d44b6322497ea75712710dbb74f0fdd47d34e7f7e55bc8e68ac052f4a883db1e

General

Target

unk.sh
Size

32KB
MD5

915341f64bd315170331b0c9c0ec243f
SHA1

61ec9154737c859b33874f35b88453c2c05d7164
SHA256

d44b6322497ea75712710dbb74f0fdd47d34e7f7e55bc8e68ac052f4a883db1e
SHA512

4d3712ba3c8d7f3ddb4c6635036268a04a9a0559e42bd479409bd345f5046c3b38408ea17eaf1fa7c7c9940752078066083b40fc934764d4d31a0eddc938d6c3

Score

9^/10

persistence

Malware Config

Signatures

Deletes system logs 1 TTPs 1 IoCs

Indicator Removal on Host
T1070

Processes:

rm

description ioc process

/var/log/syslog /var/log/syslog rm
Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.

Processes:

sudo

description ioc process

/etc/hosts /etc/hosts sudo
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

sudo

description ioc process

/etc/resolv.conf /etc/resolv.conf sudo
Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
persistence

Scheduled Task
T1053

Processes:

chattrchattr

description ioc process

/var/spool/cron/crontabs /var/spool/cron/crontabs chattr
/etc/crontab /etc/crontab chattr
Write file to user bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

ufw

description ioc process

/usr/bin/pyvenv.cfg /usr/bin/pyvenv.cfg ufw
/usr/sbin/ufw /usr/sbin/ufw ufw

description	ioc	process
/var/log/syslog	/var/log/syslog	rm

description	ioc	process
/etc/hosts	/etc/hosts	sudo

description	ioc	process
/etc/resolv.conf	/etc/resolv.conf	sudo

description	ioc	process
/var/spool/cron/crontabs	/var/spool/cron/crontabs	chattr
/etc/crontab	/etc/crontab	chattr

description	ioc	process
/usr/bin/pyvenv.cfg	/usr/bin/pyvenv.cfg	ufw
/usr/sbin/ufw	/usr/sbin/ufw	ufw

Reads CPU attributes 1 TTPs 5 IoCs

System Information Discovery

T1082

Processes:

pspspkillpspkill

description	ioc	process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

modprobe

description	ioc	process
/sys/module/ip6_tables/initstate	/sys/module/ip6_tables/initstate	modprobe
/sys/module/x_tables/initstate	/sys/module/x_tables/initstate	modprobe

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pspkillpspkillps

description	ioc	process
/proc/78/status	/proc/78/status	ps
/proc/3/cmdline	/proc/3/cmdline	pkill
/proc/251/cmdline	/proc/251/cmdline	ps
/proc/169/status	/proc/169/status	pkill
/proc/2/cmdline	/proc/2/cmdline	pkill
/proc/30/status	/proc/30/status	pkill
/proc/12/status	/proc/12/status	pkill
/proc/16/cmdline	/proc/16/cmdline	ps
/proc/78/stat	/proc/78/stat	ps
/proc/160/status	/proc/160/status	ps
/proc/568/status	/proc/568/status	ps
/proc/798/status	/proc/798/status	ps
/proc/12/cmdline	/proc/12/cmdline	ps
/proc/32/status	/proc/32/status	ps
/proc/347/status	/proc/347/status	ps
/proc/9/status	/proc/9/status	pkill
/proc/393/cmdline	/proc/393/cmdline	pkill
/proc/165/cmdline	/proc/165/cmdline	pkill
/proc/32/cmdline	/proc/32/cmdline	ps
/proc/165/status	/proc/165/status	pkill
/proc/349/stat	/proc/349/stat	ps
/proc/394/stat	/proc/394/stat	ps
/proc/self/stat	/proc/self/stat	ps
/proc/160/cmdline	/proc/160/cmdline	ps
/proc/15/cmdline	/proc/15/cmdline	pkill
/proc/12/stat	/proc/12/stat	ps
/proc/5/cmdline	/proc/5/cmdline	pkill
/proc/168/cmdline	/proc/168/cmdline	ps
/proc/252/status	/proc/252/status	ps
/proc/34/status	/proc/34/status	pkill
/proc/159/cmdline	/proc/159/cmdline	pkill
/proc/13/stat	/proc/13/stat	ps
/proc/14/cmdline	/proc/14/cmdline	ps
/proc/568/stat	/proc/568/stat	ps
/proc/3/stat	/proc/3/stat	ps
/proc/85/stat	/proc/85/stat	ps
/proc/160/cmdline	/proc/160/cmdline	ps
/proc/80/status	/proc/80/status	ps
/proc/84/cmdline	/proc/84/cmdline	pkill
/proc/35/cmdline	/proc/35/cmdline	ps
/proc/89/stat	/proc/89/stat	ps
/proc/36/cmdline	/proc/36/cmdline	pkill
/proc/763/stat	/proc/763/stat	ps
/proc/8/stat	/proc/8/stat	ps
/proc/16/status	/proc/16/status	ps
/proc/18/status	/proc/18/status	pkill
/proc/20/stat	/proc/20/stat	ps
/proc/14/status	/proc/14/status	ps
/proc/238/status	/proc/238/status	ps
/proc/5/status	/proc/5/status	ps
/proc/15/status	/proc/15/status	ps
/proc/115/stat	/proc/115/stat	ps
/proc/156/status	/proc/156/status	ps
/proc/342/status	/proc/342/status	ps
/proc/161/status	/proc/161/status	pkill
/proc/238/status	/proc/238/status	pkill
/proc/127/cmdline	/proc/127/cmdline	ps
/proc/169/cmdline	/proc/169/cmdline	pkill
/proc/159/cmdline	/proc/159/cmdline	ps
/proc/15/status	/proc/15/status	pkill
/proc/20/cmdline	/proc/20/cmdline	pkill
/proc/541/cmdline	/proc/541/cmdline	pkill
/proc/153/cmdline	/proc/153/cmdline	ps
/proc/11/cmdline	/proc/11/cmdline	pkill

Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.

Processes:

chattrunk.shrmrmrm

description ioc process

/tmp/ /tmp/ chattr
/tmp/log_rot /tmp/log_rot unk.sh
/tmp/addres* /tmp/addres* rm
/tmp/walle* /tmp/walle* rm
/tmp/keys /tmp/keys rm

description	ioc	process
/tmp/	/tmp/	chattr
/tmp/log_rot	/tmp/log_rot	unk.sh
/tmp/addres*	/tmp/addres*	rm
/tmp/walle*	/tmp/walle*	rm
/tmp/keys	/tmp/keys	rm

./unk.sh
./unk.sh
1⤵
- Writes file to tmp directory
PID:570

/bin/rm
rm -rf /var/log/syslog
2⤵
- Deletes system logs
PID:571

/usr/bin/chattr
chattr -iua /tmp/
2⤵
- Writes file to tmp directory
PID:572

/usr/bin/chattr
chattr -iua /var/tmp/
2⤵
PID:573

/usr/bin/chattr
chattr -R -i /var/spool/cron
2⤵
- Creates/modifies Cron job
PID:574

/usr/bin/chattr
chattr -i /etc/crontab
2⤵
- Creates/modifies Cron job
PID:575

/usr/sbin/ufw
ufw disable
2⤵
- Write file to user bin folder
PID:576

/sbin/iptables
/sbin/iptables -V
3⤵
PID:578

/lib/ufw/ufw-init
/lib/ufw/ufw-init force-stop
3⤵
PID:582

/sbin/ip6tables
ip6tables -L INPUT -n
4⤵
PID:583

/sbin/iptables
iptables -F ufw-logging-deny
4⤵
PID:588

/sbin/iptables
iptables -F ufw-logging-allow
4⤵
PID:591

/sbin/iptables
iptables -F ufw-not-local
4⤵
PID:592

/sbin/iptables
iptables -F ufw-user-logging-input
4⤵
PID:593

/sbin/iptables
iptables -F ufw-user-limit-accept
4⤵
PID:594

/sbin/iptables
iptables -F ufw-user-limit
4⤵
PID:595

/sbin/iptables
iptables -F ufw-skip-to-policy-input
4⤵
PID:596

/sbin/iptables
iptables -F ufw-reject-input
4⤵
PID:597

/sbin/iptables
iptables -F ufw-after-logging-input
4⤵
PID:598

/sbin/iptables
iptables -F ufw-after-input
4⤵
PID:599

/sbin/iptables
iptables -F ufw-user-input
4⤵
PID:600

/sbin/iptables
iptables -F ufw-before-input
4⤵
PID:601

/sbin/iptables
iptables -F ufw-before-logging-input
4⤵
PID:602

/sbin/iptables
iptables -F ufw-skip-to-policy-forward
4⤵
PID:603

/sbin/iptables
iptables -F ufw-reject-forward
4⤵
PID:604

/sbin/iptables
iptables -F ufw-after-logging-forward
4⤵
PID:605

/sbin/iptables
iptables -F ufw-after-forward
4⤵
PID:606

/sbin/iptables
iptables -F ufw-user-logging-forward
4⤵
PID:607

/sbin/iptables
iptables -F ufw-user-forward
4⤵
PID:608

/sbin/iptables
iptables -F ufw-before-forward
4⤵
PID:609

/sbin/iptables
iptables -F ufw-before-logging-forward
4⤵
PID:610

/sbin/iptables
iptables -F ufw-track-forward
4⤵
PID:611

/sbin/iptables
iptables -F ufw-track-output
4⤵
PID:612

/sbin/iptables
iptables -F ufw-track-input
4⤵
PID:613

/sbin/iptables
iptables -F ufw-skip-to-policy-output
4⤵
PID:614

/sbin/iptables
iptables -F ufw-reject-output
4⤵
PID:615

/sbin/iptables
iptables -F ufw-after-logging-output
4⤵
PID:616

/sbin/iptables
iptables -F ufw-after-output
4⤵
PID:617

/sbin/iptables
iptables -F ufw-user-logging-output
4⤵
PID:618

/sbin/iptables
iptables -F ufw-user-output
4⤵
PID:619

/sbin/iptables
iptables -F ufw-before-output
4⤵
PID:620

/sbin/iptables
iptables -F ufw-before-logging-output
4⤵
PID:621

/sbin/iptables
iptables -Z ufw-logging-deny
4⤵
PID:622

/sbin/iptables
iptables -Z ufw-logging-allow
4⤵
PID:623

/sbin/iptables
iptables -Z ufw-not-local
4⤵
PID:624

/sbin/iptables
iptables -Z ufw-user-logging-input
4⤵
PID:625

/sbin/iptables
iptables -Z ufw-user-limit-accept
4⤵
PID:626

/sbin/iptables
iptables -Z ufw-user-limit
4⤵
PID:627

/sbin/iptables
iptables -Z ufw-skip-to-policy-input
4⤵
PID:628

/sbin/iptables
iptables -Z ufw-reject-input
4⤵
PID:629

/sbin/iptables
iptables -Z ufw-after-logging-input
4⤵
PID:630

/sbin/iptables
iptables -Z ufw-after-input
4⤵
PID:631

/sbin/iptables
iptables -Z ufw-user-input
4⤵
PID:632

/sbin/iptables
iptables -Z ufw-before-input
4⤵
PID:633

/sbin/iptables
iptables -Z ufw-before-logging-input
4⤵
PID:634

/sbin/iptables
iptables -Z ufw-skip-to-policy-forward
4⤵
PID:635

/sbin/iptables
iptables -Z ufw-reject-forward
4⤵
PID:636

/sbin/iptables
iptables -Z ufw-after-logging-forward
4⤵
PID:637

/sbin/iptables
iptables -Z ufw-after-forward
4⤵
PID:638

/sbin/iptables
iptables -Z ufw-user-logging-forward
4⤵
PID:639

/sbin/iptables
iptables -Z ufw-user-forward
4⤵
PID:640

/sbin/iptables
iptables -Z ufw-before-forward
4⤵
PID:641

/sbin/iptables
iptables -Z ufw-before-logging-forward
4⤵
PID:642

/sbin/iptables
iptables -Z ufw-track-forward
4⤵
PID:643

/sbin/iptables
iptables -Z ufw-track-output
4⤵
PID:644

/sbin/iptables
iptables -Z ufw-track-input
4⤵
PID:645

/sbin/iptables
iptables -Z ufw-skip-to-policy-output
4⤵
PID:646

/sbin/iptables
iptables -Z ufw-reject-output
4⤵
PID:647

/sbin/iptables
iptables -Z ufw-after-logging-output
4⤵
PID:648

/sbin/iptables
iptables -Z ufw-after-output
4⤵
PID:649

/sbin/iptables
iptables -Z ufw-user-logging-output
4⤵
PID:650

/sbin/iptables
iptables -Z ufw-user-output
4⤵
PID:651

/sbin/iptables
iptables -Z ufw-before-output
4⤵
PID:652

/sbin/iptables
iptables -Z ufw-before-logging-output
4⤵
PID:653

/sbin/iptables
iptables -X ufw-logging-deny
4⤵
PID:654

/sbin/iptables
iptables -X ufw-logging-allow
4⤵
PID:655

/sbin/iptables
iptables -X ufw-not-local
4⤵
PID:656

/sbin/iptables
iptables -X ufw-user-logging-input
4⤵
PID:657

/sbin/iptables
iptables -X ufw-user-logging-output
4⤵
PID:658

/sbin/iptables
iptables -X ufw-user-logging-forward
4⤵
PID:659

/sbin/iptables
iptables -X ufw-user-limit-accept
4⤵
PID:660

/sbin/iptables
iptables -X ufw-user-limit
4⤵
PID:661

/sbin/iptables
iptables -X ufw-user-input
4⤵
PID:662

/sbin/iptables
iptables -X ufw-user-forward
4⤵
PID:663

/sbin/iptables
iptables -X ufw-user-output
4⤵
PID:664

/sbin/iptables
iptables -X ufw-skip-to-policy-input
4⤵
PID:665

/sbin/iptables
iptables -X ufw-skip-to-policy-output
4⤵
PID:666

/sbin/iptables
iptables -X ufw-skip-to-policy-forward
4⤵
PID:667

/sbin/iptables
iptables -P INPUT ACCEPT
4⤵
PID:668

/sbin/iptables
iptables -P OUTPUT ACCEPT
4⤵
PID:669

/sbin/iptables
iptables -P FORWARD ACCEPT
4⤵
PID:670

/sbin/ip6tables
ip6tables -F ufw6-logging-deny
4⤵
PID:671

/sbin/ip6tables
ip6tables -F ufw6-logging-allow
4⤵
PID:672

/sbin/ip6tables
ip6tables -F ufw6-not-local
4⤵
PID:673

/sbin/ip6tables
ip6tables -F ufw6-user-logging-input
4⤵
PID:674

/sbin/ip6tables
ip6tables -F ufw6-user-limit-accept
4⤵
PID:675

/sbin/ip6tables
ip6tables -F ufw6-user-limit
4⤵
PID:676

/sbin/ip6tables
ip6tables -F ufw6-skip-to-policy-input
4⤵
PID:677

/sbin/ip6tables
ip6tables -F ufw6-reject-input
4⤵
PID:678

/sbin/ip6tables
ip6tables -F ufw6-after-logging-input
4⤵
PID:679

/sbin/ip6tables
ip6tables -F ufw6-after-input
4⤵
PID:680

/sbin/ip6tables
ip6tables -F ufw6-user-input
4⤵
PID:681

/sbin/ip6tables
ip6tables -F ufw6-before-input
4⤵
PID:682

/sbin/ip6tables
ip6tables -F ufw6-before-logging-input
4⤵
PID:683

/sbin/ip6tables
ip6tables -F ufw6-skip-to-policy-forward
4⤵
PID:684

/sbin/ip6tables
ip6tables -F ufw6-reject-forward
4⤵
PID:685

/sbin/ip6tables
ip6tables -F ufw6-after-logging-forward
4⤵
PID:686

/sbin/ip6tables
ip6tables -F ufw6-after-forward
4⤵
PID:687

/sbin/ip6tables
ip6tables -F ufw6-user-logging-forward
4⤵
PID:688

/sbin/ip6tables
ip6tables -F ufw6-user-forward
4⤵
PID:689

/sbin/ip6tables
ip6tables -F ufw6-before-forward
4⤵
PID:690

/sbin/ip6tables
ip6tables -F ufw6-before-logging-forward
4⤵
PID:691

/sbin/ip6tables
ip6tables -F ufw6-track-forward
4⤵
PID:692

/sbin/ip6tables
ip6tables -F ufw6-track-output
4⤵
PID:693

/sbin/ip6tables
ip6tables -F ufw6-track-input
4⤵
PID:694

/sbin/ip6tables
ip6tables -F ufw6-skip-to-policy-output
4⤵
PID:695

/sbin/ip6tables
ip6tables -F ufw6-reject-output
4⤵
PID:696

/sbin/ip6tables
ip6tables -F ufw6-after-logging-output
4⤵
PID:697

/sbin/ip6tables
ip6tables -F ufw6-after-output
4⤵
PID:698

/sbin/ip6tables
ip6tables -F ufw6-user-logging-output
4⤵
PID:699

/sbin/ip6tables
ip6tables -F ufw6-user-output
4⤵
PID:700

/sbin/ip6tables
ip6tables -F ufw6-before-output
4⤵
PID:701

/sbin/ip6tables
ip6tables -F ufw6-before-logging-output
4⤵
PID:702

/sbin/ip6tables
ip6tables -Z ufw6-logging-deny
4⤵
PID:703

/sbin/ip6tables
ip6tables -Z ufw6-logging-allow
4⤵
PID:704

/sbin/ip6tables
ip6tables -Z ufw6-not-local
4⤵
PID:705

/sbin/ip6tables
ip6tables -Z ufw6-user-logging-input
4⤵
PID:706

/sbin/ip6tables
ip6tables -Z ufw6-user-limit-accept
4⤵
PID:707

/sbin/ip6tables
ip6tables -Z ufw6-user-limit
4⤵
PID:708

/sbin/ip6tables
ip6tables -Z ufw6-skip-to-policy-input
4⤵
PID:709

/sbin/ip6tables
ip6tables -Z ufw6-reject-input
4⤵
PID:710

/sbin/ip6tables
ip6tables -Z ufw6-after-logging-input
4⤵
PID:711

/sbin/ip6tables
ip6tables -Z ufw6-after-input
4⤵
PID:712

/sbin/ip6tables
ip6tables -Z ufw6-user-input
4⤵
PID:713

/sbin/ip6tables
ip6tables -Z ufw6-before-input
4⤵
PID:714

/sbin/ip6tables
ip6tables -Z ufw6-before-logging-input
4⤵
PID:715

/sbin/ip6tables
ip6tables -Z ufw6-skip-to-policy-forward
4⤵
PID:716

/sbin/ip6tables
ip6tables -Z ufw6-reject-forward
4⤵
PID:717

/sbin/ip6tables
ip6tables -Z ufw6-after-logging-forward
4⤵
PID:718

/sbin/ip6tables
ip6tables -Z ufw6-after-forward
4⤵
PID:719

/sbin/ip6tables
ip6tables -Z ufw6-user-logging-forward
4⤵
PID:720

/sbin/ip6tables
ip6tables -Z ufw6-user-forward
4⤵
PID:721

/sbin/ip6tables
ip6tables -Z ufw6-before-forward
4⤵
PID:722

/sbin/ip6tables
ip6tables -Z ufw6-before-logging-forward
4⤵
PID:723

/sbin/ip6tables
ip6tables -Z ufw6-track-forward
4⤵
PID:724

/sbin/ip6tables
ip6tables -Z ufw6-track-output
4⤵
PID:725

/sbin/ip6tables
ip6tables -Z ufw6-track-input
4⤵
PID:726

/sbin/ip6tables
ip6tables -Z ufw6-skip-to-policy-output
4⤵
PID:727

/sbin/ip6tables
ip6tables -Z ufw6-reject-output
4⤵
PID:728

/sbin/ip6tables
ip6tables -Z ufw6-after-logging-output
4⤵
PID:729

/sbin/ip6tables
ip6tables -Z ufw6-after-output
4⤵
PID:730

/sbin/ip6tables
ip6tables -Z ufw6-user-logging-output
4⤵
PID:731

/sbin/ip6tables
ip6tables -Z ufw6-user-output
4⤵
PID:732

/sbin/ip6tables
ip6tables -Z ufw6-before-output
4⤵
PID:733

/sbin/ip6tables
ip6tables -Z ufw6-before-logging-output
4⤵
PID:734

/sbin/ip6tables
ip6tables -X ufw6-logging-deny
4⤵
PID:735

/sbin/ip6tables
ip6tables -X ufw6-logging-allow
4⤵
PID:736

/sbin/ip6tables
ip6tables -X ufw6-not-local
4⤵
PID:737

/sbin/ip6tables
ip6tables -X ufw6-user-logging-input
4⤵
PID:738

/sbin/ip6tables
ip6tables -X ufw6-user-logging-output
4⤵
PID:739

/sbin/ip6tables
ip6tables -X ufw6-user-logging-forward
4⤵
PID:740

/sbin/ip6tables
ip6tables -X ufw6-user-limit-accept
4⤵
PID:741

/sbin/ip6tables
ip6tables -X ufw6-user-limit
4⤵
PID:742

/sbin/ip6tables
ip6tables -X ufw6-user-input
4⤵
PID:743

/sbin/ip6tables
ip6tables -X ufw6-user-forward
4⤵
PID:744

/sbin/ip6tables
ip6tables -X ufw6-user-output
4⤵
PID:745

/sbin/ip6tables
ip6tables -X ufw6-skip-to-policy-input
4⤵
PID:746

/sbin/ip6tables
ip6tables -X ufw6-skip-to-policy-output
4⤵
PID:747

/sbin/ip6tables
ip6tables -X ufw6-skip-to-policy-forward
4⤵
PID:748

/sbin/ip6tables
ip6tables -P INPUT ACCEPT
4⤵
PID:749

/sbin/ip6tables
ip6tables -P OUTPUT ACCEPT
4⤵
PID:750

/sbin/ip6tables
ip6tables -P FORWARD ACCEPT
4⤵
PID:751

/sbin/iptables
iptables -F
2⤵
PID:752

/usr/bin/sudo
sudo sysctl "kernel.nmi_watchdog=0"
2⤵
- Modifies hosts file
- Writes DNS configuration
PID:753

/sbin/sysctl
sysctl "kernel.nmi_watchdog=0"
3⤵
PID:754

/usr/sbin/userdel
userdel akay
2⤵
PID:755

/usr/sbin/userdel
userdel vfinder
2⤵
PID:756

/usr/bin/chattr
chattr -iae /root/.ssh/
2⤵
PID:757

/usr/bin/chattr
chattr -iae /root/.ssh/authorized_keys
2⤵
PID:758

/bin/rm
rm -rf "/tmp/addres*"
2⤵
- Writes file to tmp directory
PID:759

/bin/rm
rm -rf "/tmp/walle*"
2⤵
- Writes file to tmp directory
PID:760

/bin/rm
rm -rf /tmp/keys
2⤵
- Writes file to tmp directory
PID:761

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:762

/bin/grep
grep -i "[a]liyun"
2⤵
PID:763

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:764

/bin/grep
grep -i "[y]unjing"
2⤵
PID:765

/bin/grep
grep 185.71.65.238
2⤵
PID:767

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:768

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:769

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:770

/bin/grep
grep 140.82.52.87
2⤵
PID:772

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:773

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:774

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:775

/bin/grep
grep 207.38.87.6
2⤵
PID:777

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:778

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:779

/bin/grep
grep -v -
2⤵
PID:780

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:781

/bin/grep
grep 34.81.218.76:9486
2⤵
PID:783

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:784

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:785

/bin/grep
grep -v -
2⤵
PID:786

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:787

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:790

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:791

/bin/grep
grep 42.112.28.216:9486
2⤵
PID:789

/bin/grep
grep -v -
2⤵
PID:792

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:793

/usr/bin/pkill
pkill -f .git/kthreaddw
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:794

/bin/grep
grep agetty
2⤵
PID:796

/bin/ps
ps aux
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:795

/bin/grep
grep -v grep
2⤵
PID:797

/usr/bin/awk
awk "{if(\$3>80.0) print \$2}"
2⤵
PID:798

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:799

/usr/bin/pkill
pkill -f 42.112.28.216
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:800

/bin/grep
grep 127.0.0.1:52018
2⤵
PID:802

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:803

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:804

/bin/grep
grep -v -
2⤵
PID:805

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:806

/bin/grep
grep :143
2⤵
PID:808

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:809

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:810

/bin/grep
grep -v -
2⤵
PID:811

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:812

/bin/grep
grep :2222
2⤵
PID:814

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:815

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:816

/bin/grep
grep -v -
2⤵
PID:817

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:818

/bin/grep
grep :3333
2⤵
PID:820

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:821

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:822

/bin/grep
grep -v -
2⤵
PID:823

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:824

/bin/grep
grep :3389
2⤵
PID:826

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:827

/usr/bin/awk
awk "-F[/]" "{print \$1}"
2⤵
PID:828

/usr/bin/xargs
xargs -I "%" kill -9 "%"
2⤵
PID:830

/bin/grep
grep -v -
2⤵
PID:829

/bin/grep
grep :4444
2⤵
PID:832

/usr/bin/awk
awk "{print \$7}"
2⤵
PID:833

/sbin/modprobe
/sbin/modprobe ip6_tables
1⤵
- Enumerates kernel/hardware configuration
PID:584

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Hijack Execution Flow

1

T1574

Privilege Escalation

Scheduled Task

1

T1053

Hijack Execution Flow

1

T1574

Defense Evasion

Indicator Removal on Host

1

T1070

Hijack Execution Flow

1

T1574

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

1

T1568

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads