37b4f31eee5f88e47641e1792a4bf769ec2e19ca1e6d02972abc1bf5d0616e4a

Analysis

max time kernel
0s
max time network
153s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
submitted
25-06-2022 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37b4f31eee5f88e47641e1792a4bf769ec2e19ca1e6d02972abc1bf5d0616e4a
Size

117KB
MD5

89ac85db752dcce27d72752ad4e2cea5
SHA1

149560e6c61462b6cb554322d61bd4378f7de870
SHA256

37b4f31eee5f88e47641e1792a4bf769ec2e19ca1e6d02972abc1bf5d0616e4a
SHA512

83fcf3f980bfbe13a1bce7cce70b4ce843282664146deeda77bdfe6b458d145edac1585ba572f99ea55d4d99f55080019a77c76579ffabca2d3471f35ab01dde

Score

6^/10

Malware Config

Signatures

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/79/cmdline	/proc/79/cmdline	pkill
/proc/24/cmdline	/proc/24/cmdline	pkill
/proc/345/status	/proc/345/status	pkill
/proc/451/cmdline	/proc/451/cmdline	pkill
/proc/170/status	/proc/170/status	pkill
/proc/160/cmdline	/proc/160/cmdline	pkill
/proc/251/cmdline	/proc/251/cmdline	pkill
/proc/19/status	/proc/19/status	pkill
/proc/84/status	/proc/84/status	pkill
/proc/1/status	/proc/1/status	pkill
/proc/154/status	/proc/154/status	pkill
/proc/34/status	/proc/34/status	pkill
/proc/584/cmdline	/proc/584/cmdline	pkill
/proc/13/cmdline	/proc/13/cmdline	pkill
/proc/83/status	/proc/83/status	pkill
/proc/153/cmdline	/proc/153/cmdline	pkill
/proc/3/status	/proc/3/status	pkill
/proc/80/status	/proc/80/status	pkill
/proc/32/status	/proc/32/status	pkill
/proc/16/cmdline	/proc/16/cmdline	pkill
/proc/584/status	/proc/584/status	pkill
/proc/19/cmdline	/proc/19/cmdline	pkill
/proc/35/cmdline	/proc/35/cmdline	pkill
/proc/85/cmdline	/proc/85/cmdline	pkill
/proc/130/cmdline	/proc/130/cmdline	pkill
/proc/22/cmdline	/proc/22/cmdline	pkill
/proc/417/status	/proc/417/status	pkill
/proc/364/cmdline	/proc/364/cmdline	pkill
/proc/8/status	/proc/8/status	pkill
/proc/364/status	/proc/364/status	pkill
/proc/4/cmdline	/proc/4/cmdline	pkill
/proc/192/status	/proc/192/status	pkill
/proc/19/cmdline	/proc/19/cmdline	pkill
/proc/579/status	/proc/579/status	pkill
/proc/4/status	/proc/4/status	pkill
/proc/162/cmdline	/proc/162/cmdline	pkill
/proc/35/status	/proc/35/status	pkill
/proc/15/status	/proc/15/status	pkill
/proc/4/cmdline	/proc/4/cmdline	pkill
/proc/130/status	/proc/130/status	pkill
/proc/621/cmdline	/proc/621/cmdline	pkill
/proc/7/status	/proc/7/status	pkill
/proc/160/cmdline	/proc/160/cmdline	pkill
/proc/361/cmdline	/proc/361/cmdline	pkill
/proc/23/cmdline	/proc/23/cmdline	pkill
/proc/9/status	/proc/9/status	pkill
/proc/98/status	/proc/98/status	pkill
/proc/161/status	/proc/161/status	pkill
/proc/166/status	/proc/166/status	pkill
/proc/157/status	/proc/157/status	pkill
/proc/26/cmdline	/proc/26/cmdline	pkill
/proc/18/cmdline	/proc/18/cmdline	pkill
/proc/360/status	/proc/360/status	pkill
/proc/13/cmdline	/proc/13/cmdline	pkill
/proc/24/status	/proc/24/status	pkill
/proc/164/status	/proc/164/status	pkill
/proc/169/status	/proc/169/status	pkill
/proc/358/status	/proc/358/status	pkill
/proc/9/status	/proc/9/status	pkill
/proc/1/status	/proc/1/status	pkill
/proc/16/cmdline	/proc/16/cmdline	pkill
/proc/7/cmdline	/proc/7/cmdline	pkill
/proc/162/cmdline	/proc/162/cmdline	pkill
/proc/342/status	/proc/342/status	pkill

./37b4f31eee5f88e47641e1792a4bf769ec2e19ca1e6d02972abc1bf5d0616e4a
./37b4f31eee5f88e47641e1792a4bf769ec2e19ca1e6d02972abc1bf5d0616e4a
1⤵
PID:581

/bin/sh
sh -c "pkill -9 902i13 || busybox pkill -9 902i13"
1⤵
PID:585
- /usr/bin/pkill
  pkill -9 902i13
  2⤵
  - Reads runtime system information
  PID:586
- /bin/busybox
  busybox pkill -9 902i13
  2⤵
  PID:587

/bin/sh
sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"
1⤵
PID:593
- /usr/bin/pkill
  pkill -9 BzSxLxBxeY
  2⤵
  PID:594
- /bin/busybox
  busybox pkill -9 BzSxLxBxeY
  2⤵
  PID:595

/bin/sh
sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"
1⤵
PID:596
- /usr/bin/pkill
  pkill -9 HOHO-LUGO7
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:597
- /bin/busybox
  busybox pkill -9 HOHO-LUGO7
  2⤵
  PID:598

/bin/sh
sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"
1⤵
PID:599
- /usr/bin/pkill
  pkill -9 HOHO-U79OL
  2⤵
  - Reads CPU attributes
  PID:600
- /bin/busybox
  busybox pkill -9 HOHO-U79OL
  2⤵
  PID:601

/bin/sh
sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"
1⤵
PID:602
- /usr/bin/pkill
  pkill -9 JuYfouyf87
  2⤵
  - Reads CPU attributes
  PID:603
- /bin/busybox
  busybox pkill -9 JuYfouyf87
  2⤵
  PID:604

/bin/sh
sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
1⤵
PID:605
- /usr/bin/pkill
  pkill -9 NiGGeR69xd
  2⤵
  - Reads CPU attributes
  PID:606
- /bin/busybox
  busybox pkill -9 NiGGeR69xd
  2⤵
  PID:607

/bin/sh
sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
1⤵
PID:608
- /usr/bin/pkill
  pkill -9 SO190Ij1X
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:609
- /bin/busybox
  busybox pkill -9 SO190Ij1X
  2⤵
  PID:610

/bin/sh
sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"
1⤵
PID:611
- /usr/bin/pkill
  pkill -9 LOLKIKEEEDDE
  2⤵
  - Reads CPU attributes
  PID:612
- /bin/busybox
  busybox pkill -9 LOLKIKEEEDDE
  2⤵
  PID:613

/bin/sh
sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"
1⤵
PID:614
- /usr/bin/pkill
  pkill -9 ekjheory98e
  2⤵
  - Reads runtime system information
  PID:615
- /bin/busybox
  busybox pkill -9 ekjheory98e
  2⤵
  PID:616

/bin/sh
sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"
1⤵
PID:617
- /usr/bin/pkill
  pkill -9 scansh4
  2⤵
  - Reads CPU attributes
  PID:618
- /bin/busybox
  busybox pkill -9 scansh4
  2⤵
  PID:619

/bin/sh
sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"
1⤵
PID:620
- /usr/bin/pkill
  pkill -9 MDMA
  2⤵
  - Reads runtime system information
  PID:621
- /bin/busybox
  busybox pkill -9 MDMA
  2⤵
  PID:622

/bin/sh
sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"
1⤵
PID:623
- /usr/bin/pkill
  pkill -9 fdevalvex
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:624
- /bin/busybox
  busybox pkill -9 fdevalvex
  2⤵
  PID:625

/bin/sh
sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"
1⤵
PID:626
- /usr/bin/pkill
  pkill -9 scanspc
  2⤵
  - Reads runtime system information
  PID:627
- /bin/busybox
  busybox pkill -9 scanspc
  2⤵
  PID:628

/bin/sh
sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"
1⤵
PID:629
- /usr/bin/pkill
  pkill -9 MELTEDNINJAREALZ
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:630
- /bin/busybox
  busybox pkill -9 MELTEDNINJAREALZ
  2⤵
  PID:631

/bin/sh
sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"
1⤵
PID:632
- /usr/bin/pkill
  pkill -9 flexsonskids
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:633
- /bin/busybox
  busybox pkill -9 flexsonskids
  2⤵
  PID:634

/bin/sh
sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"
1⤵
PID:635
- /usr/bin/pkill
  pkill -9 scanx86
  2⤵
  PID:636
- /bin/busybox
  busybox pkill -9 scanx86
  2⤵
  PID:637

/bin/sh
sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"
1⤵
PID:638
- /usr/bin/pkill
  pkill -9 MISAKI-U79OL
  2⤵
  PID:639
- /bin/busybox
  busybox pkill -9 MISAKI-U79OL
  2⤵
  PID:640

/bin/sh
sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"
1⤵
PID:641
- /usr/bin/pkill
  pkill -9 foAxi102kxe
  2⤵
  PID:642
- /bin/busybox
  busybox pkill -9 foAxi102kxe
  2⤵
  PID:643

/bin/sh
sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"
1⤵
PID:644
- /usr/bin/pkill
  pkill -9 swodjwodjwoj
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:645
- /bin/busybox
  busybox pkill -9 swodjwodjwoj
  2⤵
  PID:646

/bin/sh
sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"
1⤵
PID:647
- /usr/bin/pkill
  pkill -9 MmKiy7f87l
  2⤵
  - Reads CPU attributes
  PID:648
- /bin/busybox
  busybox pkill -9 MmKiy7f87l
  2⤵
  PID:649

/bin/sh
sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"
1⤵
PID:650
- /usr/bin/pkill
  pkill -9 freecookiex86
  2⤵
  - Reads runtime system information
  PID:651
- /bin/busybox
  busybox pkill -9 freecookiex86
  2⤵
  PID:652

/bin/sh
sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"
1⤵
PID:653
- /usr/bin/pkill
  pkill -9 sysgpu
  2⤵
  PID:654
- /bin/busybox
  busybox pkill -9 sysgpu
  2⤵
  PID:655

/bin/sh
sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
1⤵
PID:656
- /usr/bin/pkill
  pkill -9 NiGGeR69xd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:657
- /bin/busybox
  busybox pkill -9 NiGGeR69xd
  2⤵
  PID:658

/bin/sh
sh -c "pkill -9 frgege || busybox pkill -9 frgege"
1⤵
PID:659
- /usr/bin/pkill
  pkill -9 frgege
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:660
- /bin/busybox
  busybox pkill -9 frgege
  2⤵
  PID:661

/bin/sh
sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"
1⤵
PID:662
- /usr/bin/pkill
  pkill -9 sysupdater
  2⤵
  - Reads CPU attributes
  PID:663
- /bin/busybox
  busybox pkill -9 sysupdater
  2⤵
  PID:664

/bin/sh
sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"
1⤵
PID:665
- /usr/bin/pkill
  pkill -9 0DnAzepd
  2⤵
  - Reads CPU attributes
  PID:666
- /bin/busybox
  busybox pkill -9 0DnAzepd
  2⤵
  PID:667

/bin/sh
sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"
1⤵
PID:668
- /usr/bin/pkill
  pkill -9 NiGGeRD0nks69
  2⤵
  PID:669
- /bin/busybox
  busybox pkill -9 NiGGeRD0nks69
  2⤵
  PID:670

/bin/sh
sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"
1⤵
PID:671
- /usr/bin/pkill
  pkill -9 frgreu
  2⤵
  - Reads CPU attributes
  PID:672
- /bin/busybox
  busybox pkill -9 frgreu
  2⤵
  PID:673

/bin/sh
sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"
1⤵
PID:674
- /usr/bin/pkill
  pkill -9 telnetd
  2⤵
  - Reads CPU attributes
  PID:675
- /bin/busybox
  busybox pkill -9 telnetd
  2⤵
  PID:676

/bin/sh
sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"
1⤵
PID:677
- /usr/bin/pkill
  pkill -9 0x766f6964
  2⤵
  - Reads runtime system information
  PID:678
- /bin/busybox
  busybox pkill -9 0x766f6964
  2⤵
  PID:679

/bin/sh
sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"
1⤵
PID:680
- /usr/bin/pkill
  pkill -9 NiGGeRd0nks1337
  2⤵
  PID:681
- /bin/busybox
  busybox pkill -9 NiGGeRd0nks1337
  2⤵
  PID:682

/bin/sh
sh -c "pkill -9 gaft || busybox pkill -9 gaft"
1⤵
PID:683
- /usr/bin/pkill
  pkill -9 gaft
  2⤵
  - Reads CPU attributes
  PID:684
- /bin/busybox
  busybox pkill -9 gaft
  2⤵
  PID:685

/bin/sh
sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"
1⤵
PID:686
- /usr/bin/pkill
  pkill -9 urasgbsigboa
  2⤵
  - Reads CPU attributes
  PID:687
- /bin/busybox
  busybox pkill -9 urasgbsigboa
  2⤵
  PID:688

/bin/sh
sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"
1⤵
PID:689
- /usr/bin/pkill
  pkill -9 120i3UI49
  2⤵
  PID:690
- /bin/busybox
  busybox pkill -9 120i3UI49
  2⤵
  PID:691

/bin/sh
sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"
1⤵
PID:692
- /usr/bin/pkill
  pkill -9 OaF3
  2⤵
  - Reads CPU attributes
  PID:693
- /bin/busybox
  busybox pkill -9 OaF3
  2⤵
  PID:694

/bin/sh
sh -c "pkill -9 geae || busybox pkill -9 geae"
1⤵
PID:695
- /usr/bin/pkill
  pkill -9 geae
  2⤵
  PID:696
- /bin/busybox
  busybox pkill -9 geae
  2⤵
  PID:697

/bin/sh
sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"
1⤵
PID:698
- /usr/bin/pkill
  pkill -9 vaiolmao
  2⤵
  - Reads CPU attributes
  PID:699
- /bin/busybox
  busybox pkill -9 vaiolmao
  2⤵
  PID:700

/bin/sh
sh -c "pkill -9 123123a || busybox pkill -9 123123a"
1⤵
PID:701
- /usr/bin/pkill
  pkill -9 123123a
  2⤵
  - Reads CPU attributes
  PID:702
- /bin/busybox
  busybox pkill -9 123123a
  2⤵
  PID:703

/bin/sh
sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"
1⤵
PID:704
- /usr/bin/pkill
  pkill -9 Ofurain0n4H34D
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:705
- /bin/busybox
  busybox pkill -9 Ofurain0n4H34D
  2⤵
  PID:706

/bin/sh
sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"
1⤵
PID:707
- /usr/bin/pkill
  pkill -9 ggTrex
  2⤵
  - Reads runtime system information
  PID:708
- /bin/busybox
  busybox pkill -9 ggTrex
  2⤵
  PID:709

/bin/sh
sh -c "pkill -9 wasads || busybox pkill -9 wasads"
1⤵
PID:710
- /usr/bin/pkill
  pkill -9 wasads
  2⤵
  PID:711
- /bin/busybox
  busybox pkill -9 wasads
  2⤵
  PID:712

/bin/sh
sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"
1⤵
PID:713
- /usr/bin/pkill
  pkill -9 1293194hjXD
  2⤵
  - Reads runtime system information
  PID:714
- /bin/busybox
  busybox pkill -9 1293194hjXD
  2⤵
  PID:715

/bin/sh
sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"
1⤵
PID:716
- /usr/bin/pkill
  pkill -9 OthLaLosn
  2⤵
  - Reads CPU attributes
  PID:717
- /bin/busybox
  busybox pkill -9 OthLaLosn
  2⤵
  PID:718

/bin/sh
sh -c "pkill -9 ggt || busybox pkill -9 ggt"
1⤵
PID:719
- /usr/bin/pkill
  pkill -9 ggt
  2⤵
  - Reads runtime system information
  PID:720
- /bin/busybox
  busybox pkill -9 ggt
  2⤵
  PID:721

/bin/sh
sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"
1⤵
PID:722
- /usr/bin/pkill
  pkill -9 wget-log
  2⤵
  - Reads CPU attributes
  PID:723
- /bin/busybox
  busybox pkill -9 wget-log
  2⤵
  PID:724

/bin/sh
sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"
1⤵
PID:725
- /usr/bin/pkill
  pkill -9 1337SoraLOADER
  2⤵
  - Reads runtime system information
  PID:726
- /bin/busybox
  busybox pkill -9 1337SoraLOADER
  2⤵
  PID:727

/bin/sh
sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"
1⤵
PID:728
- /usr/bin/pkill
  pkill -9 SAIAKINA
  2⤵
  - Reads CPU attributes
  PID:729
- /bin/busybox
  busybox pkill -9 SAIAKINA
  2⤵
  PID:730

/bin/sh
sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"
1⤵
PID:731
- /usr/bin/pkill
  pkill -9 ggtq
  2⤵
  - Reads CPU attributes
  PID:732
- /bin/busybox
  busybox pkill -9 ggtq
  2⤵
  PID:733

/bin/sh
sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"
1⤵
PID:734
- /usr/bin/pkill
  pkill -9 1378bfp919GRB1Q2
  2⤵
  - Reads CPU attributes
  PID:735
- /bin/busybox
  busybox pkill -9 1378bfp919GRB1Q2
  2⤵
  PID:736

/bin/sh
sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"
1⤵
PID:737
- /usr/bin/pkill
  pkill -9 SAIAKUSO
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:738
- /bin/busybox
  busybox pkill -9 SAIAKUSO
  2⤵
  PID:739

/bin/sh
sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"
1⤵
PID:740
- /usr/bin/pkill
  pkill -9 ggtr
  2⤵
  PID:741
- /bin/busybox
  busybox pkill -9 ggtr
  2⤵
  PID:742

/bin/sh
sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"
1⤵
PID:743
- /usr/bin/pkill
  pkill -9 14Fa
  2⤵
  - Reads CPU attributes
  PID:744
- /bin/busybox
  busybox pkill -9 14Fa
  2⤵
  PID:745

/bin/sh
sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"
1⤵
PID:746
- /usr/bin/pkill
  pkill -9 SEXSLAVE1337
  2⤵
  - Reads CPU attributes
  PID:747
- /bin/busybox
  busybox pkill -9 SEXSLAVE1337
  2⤵
  PID:748

/bin/sh
sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"
1⤵
PID:749
- /usr/bin/pkill
  pkill -9 ggtt
  2⤵
  - Reads CPU attributes
  PID:750
- /bin/busybox
  busybox pkill -9 ggtt
  2⤵
  PID:751

/bin/sh
sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"
1⤵
PID:752
- /usr/bin/pkill
  pkill -9 1902a3u912u3u4
  2⤵
  - Reads runtime system information
  PID:753
- /bin/busybox
  busybox pkill -9 1902a3u912u3u4
  2⤵
  PID:754

/bin/sh
sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
1⤵
PID:755
- /usr/bin/pkill
  pkill -9 SO190Ij1X
  2⤵
  - Reads CPU attributes
  PID:756
- /bin/busybox
  busybox pkill -9 SO190Ij1X
  2⤵
  PID:757

/bin/sh
sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"
1⤵
PID:758
- /usr/bin/pkill
  pkill -9 haetrghbr
  2⤵
  - Reads runtime system information
  PID:759
- /bin/busybox
  busybox pkill -9 haetrghbr
  2⤵
  PID:760

/bin/sh
sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"
1⤵
PID:761
- /usr/bin/pkill
  pkill -9 19ju3d
  2⤵
  - Reads CPU attributes
  PID:762
- /bin/busybox
  busybox pkill -9 19ju3d
  2⤵
  PID:763

/bin/sh
sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"
1⤵
PID:764
- /usr/bin/pkill
  pkill -9 SORAojkf120
  2⤵
  - Reads CPU attributes
  PID:765
- /bin/busybox
  busybox pkill -9 SORAojkf120
  2⤵
  PID:766

/bin/sh
sh -c "pkill -9 hehahejeje92 || busybox pkill -9 hehahejeje92"
1⤵
PID:767
- /usr/bin/pkill
  pkill -9 hehahejeje92
  2⤵
  - Reads runtime system information
  PID:768
- /bin/busybox
  busybox pkill -9 hehahejeje92
  2⤵
  PID:769

/bin/sh
sh -c "pkill -9 2U2JDJA901F91 || busybox pkill -9 2U2JDJA901F91"
1⤵
PID:770
- /usr/bin/pkill
  pkill -9 2U2JDJA901F91
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:771
- /bin/busybox
  busybox pkill -9 2U2JDJA901F91
  2⤵
  PID:772

/bin/sh
sh -c "pkill -9 SlaVLav12 || busybox pkill -9 SlaVLav12"
1⤵
PID:773
- /usr/bin/pkill
  pkill -9 SlaVLav12
  2⤵
  - Reads runtime system information
  PID:774
- /bin/busybox
  busybox pkill -9 SlaVLav12
  2⤵
  PID:775

/bin/sh
sh -c "pkill -9 helpmedaddthhhhh || busybox pkill -9 helpmedaddthhhhh"
1⤵
PID:776
- /usr/bin/pkill
  pkill -9 helpmedaddthhhhh
  2⤵
  - Reads CPU attributes
  PID:777
- /bin/busybox
  busybox pkill -9 helpmedaddthhhhh
  2⤵
  PID:778

/bin/sh
sh -c "pkill -9 2wgg9qphbq || busybox pkill -9 2wgg9qphbq"
1⤵
PID:779
- /usr/bin/pkill
  pkill -9 2wgg9qphbq
  2⤵
  PID:780
- /bin/busybox
  busybox pkill -9 2wgg9qphbq
  2⤵
  PID:781

/bin/sh
sh -c "pkill -9 Slav3Th3seD3vices || busybox pkill -9 Slav3Th3seD3vices"
1⤵
PID:782
- /usr/bin/pkill
  pkill -9 Slav3Th3seD3vices
  2⤵
  - Reads runtime system information
  PID:783
- /bin/busybox
  busybox pkill -9 Slav3Th3seD3vices
  2⤵
  PID:784

/bin/sh
sh -c "pkill -9 hzSmYZjYMQ || busybox pkill -9 hzSmYZjYMQ"
1⤵
PID:785
- /usr/bin/pkill
  pkill -9 hzSmYZjYMQ
  2⤵
  PID:786
- /bin/busybox
  busybox pkill -9 hzSmYZjYMQ
  2⤵
  PID:787

/bin/sh
sh -c "pkill -9 5Gbf || busybox pkill -9 5Gbf"
1⤵
PID:788
- /usr/bin/pkill
  pkill -9 5Gbf
  2⤵
  - Reads CPU attributes
  PID:789
- /bin/busybox
  busybox pkill -9 5Gbf
  2⤵
  PID:790

/bin/sh
sh -c "pkill -9 SoRAxD123LOL || busybox pkill -9 SoRAxD123LOL"
1⤵
PID:791
- /usr/bin/pkill
  pkill -9 SoRAxD123LOL
  2⤵
  - Reads CPU attributes
  PID:792
- /bin/busybox
  busybox pkill -9 SoRAxD123LOL
  2⤵
  PID:793

/bin/sh
sh -c "pkill -9 iaGv || busybox pkill -9 iaGv"
1⤵
PID:794
- /usr/bin/pkill
  pkill -9 iaGv
  2⤵
  PID:795
- /bin/busybox
  busybox pkill -9 iaGv
  2⤵
  PID:796

/bin/sh
sh -c "pkill -9 5aA3 || busybox pkill -9 5aA3"
1⤵
PID:797
- /usr/bin/pkill
  pkill -9 5aA3
  2⤵
  - Reads CPU attributes
  PID:798
- /bin/busybox
  busybox pkill -9 5aA3
  2⤵
  PID:799

/bin/sh
sh -c "pkill -9 SoRAxD420LOL || busybox pkill -9 SoRAxD420LOL"
1⤵
PID:800
- /usr/bin/pkill
  pkill -9 SoRAxD420LOL
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:801
- /bin/busybox
  busybox pkill -9 SoRAxD420LOL
  2⤵
  PID:802

/bin/sh
sh -c "pkill -9 insomni || busybox pkill -9 insomni"
1⤵
PID:803
- /usr/bin/pkill
  pkill -9 insomni
  2⤵
  PID:804
- /bin/busybox
  busybox pkill -9 insomni
  2⤵
  PID:805

/bin/sh
sh -c "pkill -9 640277 || busybox pkill -9 640277"
1⤵
PID:806
- /usr/bin/pkill
  pkill -9 640277
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:807
- /bin/busybox
  busybox pkill -9 640277
  2⤵
  PID:808

/bin/sh
sh -c "pkill -9 SoraBeReppin1337 || busybox pkill -9 SoraBeReppin1337"
1⤵
PID:809
- /usr/bin/pkill
  pkill -9 SoraBeReppin1337
  2⤵
  - Reads runtime system information
  PID:810
- /bin/busybox
  busybox pkill -9 SoraBeReppin1337
  2⤵
  PID:811

/bin/sh
sh -c "pkill -9 ipcamCache || busybox pkill -9 ipcamCache"
1⤵
PID:812
- /usr/bin/pkill
  pkill -9 ipcamCache
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:813
- /bin/busybox
  busybox pkill -9 ipcamCache
  2⤵
  PID:814

/bin/sh
sh -c "pkill -9 66tlGg9Q || busybox pkill -9 66tlGg9Q"
1⤵
PID:815
- /usr/bin/pkill
  pkill -9 66tlGg9Q
  2⤵
  - Reads CPU attributes
  PID:816
- /bin/busybox
  busybox pkill -9 66tlGg9Q
  2⤵
  PID:817

/bin/sh
sh -c "pkill -9 T || busybox pkill -9 T"
1⤵
PID:818
- /usr/bin/pkill
  pkill -9 T
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:819
- /bin/busybox
  busybox pkill -9 T
  2⤵
  PID:820

/bin/sh
sh -c "pkill -9 jUYfouyf87 || busybox pkill -9 jUYfouyf87"
1⤵
PID:821
- /usr/bin/pkill
  pkill -9 jUYfouyf87
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:822
- /bin/busybox
  busybox pkill -9 jUYfouyf87
  2⤵
  PID:823

/bin/sh
sh -c "pkill -9 6ke3 || busybox pkill -9 6ke3"
1⤵
PID:824
- /usr/bin/pkill
  pkill -9 6ke3
  2⤵
  - Reads CPU attributes
  PID:825
- /bin/busybox
  busybox pkill -9 6ke3
  2⤵
  PID:826

/bin/sh
sh -c "pkill -9 TOKYO3 || busybox pkill -9 TOKYO3"
1⤵
PID:827
- /usr/bin/pkill
  pkill -9 TOKYO3
  2⤵
  PID:828
- /bin/busybox
  busybox pkill -9 TOKYO3
  2⤵
  PID:829

/bin/sh
sh -c "pkill -9 lyEeaXul2dULCVxh || busybox pkill -9 lyEeaXul2dULCVxh"
1⤵
PID:830
- /usr/bin/pkill
  pkill -9 lyEeaXul2dULCVxh
  2⤵
  PID:831
- /bin/busybox
  busybox pkill -9 lyEeaXul2dULCVxh
  2⤵
  PID:832

/bin/sh
sh -c "pkill -9 93OfjHZ2z || busybox pkill -9 93OfjHZ2z"
1⤵
PID:833
- /usr/bin/pkill
  pkill -9 93OfjHZ2z
  2⤵
  - Reads runtime system information
  PID:834
- /bin/busybox
  busybox pkill -9 93OfjHZ2z
  2⤵
  PID:835

/bin/sh
sh -c "pkill -9 TY2gD6MZvKc7KU6r || busybox pkill -9 TY2gD6MZvKc7KU6r"
1⤵
PID:836
- /usr/bin/pkill
  pkill -9 TY2gD6MZvKc7KU6r
  2⤵
  PID:837
- /bin/busybox
  busybox pkill -9 TY2gD6MZvKc7KU6r
  2⤵
  PID:838

/bin/sh
sh -c "pkill -9 mMkiy6f87l || busybox pkill -9 mMkiy6f87l"
1⤵
PID:839
- /usr/bin/pkill
  pkill -9 mMkiy6f87l
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:840
- /bin/busybox
  busybox pkill -9 mMkiy6f87l
  2⤵
  PID:841

/bin/sh
sh -c "pkill -9 A023UU4U24UIU || busybox pkill -9 A023UU4U24UIU"
1⤵
PID:842
- /usr/bin/pkill
  pkill -9 A023UU4U24UIU
  2⤵
  - Reads CPU attributes
  PID:843
- /bin/busybox
  busybox pkill -9 A023UU4U24UIU
  2⤵
  PID:844

/bin/sh
sh -c "pkill -9 TheWeeknd || busybox pkill -9 TheWeeknd"
1⤵
PID:845
- /usr/bin/pkill
  pkill -9 TheWeeknd
  2⤵
  - Reads runtime system information
  PID:846
- /bin/busybox
  busybox pkill -9 TheWeeknd
  2⤵
  PID:847

/bin/sh
sh -c "pkill -9 mioribitches || busybox pkill -9 mioribitches"
1⤵
PID:848
- /usr/bin/pkill
  pkill -9 mioribitches
  2⤵
  - Reads runtime system information
  PID:849
- /bin/busybox
  busybox pkill -9 mioribitches
  2⤵
  PID:850

/bin/sh
sh -c "pkill -9 A5p9 || busybox pkill -9 A5p9"
1⤵
PID:851
- /usr/bin/pkill
  pkill -9 A5p9
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:852
- /bin/busybox
  busybox pkill -9 A5p9
  2⤵
  PID:853

/bin/sh
sh -c "pkill -9 TheWeeknds || busybox pkill -9 TheWeeknds"
1⤵
PID:854
- /usr/bin/pkill
  pkill -9 TheWeeknds
  2⤵
  - Reads CPU attributes
  PID:855
- /bin/busybox
  busybox pkill -9 TheWeeknds
  2⤵
  PID:856

/bin/sh
sh -c "pkill -9 mnblkjpoi || busybox pkill -9 mnblkjpoi"
1⤵
PID:857
- /usr/bin/pkill
  pkill -9 mnblkjpoi
  2⤵
  - Reads runtime system information
  PID:858
- /bin/busybox
  busybox pkill -9 mnblkjpoi
  2⤵
  PID:859

/bin/sh
sh -c "pkill -9 AbAd || busybox pkill -9 AbAd"
1⤵
PID:860
- /usr/bin/pkill
  pkill -9 AbAd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:861
- /bin/busybox
  busybox pkill -9 AbAd
  2⤵
  PID:862

/bin/sh
sh -c "pkill -9 Tokyos || busybox pkill -9 Tokyos"
1⤵
PID:863
- /usr/bin/pkill
  pkill -9 Tokyos
  2⤵
  - Reads CPU attributes
  PID:864
- /bin/busybox
  busybox pkill -9 Tokyos
  2⤵
  PID:865

/bin/sh
sh -c "pkill -9 neb || busybox pkill -9 neb"
1⤵
PID:866
- /usr/bin/pkill
  pkill -9 neb
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:867
- /bin/busybox
  busybox pkill -9 neb
  2⤵
  PID:868

/bin/sh
sh -c "pkill -9 Akiru || busybox pkill -9 Akiru"
1⤵
PID:869
- /usr/bin/pkill
  pkill -9 Akiru
  2⤵
  - Reads CPU attributes
  PID:870
- /bin/busybox
  busybox pkill -9 Akiru
  2⤵
  PID:871

/bin/sh
sh -c "pkill -9 U8inTz || busybox pkill -9 U8inTz"
1⤵
PID:872
- /usr/bin/pkill
  pkill -9 U8inTz
  2⤵
  - Reads runtime system information
  PID:873
- /bin/busybox
  busybox pkill -9 U8inTz
  2⤵
  PID:874

/bin/sh
sh -c "pkill -9 netstats || busybox pkill -9 netstats"
1⤵
PID:875
- /usr/bin/pkill
  pkill -9 netstats
  2⤵
  - Reads CPU attributes
  PID:876
- /bin/busybox
  busybox pkill -9 netstats
  2⤵
  PID:877

/bin/sh
sh -c "pkill -9 Alex || busybox pkill -9 Alex"
1⤵
PID:878
- /usr/bin/pkill
  pkill -9 Alex
  2⤵
  - Reads runtime system information
  PID:879
- /bin/busybox
  busybox pkill -9 Alex
  2⤵
  PID:880

/bin/sh
sh -c "pkill -9 W9RCAKM20T || busybox pkill -9 W9RCAKM20T"
1⤵
PID:881
- /usr/bin/pkill
  pkill -9 W9RCAKM20T
  2⤵
  - Reads CPU attributes
  PID:882
- /bin/busybox
  busybox pkill -9 W9RCAKM20T
  2⤵
  PID:883

/bin/sh
sh -c "pkill -9 newnetword || busybox pkill -9 newnetword"
1⤵
PID:884
- /usr/bin/pkill
  pkill -9 newnetword
  2⤵
  - Reads runtime system information
  PID:885
- /bin/busybox
  busybox pkill -9 newnetword
  2⤵
  PID:886

/bin/sh
sh -c "pkill -9 Ayo215 || busybox pkill -9 Ayo215"
1⤵
PID:887
- /usr/bin/pkill
  pkill -9 Ayo215
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:888
- /bin/busybox
  busybox pkill -9 Ayo215
  2⤵
  PID:889

/bin/sh
sh -c "pkill -9 Word || busybox pkill -9 Word"
1⤵
PID:890
- /usr/bin/pkill
  pkill -9 Word
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:891
- /bin/busybox
  busybox pkill -9 Word
  2⤵
  PID:892

/bin/sh
sh -c "pkill -9 nloads || busybox pkill -9 nloads"
1⤵
PID:893
- /usr/bin/pkill
  pkill -9 nloads
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:894
- /bin/busybox
  busybox pkill -9 nloads
  2⤵
  PID:895

/bin/sh
sh -c "pkill -9 BAdAsV || busybox pkill -9 BAdAsV"
1⤵
PID:896
- /usr/bin/pkill
  pkill -9 BAdAsV
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:897
- /bin/busybox
  busybox pkill -9 BAdAsV
  2⤵
  PID:898

/bin/sh
sh -c "pkill -9 Wordmane || busybox pkill -9 Wordmane"
1⤵
PID:899
- /usr/bin/pkill
  pkill -9 Wordmane
  2⤵
  PID:900
- /bin/busybox
  busybox pkill -9 Wordmane
  2⤵
  PID:901

/bin/sh
sh -c "pkill -9 notyakuzaa || busybox pkill -9 notyakuzaa"
1⤵
PID:902
- /usr/bin/pkill
  pkill -9 notyakuzaa
  2⤵
  - Reads runtime system information
  PID:903
- /bin/busybox
  busybox pkill -9 notyakuzaa
  2⤵
  PID:904

/bin/sh
sh -c "pkill -9 Belch || busybox pkill -9 Belch"
1⤵
PID:905
- /usr/bin/pkill
  pkill -9 Belch
  2⤵
  PID:906
- /bin/busybox
  busybox pkill -9 Belch
  2⤵
  PID:907

/bin/sh
sh -c "pkill -9 Wordnets || busybox pkill -9 Wordnets"
1⤵
PID:908
- /usr/bin/pkill
  pkill -9 Wordnets
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:909
- /bin/busybox
  busybox pkill -9 Wordnets
  2⤵
  PID:910

/bin/sh
sh -c "pkill -9 obp || busybox pkill -9 obp"
1⤵
PID:911
- /usr/bin/pkill
  pkill -9 obp
  2⤵
  PID:912
- /bin/busybox
  busybox pkill -9 obp
  2⤵
  PID:913

/bin/sh
sh -c "pkill -9 BigN0gg0r420 || busybox pkill -9 BigN0gg0r420"
1⤵
PID:914
- /usr/bin/pkill
  pkill -9 BigN0gg0r420
  2⤵
  - Reads CPU attributes
  PID:915

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

description	ioc	Process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads