status	/proc/3/status	ps
/proc/16/status	/proc/16/status	ps
/proc/347/cmdline	/proc/347/cmdline	ps
/proc/filesystems	/proc/filesystems	systemctl
/proc/4/cmdline	/proc/4/cmdline	ps
/proc/21/status	/proc/21/status	ps
/proc/36/cmdline	/proc/36/cmdline	ps
/proc/286/status	/proc/286/status	ps
/proc/22/cmdline	/proc/22/cmdline	ps
/proc/31/cmdline	/proc/31/cmdline	ps
/proc/1/environ	/proc/1/environ	systemctl
/proc/meminfo	/proc/meminfo	ps
/proc/156/cmdline	/proc/156/cmdline	ps

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/	/tmp/	cronb.sh
/tmp/addres*	/tmp/addres*	rm
/tmp/walle*	/tmp/walle*	rm
/tmp/keys	/tmp/keys	rm
/tmp/	/tmp/	chattr

./cronb.sh
./cronb.sh
1⤵
- Writes file to tmp directory
PID:577
- /usr/bin/id
  id
  2⤵
  PID:578
- /bin/mkdir
  mkdir /var/tmp/.copydie -p
  2⤵
  PID:581
- /bin/rm
  rm -rf /var/log/syslog
  2⤵
  - Deletes system logs
  PID:582
- /usr/bin/chattr
  chattr -iua /tmp/
  2⤵
  - Writes file to tmp directory
  PID:583
- /usr/bin/chattr
  chattr -iua /var/tmp/
  2⤵
  PID:584
- /usr/sbin/ufw
  ufw disable
  2⤵
  - Write file to user bin folder
  PID:585
- - /sbin/iptables
    /sbin/iptables -V
    3⤵
    PID:586
- - /lib/ufw/ufw-init
    /lib/ufw/ufw-init force-stop
    3⤵
    PID:587
  - - /sbin/ip6tables
      ip6tables -L INPUT -n
      4⤵
      PID:588
  - - /sbin/iptables
      iptables -F ufw-logging-deny
      4⤵
      PID:593
  - - /sbin/iptables
      iptables -F ufw-logging-allow
      4⤵
      PID:596
  - - /sbin/iptables
      iptables -F ufw-not-local
      4⤵
      PID:597
  - - /sbin/iptables
      iptables -F ufw-user-logging-input
      4⤵
      PID:598
  - - /sbin/iptables
      iptables -F ufw-user-limit-accept
      4⤵
      PID:599
  - - /sbin/iptables
      iptables -F ufw-user-limit
      4⤵
      PID:600
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-input
      4⤵
      PID:601
  - - /sbin/iptables
      iptables -F ufw-reject-input
      4⤵
      PID:602
  - - /sbin/iptables
      iptables -F ufw-after-logging-input
      4⤵
      PID:603
  - - /sbin/iptables
      iptables -F ufw-after-input
      4⤵
      PID:609
  - - /sbin/iptables
      iptables -F ufw-user-input
      4⤵
      PID:610
  - - /sbin/iptables
      iptables -F ufw-before-input
      4⤵
      PID:611
  - - /sbin/iptables
      iptables -F ufw-before-logging-input
      4⤵
      PID:612
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-forward
      4⤵
      PID:613
  - - /sbin/iptables
      iptables -F ufw-reject-forward
      4⤵
      PID:614
  - - /sbin/iptables
      iptables -F ufw-after-logging-forward
      4⤵
      PID:615
  - - /sbin/iptables
      iptables -F ufw-after-forward
      4⤵
      PID:616
  - - /sbin/iptables
      iptables -F ufw-user-logging-forward
      4⤵
      PID:617
  - - /sbin/iptables
      iptables -F ufw-user-forward
      4⤵
      PID:618
  - - /sbin/iptables
      iptables -F ufw-before-forward
      4⤵
      PID:619
  - - /sbin/iptables
      iptables -F ufw-before-logging-forward
      4⤵
      PID:620
  - - /sbin/iptables
      iptables -F ufw-track-forward
      4⤵
      PID:621
  - - /sbin/iptables
      iptables -F ufw-track-output
      4⤵
      PID:622
  - - /sbin/iptables
      iptables -F ufw-track-input
      4⤵
      PID:623
  - - /sbin/iptables
      iptables -F ufw-skip-to-policy-output
      4⤵
      PID:624
  - - /sbin/iptables
      iptables -F ufw-reject-output
      4⤵
      PID:625
  - - /sbin/iptables
      iptables -F ufw-after-logging-output
      4⤵
      PID:626
  - - /sbin/iptables
      iptables -F ufw-after-output
      4⤵
      PID:627
  - - /sbin/iptables
      iptables -F ufw-user-logging-output
      4⤵
      PID:628
  - - /sbin/iptables
      iptables -F ufw-user-output
      4⤵
      PID:629
  - - /sbin/iptables
      iptables -F ufw-before-output
      4⤵
      PID:630
  - - /sbin/iptables
      iptables -F ufw-before-logging-output
      4⤵
      PID:631
  - - /sbin/iptables
      iptables -Z ufw-logging-deny
      4⤵
      PID:632
  - - /sbin/iptables
      iptables -Z ufw-logging-allow
      4⤵
      PID:633
  - - /sbin/iptables
      iptables -Z ufw-not-local
      4⤵
      PID:634
  - - /sbin/iptables
      iptables -Z ufw-user-logging-input
      4⤵
      PID:635
  - - /sbin/iptables
      iptables -Z ufw-user-limit-accept
      4⤵
      PID:636
  - - /sbin/iptables
      iptables -Z ufw-user-limit
      4⤵
      PID:637
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-input
      4⤵
      PID:638
  - - /sbin/iptables
      iptables -Z ufw-reject-input
      4⤵
      PID:639
  - - /sbin/iptables
      iptables -Z ufw-after-logging-input
      4⤵
      PID:640
  - - /sbin/iptables
      iptables -Z ufw-after-input
      4⤵
      PID:641
  - - /sbin/iptables
      iptables -Z ufw-user-input
      4⤵
      PID:642
  - - /sbin/iptables
      iptables -Z ufw-before-input
      4⤵
      PID:643
  - - /sbin/iptables
      iptables -Z ufw-before-logging-input
      4⤵
      PID:644
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-forward
      4⤵
      PID:645
  - - /sbin/iptables
      iptables -Z ufw-reject-forward
      4⤵
      PID:646
  - - /sbin/iptables
      iptables -Z ufw-after-logging-forward
      4⤵
      PID:647
  - - /sbin/iptables
      iptables -Z ufw-after-forward
      4⤵
      PID:648
  - - /sbin/iptables
      iptables -Z ufw-user-logging-forward
      4⤵
      PID:649
  - - /sbin/iptables
      iptables -Z ufw-user-forward
      4⤵
      PID:650
  - - /sbin/iptables
      iptables -Z ufw-before-forward
      4⤵
      PID:651
  - - /sbin/iptables
      iptables -Z ufw-before-logging-forward
      4⤵
      PID:652
  - - /sbin/iptables
      iptables -Z ufw-track-forward
      4⤵
      PID:653
  - - /sbin/iptables
      iptables -Z ufw-track-output
      4⤵
      PID:654
  - - /sbin/iptables
      iptables -Z ufw-track-input
      4⤵
      PID:655
  - - /sbin/iptables
      iptables -Z ufw-skip-to-policy-output
      4⤵
      PID:656
  - - /sbin/iptables
      iptables -Z ufw-reject-output
      4⤵
      PID:657
  - - /sbin/iptables
      iptables -Z ufw-after-logging-output
      4⤵
      PID:658
  - - /sbin/iptables
      iptables -Z ufw-after-output
      4⤵
      PID:659
  - - /sbin/iptables
      iptables -Z ufw-user-logging-output
      4⤵
      PID:660
  - - /sbin/iptables
      iptables -Z ufw-user-output
      4⤵
      PID:661
  - - /sbin/iptables
      iptables -Z ufw-before-output
      4⤵
      PID:662
  - - /sbin/iptables
      iptables -Z ufw-before-logging-output
      4⤵
      PID:663
  - - /sbin/iptables
      iptables -X ufw-logging-deny
      4⤵
      PID:664
  - - /sbin/iptables
      iptables -X ufw-logging-allow
      4⤵
      PID:665
  - - /sbin/iptables
      iptables -X ufw-not-local
      4⤵
      PID:666
  - - /sbin/iptables
      iptables -X ufw-user-logging-input
      4⤵
      PID:667
  - - /sbin/iptables
      iptables -X ufw-user-logging-output
      4⤵
      PID:668
  - - /sbin/iptables
      iptables -X ufw-user-logging-forward
      4⤵
      PID:669
  - - /sbin/iptables
      iptables -X ufw-user-limit-accept
      4⤵
      PID:670
  - - /sbin/iptables
      iptables -X ufw-user-limit
      4⤵
      PID:671
  - - /sbin/iptables
      iptables -X ufw-user-input
      4⤵
      PID:672
  - - /sbin/iptables
      iptables -X ufw-user-forward
      4⤵
      PID:673
  - - /sbin/iptables
      iptables -X ufw-user-output
      4⤵
      PID:674
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-input
      4⤵
      PID:675
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-output
      4⤵
      PID:676
  - - /sbin/iptables
      iptables -X ufw-skip-to-policy-forward
      4⤵
      PID:677
  - - /sbin/iptables
      iptables -P INPUT ACCEPT
      4⤵
      PID:678
  - - /sbin/iptables
      iptables -P OUTPUT ACCEPT
      4⤵
      PID:679
  - - /sbin/iptables
      iptables -P FORWARD ACCEPT
      4⤵
      PID:680
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-deny
      4⤵
      PID:681
  - - /sbin/ip6tables
      ip6tables -F ufw6-logging-allow
      4⤵
      PID:682
  - - /sbin/ip6tables
      ip6tables -F ufw6-not-local
      4⤵
      PID:683
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-input
      4⤵
      PID:684
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit-accept
      4⤵
      PID:685
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-limit
      4⤵
      PID:686
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-input
      4⤵
      PID:687
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-input
      4⤵
      PID:688
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-input
      4⤵
      PID:689
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-input
      4⤵
      PID:690
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-input
      4⤵
      PID:691
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-input
      4⤵
      PID:692
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-input
      4⤵
      PID:693
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-forward
      4⤵
      PID:694
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-forward
      4⤵
      PID:695
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-forward
      4⤵
      PID:696
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-forward
      4⤵
      PID:697
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-forward
      4⤵
      PID:698
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-forward
      4⤵
      PID:699
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-forward
      4⤵
      PID:700
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-forward
      4⤵
      PID:701
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-forward
      4⤵
      PID:702
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-output
      4⤵
      PID:703
  - - /sbin/ip6tables
      ip6tables -F ufw6-track-input
      4⤵
      PID:704
  - - /sbin/ip6tables
      ip6tables -F ufw6-skip-to-policy-output
      4⤵
      PID:705
  - - /sbin/ip6tables
      ip6tables -F ufw6-reject-output
      4⤵
      PID:706
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-logging-output
      4⤵
      PID:707
  - - /sbin/ip6tables
      ip6tables -F ufw6-after-output
      4⤵
      PID:708
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-logging-output
      4⤵
      PID:709
  - - /sbin/ip6tables
      ip6tables -F ufw6-user-output
      4⤵
      PID:710
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-output
      4⤵
      PID:711
  - - /sbin/ip6tables
      ip6tables -F ufw6-before-logging-output
      4⤵
      PID:712
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-deny
      4⤵
      PID:713
  - - /sbin/ip6tables
      ip6tables -Z ufw6-logging-allow
      4⤵
      PID:714
  - - /sbin/ip6tables
      ip6tables -Z ufw6-not-local
      4⤵
      PID:715
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-input
      4⤵
      PID:716
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit-accept
      4⤵
      PID:717
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-limit
      4⤵
      PID:718
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-input
      4⤵
      PID:719
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-input
      4⤵
      PID:720
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-input
      4⤵
      PID:721
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-input
      4⤵
      PID:722
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-input
      4⤵
      PID:723
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-input
      4⤵
      PID:724
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-input
      4⤵
      PID:725
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-forward
      4⤵
      PID:726
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-forward
      4⤵
      PID:727
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-forward
      4⤵
      PID:728
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-forward
      4⤵
      PID:729
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-forward
      4⤵
      PID:730
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-forward
      4⤵
      PID:731
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-forward
      4⤵
      PID:732
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-forward
      4⤵
      PID:733
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-forward
      4⤵
      PID:734
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-output
      4⤵
      PID:735
  - - /sbin/ip6tables
      ip6tables -Z ufw6-track-input
      4⤵
      PID:736
  - - /sbin/ip6tables
      ip6tables -Z ufw6-skip-to-policy-output
      4⤵
      PID:737
  - - /sbin/ip6tables
      ip6tables -Z ufw6-reject-output
      4⤵
      PID:738
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-logging-output
      4⤵
      PID:739
  - - /sbin/ip6tables
      ip6tables -Z ufw6-after-output
      4⤵
      PID:740
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-logging-output
      4⤵
      PID:741
  - - /sbin/ip6tables
      ip6tables -Z ufw6-user-output
      4⤵
      PID:742
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-output
      4⤵
      PID:743
  - - /sbin/ip6tables
      ip6tables -Z ufw6-before-logging-output
      4⤵
      PID:744
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-deny
      4⤵
      PID:745
  - - /sbin/ip6tables
      ip6tables -X ufw6-logging-allow
      4⤵
      PID:746
  - - /sbin/ip6tables
      ip6tables -X ufw6-not-local
      4⤵
      PID:747
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-input
      4⤵
      PID:748
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-output
      4⤵
      PID:749
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-logging-forward
      4⤵
      PID:750
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit-accept
      4⤵
      PID:751
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-limit
      4⤵
      PID:752
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-input
      4⤵
      PID:753
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-forward
      4⤵
      PID:754
  - - /sbin/ip6tables
      ip6tables -X ufw6-user-output
      4⤵
      PID:755
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-input
      4⤵
      PID:756
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-output
      4⤵
      PID:757
  - - /sbin/ip6tables
      ip6tables -X ufw6-skip-to-policy-forward
      4⤵
      PID:758
  - - /sbin/ip6tables
      ip6tables -P INPUT ACCEPT
      4⤵
      PID:759
  - - /sbin/ip6tables
      ip6tables -P OUTPUT ACCEPT
      4⤵
      PID:760
  - - /sbin/ip6tables
      ip6tables -P FORWARD ACCEPT
      4⤵
      PID:761
- /sbin/iptables
  iptables -F
  2⤵
  PID:762
- /usr/bin/sudo
  sudo sysctl "kernel.nmi_watchdog=0"
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  - Reads runtime system information
  PID:763
- - /sbin/sysctl
    sysctl "kernel.nmi_watchdog=0"
    3⤵
    PID:764
- /sbin/sysctl
  sysctl "kernel.nmi_watchdog=0"
  2⤵
  PID:765
- /usr/bin/chattr
  chattr -iae /root/.ssh/
  2⤵
  PID:766
- /usr/bin/chattr
  chattr -iae /root/.ssh/authorized_keys
  2⤵
  PID:767
- /bin/rm
  rm -rf "/tmp/addres*"
  2⤵
  - Writes file to tmp directory
  PID:768
- /bin/rm
  rm -rf "/tmp/walle*"
  2⤵
  - Writes file to tmp directory
  PID:769
- /bin/rm
  rm -rf /tmp/keys
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:771
- /bin/grep
  grep -i "[a]liyun"
  2⤵
  PID:772
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:773
- /bin/grep
  grep -i "[y]unjing"
  2⤵
  PID:774
- /usr/sbin/service
  service apparmor stop
  2⤵
  - Write file to user bin folder
  PID:776
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:777
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:778
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    PID:779
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Reads runtime system information
    PID:783
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    PID:784
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Reads runtime system information
    PID:785
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Reads runtime system information
    PID:786
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Reads runtime system information
    PID:787
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Reads runtime system information
    PID:788
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Reads runtime system information
    PID:789
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Reads runtime system information
    PID:790
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Reads runtime system information
    PID:791
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    PID:792
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Reads runtime system information
    PID:793
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Reads runtime system information
    PID:794
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    - Reads runtime system information
    PID:795
- /usr/local/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:776
- /usr/local/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:776
- /usr/sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:776
- /usr/bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:776
- /sbin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:776
- /bin/systemctl
  systemctl stop apparmor.service
  2⤵
  PID:776
- /bin/systemctl
  systemctl disable apparmor
  2⤵
  PID:807
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install disable apparmor
    3⤵
    PID:808
  - - /usr/bin/getopt
      getopt -o r: --long root: -- disable apparmor
      4⤵
      PID:809
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d apparmor defaults
      4⤵
      Modifies rc script
      Write file to user bin folder
      PID:810