488446f7510d2914a58c62dc96263b40d42573718cfe07979c672e6a6517c620

Analysis

max time kernel
18791s
max time network
155s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
submitted
14-07-2022 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

488446f7510d2914a58c62dc96263b40d42573718cfe07979c672e6a6517c620
Size

116KB
MD5

aa1dac371acb96fa7a8d68d3fa11946a
SHA1

a6acdbd8f17107c840f1fcdc5e5674558d2db2a7
SHA256

488446f7510d2914a58c62dc96263b40d42573718cfe07979c672e6a6517c620
SHA512

9fe78220c7eb15983553329963fc061be3cd03cf0d8db18d494f29fc27d18eb827e6b2c7d220ca9d8b74dfee4506c83f14e9f9618af61b00563af45f08228c95

Score

6^/10

Malware Config

Signatures

Reads CPU attributes 1 TTPs 64 IoCs

System Information Discovery

T1082

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/625/cmdline	/proc/625/cmdline	pkill
/proc/154/cmdline	/proc/154/cmdline	pkill
/proc/21/status	/proc/21/status	pkill
/proc/4/status	/proc/4/status	pkill
/proc/115/status	/proc/115/status	pkill
/proc/82/cmdline	/proc/82/cmdline	pkill
/proc/25/status	/proc/25/status	pkill
/proc/458/cmdline	/proc/458/cmdline	pkill
/proc/89/cmdline	/proc/89/cmdline	pkill
/proc/223/status	/proc/223/status	pkill
/proc/84/cmdline	/proc/84/cmdline	pkill
/proc/732/cmdline	/proc/732/cmdline	pkill
/proc/5/status	/proc/5/status	pkill
/proc/83/status	/proc/83/status	pkill
/proc/332/cmdline	/proc/332/cmdline	pkill
/proc/98/status	/proc/98/status	pkill
/proc/89/status	/proc/89/status	pkill
/proc/332/status	/proc/332/status	pkill
/proc/26/cmdline	/proc/26/cmdline	pkill
/proc/580/cmdline	/proc/580/cmdline	pkill
/proc/356/cmdline	/proc/356/cmdline	pkill
/proc/3/cmdline	/proc/3/cmdline	pkill
/proc/16/cmdline	/proc/16/cmdline	pkill
/proc/458/status	/proc/458/status	pkill
/proc/447/cmdline	/proc/447/cmdline	pkill
/proc/25/cmdline	/proc/25/cmdline	pkill
/proc/165/status	/proc/165/status	pkill
/proc/159/cmdline	/proc/159/cmdline	pkill
/proc/20/status	/proc/20/status	pkill
/proc/156/status	/proc/156/status	pkill
/proc/154/cmdline	/proc/154/cmdline	pkill
/proc/251/status	/proc/251/status	pkill
/proc/18/status	/proc/18/status	pkill
/proc/13/status	/proc/13/status	pkill
/proc/6/status	/proc/6/status	pkill
/proc/163/cmdline	/proc/163/cmdline	pkill
/proc/347/status	/proc/347/status	pkill
/proc/12/cmdline	/proc/12/cmdline	pkill
/proc/420/cmdline	/proc/420/cmdline	pkill
/proc/80/cmdline	/proc/80/cmdline	pkill
/proc/27/status	/proc/27/status	pkill
/proc/27/status	/proc/27/status	pkill
/proc/16/cmdline	/proc/16/cmdline	pkill
/proc/352/status	/proc/352/status	pkill
/proc/162/cmdline	/proc/162/cmdline	pkill
/proc/153/cmdline	/proc/153/cmdline	pkill
/proc/14/status	/proc/14/status	pkill
/proc/19/cmdline	/proc/19/cmdline	pkill
/proc/25/cmdline	/proc/25/cmdline	pkill
/proc/1/cmdline	/proc/1/cmdline	pkill
/proc/15/status	/proc/15/status	pkill
/proc/356/status	/proc/356/status	pkill
/proc/339/cmdline	/proc/339/cmdline	pkill
/proc/332/cmdline	/proc/332/cmdline	pkill
/proc/26/cmdline	/proc/26/cmdline	pkill
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	pkill
/proc/7/cmdline	/proc/7/cmdline	pkill
/proc/25/status	/proc/25/status	pkill
/proc/81/cmdline	/proc/81/cmdline	pkill
/proc/30/cmdline	/proc/30/cmdline	pkill
/proc/418/status	/proc/418/status	pkill
/proc/29/cmdline	/proc/29/cmdline	pkill
/proc/164/cmdline	/proc/164/cmdline	pkill
/proc/363/status	/proc/363/status	pkill

./488446f7510d2914a58c62dc96263b40d42573718cfe07979c672e6a6517c620
./488446f7510d2914a58c62dc96263b40d42573718cfe07979c672e6a6517c620
1⤵
PID:577

/bin/sh
sh -c "pkill -9 902i13 || busybox pkill -9 902i13"
1⤵
PID:581
- /usr/bin/pkill
  pkill -9 902i13
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:582
- /bin/busybox
  busybox pkill -9 902i13
  2⤵
  PID:583

/bin/sh
sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"
1⤵
PID:588
- /usr/bin/pkill
  pkill -9 BzSxLxBxeY
  2⤵
  - Reads runtime system information
  PID:589
- /bin/busybox
  busybox pkill -9 BzSxLxBxeY
  2⤵
  PID:590

/bin/sh
sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"
1⤵
PID:591
- /usr/bin/pkill
  pkill -9 HOHO-LUGO7
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:592
- /bin/busybox
  busybox pkill -9 HOHO-LUGO7
  2⤵
  PID:593

/bin/sh
sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"
1⤵
PID:594
- /usr/bin/pkill
  pkill -9 HOHO-U79OL
  2⤵
  - Reads CPU attributes
  PID:595
- /bin/busybox
  busybox pkill -9 HOHO-U79OL
  2⤵
  PID:596

/bin/sh
sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"
1⤵
PID:597
- /usr/bin/pkill
  pkill -9 JuYfouyf87
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:598
- /bin/busybox
  busybox pkill -9 JuYfouyf87
  2⤵
  PID:599

/bin/sh
sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
1⤵
PID:600
- /usr/bin/pkill
  pkill -9 NiGGeR69xd
  2⤵
  - Reads CPU attributes
  PID:601
- /bin/busybox
  busybox pkill -9 NiGGeR69xd
  2⤵
  PID:602

/bin/sh
sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
1⤵
PID:603
- /usr/bin/pkill
  pkill -9 SO190Ij1X
  2⤵
  PID:604
- /bin/busybox
  busybox pkill -9 SO190Ij1X
  2⤵
  PID:605

/bin/sh
sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"
1⤵
PID:606
- /usr/bin/pkill
  pkill -9 LOLKIKEEEDDE
  2⤵
  - Reads CPU attributes
  PID:607
- /bin/busybox
  busybox pkill -9 LOLKIKEEEDDE
  2⤵
  PID:608

/bin/sh
sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"
1⤵
PID:609
- /usr/bin/pkill
  pkill -9 ekjheory98e
  2⤵
  PID:610
- /bin/busybox
  busybox pkill -9 ekjheory98e
  2⤵
  PID:611

/bin/sh
sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"
1⤵
PID:612
- /usr/bin/pkill
  pkill -9 scansh4
  2⤵
  - Reads runtime system information
  PID:613
- /bin/busybox
  busybox pkill -9 scansh4
  2⤵
  PID:614

/bin/sh
sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"
1⤵
PID:615
- /usr/bin/pkill
  pkill -9 MDMA
  2⤵
  PID:616
- /bin/busybox
  busybox pkill -9 MDMA
  2⤵
  PID:617

/bin/sh
sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"
1⤵
PID:618
- /usr/bin/pkill
  pkill -9 fdevalvex
  2⤵
  - Reads runtime system information
  PID:619
- /bin/busybox
  busybox pkill -9 fdevalvex
  2⤵
  PID:620

/bin/sh
sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"
1⤵
PID:621
- /usr/bin/pkill
  pkill -9 scanspc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:622
- /bin/busybox
  busybox pkill -9 scanspc
  2⤵
  PID:623

/bin/sh
sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"
1⤵
PID:624
- /usr/bin/pkill
  pkill -9 MELTEDNINJAREALZ
  2⤵
  - Reads runtime system information
  PID:625
- /bin/busybox
  busybox pkill -9 MELTEDNINJAREALZ
  2⤵
  PID:626

/bin/sh
sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"
1⤵
PID:627
- /usr/bin/pkill
  pkill -9 flexsonskids
  2⤵
  - Reads CPU attributes
  PID:628
- /bin/busybox
  busybox pkill -9 flexsonskids
  2⤵
  PID:629

/bin/sh
sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"
1⤵
PID:630
- /usr/bin/pkill
  pkill -9 scanx86
  2⤵
  - Reads CPU attributes
  PID:631
- /bin/busybox
  busybox pkill -9 scanx86
  2⤵
  PID:632

/bin/sh
sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"
1⤵
PID:633
- /usr/bin/pkill
  pkill -9 MISAKI-U79OL
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:634
- /bin/busybox
  busybox pkill -9 MISAKI-U79OL
  2⤵
  PID:635

/bin/sh
sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"
1⤵
PID:636
- /usr/bin/pkill
  pkill -9 foAxi102kxe
  2⤵
  - Reads CPU attributes
  PID:637
- /bin/busybox
  busybox pkill -9 foAxi102kxe
  2⤵
  PID:638

/bin/sh
sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"
1⤵
PID:639
- /usr/bin/pkill
  pkill -9 swodjwodjwoj
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:640
- /bin/busybox
  busybox pkill -9 swodjwodjwoj
  2⤵
  PID:641

/bin/sh
sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"
1⤵
PID:642
- /usr/bin/pkill
  pkill -9 MmKiy7f87l
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:643
- /bin/busybox
  busybox pkill -9 MmKiy7f87l
  2⤵
  PID:644

/bin/sh
sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"
1⤵
PID:645
- /usr/bin/pkill
  pkill -9 freecookiex86
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:646
- /bin/busybox
  busybox pkill -9 freecookiex86
  2⤵
  PID:647

/bin/sh
sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"
1⤵
PID:648
- /usr/bin/pkill
  pkill -9 sysgpu
  2⤵
  PID:649
- /bin/busybox
  busybox pkill -9 sysgpu
  2⤵
  PID:650

/bin/sh
sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
1⤵
PID:651
- /usr/bin/pkill
  pkill -9 NiGGeR69xd
  2⤵
  - Reads CPU attributes
  PID:652
- /bin/busybox
  busybox pkill -9 NiGGeR69xd
  2⤵
  PID:653

/bin/sh
sh -c "pkill -9 frgege || busybox pkill -9 frgege"
1⤵
PID:654
- /usr/bin/pkill
  pkill -9 frgege
  2⤵
  - Reads CPU attributes
  PID:655
- /bin/busybox
  busybox pkill -9 frgege
  2⤵
  PID:656

/bin/sh
sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"
1⤵
PID:657
- /usr/bin/pkill
  pkill -9 sysupdater
  2⤵
  PID:658
- /bin/busybox
  busybox pkill -9 sysupdater
  2⤵
  PID:659

/bin/sh
sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"
1⤵
PID:660
- /usr/bin/pkill
  pkill -9 0DnAzepd
  2⤵
  - Reads CPU attributes
  PID:661
- /bin/busybox
  busybox pkill -9 0DnAzepd
  2⤵
  PID:662

/bin/sh
sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"
1⤵
PID:663
- /usr/bin/pkill
  pkill -9 NiGGeRD0nks69
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:664
- /bin/busybox
  busybox pkill -9 NiGGeRD0nks69
  2⤵
  PID:665

/bin/sh
sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"
1⤵
PID:666
- /usr/bin/pkill
  pkill -9 frgreu
  2⤵
  - Reads CPU attributes
  PID:667
- /bin/busybox
  busybox pkill -9 frgreu
  2⤵
  PID:668

/bin/sh
sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"
1⤵
PID:669
- /usr/bin/pkill
  pkill -9 telnetd
  2⤵
  - Reads runtime system information
  PID:670
- /bin/busybox
  busybox pkill -9 telnetd
  2⤵
  PID:671

/bin/sh
sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"
1⤵
PID:672
- /usr/bin/pkill
  pkill -9 0x766f6964
  2⤵
  - Reads CPU attributes
  PID:673
- /bin/busybox
  busybox pkill -9 0x766f6964
  2⤵
  PID:674

/bin/sh
sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"
1⤵
PID:675
- /usr/bin/pkill
  pkill -9 NiGGeRd0nks1337
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:676
- /bin/busybox
  busybox pkill -9 NiGGeRd0nks1337
  2⤵
  PID:677

/bin/sh
sh -c "pkill -9 gaft || busybox pkill -9 gaft"
1⤵
PID:678
- /usr/bin/pkill
  pkill -9 gaft
  2⤵
  PID:679
- /bin/busybox
  busybox pkill -9 gaft
  2⤵
  PID:680

/bin/sh
sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"
1⤵
PID:681
- /usr/bin/pkill
  pkill -9 urasgbsigboa
  2⤵
  - Reads runtime system information
  PID:682
- /bin/busybox
  busybox pkill -9 urasgbsigboa
  2⤵
  PID:683

/bin/sh
sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"
1⤵
PID:684
- /usr/bin/pkill
  pkill -9 120i3UI49
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:685
- /bin/busybox
  busybox pkill -9 120i3UI49
  2⤵
  PID:686

/bin/sh
sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"
1⤵
PID:687
- /usr/bin/pkill
  pkill -9 OaF3
  2⤵
  - Reads CPU attributes
  PID:688
- /bin/busybox
  busybox pkill -9 OaF3
  2⤵
  PID:689

/bin/sh
sh -c "pkill -9 geae || busybox pkill -9 geae"
1⤵
PID:690
- /usr/bin/pkill
  pkill -9 geae
  2⤵
  PID:691
- /bin/busybox
  busybox pkill -9 geae
  2⤵
  PID:692

/bin/sh
sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"
1⤵
PID:693
- /usr/bin/pkill
  pkill -9 vaiolmao
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:694
- /bin/busybox
  busybox pkill -9 vaiolmao
  2⤵
  PID:695

/bin/sh
sh -c "pkill -9 123123a || busybox pkill -9 123123a"
1⤵
PID:696
- /usr/bin/pkill
  pkill -9 123123a
  2⤵
  - Reads CPU attributes
  PID:697
- /bin/busybox
  busybox pkill -9 123123a
  2⤵
  PID:698

/bin/sh
sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"
1⤵
PID:699
- /usr/bin/pkill
  pkill -9 Ofurain0n4H34D
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:700
- /bin/busybox
  busybox pkill -9 Ofurain0n4H34D
  2⤵
  PID:701

/bin/sh
sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"
1⤵
PID:702
- /usr/bin/pkill
  pkill -9 ggTrex
  2⤵
  PID:703
- /bin/busybox
  busybox pkill -9 ggTrex
  2⤵
  PID:704

/bin/sh
sh -c "pkill -9 wasads || busybox pkill -9 wasads"
1⤵
PID:705
- /usr/bin/pkill
  pkill -9 wasads
  2⤵
  - Reads CPU attributes
  PID:706
- /bin/busybox
  busybox pkill -9 wasads
  2⤵
  PID:707

/bin/sh
sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"
1⤵
PID:708
- /usr/bin/pkill
  pkill -9 1293194hjXD
  2⤵
  - Reads runtime system information
  PID:709
- /bin/busybox
  busybox pkill -9 1293194hjXD
  2⤵
  PID:710

/bin/sh
sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"
1⤵
PID:711
- /usr/bin/pkill
  pkill -9 OthLaLosn
  2⤵
  PID:712
- /bin/busybox
  busybox pkill -9 OthLaLosn
  2⤵
  PID:713

/bin/sh
sh -c "pkill -9 ggt || busybox pkill -9 ggt"
1⤵
PID:714
- /usr/bin/pkill
  pkill -9 ggt
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:715
- /bin/busybox
  busybox pkill -9 ggt
  2⤵
  PID:716

/bin/sh
sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"
1⤵
PID:717
- /usr/bin/pkill
  pkill -9 wget-log
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:718
- /bin/busybox
  busybox pkill -9 wget-log
  2⤵
  PID:719

/bin/sh
sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"
1⤵
PID:720
- /usr/bin/pkill
  pkill -9 1337SoraLOADER
  2⤵
  PID:721
- /bin/busybox
  busybox pkill -9 1337SoraLOADER
  2⤵
  PID:722

/bin/sh
sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"
1⤵
PID:723
- /usr/bin/pkill
  pkill -9 SAIAKINA
  2⤵
  - Reads runtime system information
  PID:724
- /bin/busybox
  busybox pkill -9 SAIAKINA
  2⤵
  PID:725

/bin/sh
sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"
1⤵
PID:726
- /usr/bin/pkill
  pkill -9 ggtq
  2⤵
  PID:727
- /bin/busybox
  busybox pkill -9 ggtq
  2⤵
  PID:728

/bin/sh
sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"
1⤵
PID:729
- /usr/bin/pkill
  pkill -9 1378bfp919GRB1Q2
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:730
- /bin/busybox
  busybox pkill -9 1378bfp919GRB1Q2
  2⤵
  PID:731

/bin/sh
sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"
1⤵
PID:732
- /usr/bin/pkill
  pkill -9 SAIAKUSO
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:733
- /bin/busybox
  busybox pkill -9 SAIAKUSO
  2⤵
  PID:734

/bin/sh
sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"
1⤵
PID:735
- /usr/bin/pkill
  pkill -9 ggtr
  2⤵
  - Reads runtime system information
  PID:736
- /bin/busybox
  busybox pkill -9 ggtr
  2⤵
  PID:737

/bin/sh
sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"
1⤵
PID:738
- /usr/bin/pkill
  pkill -9 14Fa
  2⤵
  - Reads CPU attributes
  PID:739
- /bin/busybox
  busybox pkill -9 14Fa
  2⤵
  PID:740

/bin/sh
sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"
1⤵
PID:741
- /usr/bin/pkill
  pkill -9 SEXSLAVE1337
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:742
- /bin/busybox
  busybox pkill -9 SEXSLAVE1337
  2⤵
  PID:743

/bin/sh
sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"
1⤵
PID:744
- /usr/bin/pkill
  pkill -9 ggtt
  2⤵
  PID:745
- /bin/busybox
  busybox pkill -9 ggtt
  2⤵
  PID:746

/bin/sh
sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"
1⤵
PID:747
- /usr/bin/pkill
  pkill -9 1902a3u912u3u4
  2⤵
  PID:748
- /bin/busybox
  busybox pkill -9 1902a3u912u3u4
  2⤵
  PID:749

/bin/sh
sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
1⤵
PID:750
- /usr/bin/pkill
  pkill -9 SO190Ij1X
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:751
- /bin/busybox
  busybox pkill -9 SO190Ij1X
  2⤵
  PID:752

/bin/sh
sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"
1⤵
PID:753
- /usr/bin/pkill
  pkill -9 haetrghbr
  2⤵
  - Reads CPU attributes
  PID:754
- /bin/busybox
  busybox pkill -9 haetrghbr
  2⤵
  PID:755

/bin/sh
sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"
1⤵
PID:756
- /usr/bin/pkill
  pkill -9 19ju3d
  2⤵
  PID:757
- /bin/busybox
  busybox pkill -9 19ju3d
  2⤵
  PID:758

/bin/sh
sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"
1⤵
PID:759
- /usr/bin/pkill
  pkill -9 SORAojkf120
  2⤵
  - Reads CPU attributes
  PID:760
- /bin/busybox
  busybox pkill -9 SORAojkf120
  2⤵
  PID:761

/bin/sh
sh -c "pkill -9 hehahejeje92 || busybox pkill -9 hehahejeje92"
1⤵
PID:762
- /usr/bin/pkill
  pkill -9 hehahejeje92
  2⤵
  PID:763
- /bin/busybox
  busybox pkill -9 hehahejeje92
  2⤵
  PID:764

/bin/sh
sh -c "pkill -9 2U2JDJA901F91 || busybox pkill -9 2U2JDJA901F91"
1⤵
PID:765
- /usr/bin/pkill
  pkill -9 2U2JDJA901F91
  2⤵
  PID:766
- /bin/busybox
  busybox pkill -9 2U2JDJA901F91
  2⤵
  PID:767

/bin/sh
sh -c "pkill -9 SlaVLav12 || busybox pkill -9 SlaVLav12"
1⤵
PID:768
- /usr/bin/pkill
  pkill -9 SlaVLav12
  2⤵
  - Reads CPU attributes
  PID:769
- /bin/busybox
  busybox pkill -9 SlaVLav12
  2⤵
  PID:770

/bin/sh
sh -c "pkill -9 helpmedaddthhhhh || busybox pkill -9 helpmedaddthhhhh"
1⤵
PID:771
- /usr/bin/pkill
  pkill -9 helpmedaddthhhhh
  2⤵
  - Reads runtime system information
  PID:772
- /bin/busybox
  busybox pkill -9 helpmedaddthhhhh
  2⤵
  PID:773

/bin/sh
sh -c "pkill -9 2wgg9qphbq || busybox pkill -9 2wgg9qphbq"
1⤵
PID:816
- /usr/bin/pkill
  pkill -9 2wgg9qphbq
  2⤵
  - Reads runtime system information
  PID:817
- /bin/busybox
  busybox pkill -9 2wgg9qphbq
  2⤵
  PID:818

/bin/sh
sh -c "pkill -9 Slav3Th3seD3vices || busybox pkill -9 Slav3Th3seD3vices"
1⤵
PID:863
- /usr/bin/pkill
  pkill -9 Slav3Th3seD3vices
  2⤵
  - Reads runtime system information
  PID:864
- /bin/busybox
  busybox pkill -9 Slav3Th3seD3vices
  2⤵
  PID:865

/bin/sh
sh -c "pkill -9 hzSmYZjYMQ || busybox pkill -9 hzSmYZjYMQ"
1⤵
PID:895
- /usr/bin/pkill
  pkill -9 hzSmYZjYMQ
  2⤵
  - Reads runtime system information
  PID:896
- /bin/busybox
  busybox pkill -9 hzSmYZjYMQ
  2⤵
  PID:897

/bin/sh
sh -c "pkill -9 5Gbf || busybox pkill -9 5Gbf"
1⤵
PID:898
- /usr/bin/pkill
  pkill -9 5Gbf
  2⤵
  PID:899
- /bin/busybox
  busybox pkill -9 5Gbf
  2⤵
  PID:900

/bin/sh
sh -c "pkill -9 SoRAxD123LOL || busybox pkill -9 SoRAxD123LOL"
1⤵
PID:901
- /usr/bin/pkill
  pkill -9 SoRAxD123LOL
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:902
- /bin/busybox
  busybox pkill -9 SoRAxD123LOL
  2⤵
  PID:903

/bin/sh
sh -c "pkill -9 iaGv || busybox pkill -9 iaGv"
1⤵
PID:904
- /usr/bin/pkill
  pkill -9 iaGv
  2⤵
  - Reads CPU attributes
  PID:905
- /bin/busybox
  busybox pkill -9 iaGv
  2⤵
  PID:906

/bin/sh
sh -c "pkill -9 5aA3 || busybox pkill -9 5aA3"
1⤵
PID:907
- /usr/bin/pkill
  pkill -9 5aA3
  2⤵
  - Reads CPU attributes
  PID:908
- /bin/busybox
  busybox pkill -9 5aA3
  2⤵
  PID:909

/bin/sh
sh -c "pkill -9 SoRAxD420LOL || busybox pkill -9 SoRAxD420LOL"
1⤵
PID:910
- /usr/bin/pkill
  pkill -9 SoRAxD420LOL
  2⤵
  PID:911
- /bin/busybox
  busybox pkill -9 SoRAxD420LOL
  2⤵
  PID:912

/bin/sh
sh -c "pkill -9 insomni || busybox pkill -9 insomni"
1⤵
PID:913
- /usr/bin/pkill
  pkill -9 insomni
  2⤵
  PID:914
- /bin/busybox
  busybox pkill -9 insomni
  2⤵
  PID:915

/bin/sh
sh -c "pkill -9 640277 || busybox pkill -9 640277"
1⤵
PID:916
- /usr/bin/pkill
  pkill -9 640277
  2⤵
  - Reads CPU attributes
  PID:917
- /bin/busybox
  busybox pkill -9 640277
  2⤵
  PID:918

/bin/sh
sh -c "pkill -9 SoraBeReppin1337 || busybox pkill -9 SoraBeReppin1337"
1⤵
PID:919
- /usr/bin/pkill
  pkill -9 SoraBeReppin1337
  2⤵
  - Reads CPU attributes
  PID:920
- /bin/busybox
  busybox pkill -9 SoraBeReppin1337
  2⤵
  PID:921

/bin/sh
sh -c "pkill -9 ipcamCache || busybox pkill -9 ipcamCache"
1⤵
PID:922
- /usr/bin/pkill
  pkill -9 ipcamCache
  2⤵
  - Reads CPU attributes
  PID:923
- /bin/busybox
  busybox pkill -9 ipcamCache
  2⤵
  PID:924

/bin/sh
sh -c "pkill -9 66tlGg9Q || busybox pkill -9 66tlGg9Q"
1⤵
PID:925
- /usr/bin/pkill
  pkill -9 66tlGg9Q
  2⤵
  - Reads runtime system information
  PID:926
- /bin/busybox
  busybox pkill -9 66tlGg9Q
  2⤵
  PID:927

/bin/sh
sh -c "pkill -9 T || busybox pkill -9 T"
1⤵
PID:928
- /usr/bin/pkill
  pkill -9 T
  2⤵
  PID:929
- /bin/busybox
  busybox pkill -9 T
  2⤵
  PID:930

/bin/sh
sh -c "pkill -9 jUYfouyf87 || busybox pkill -9 jUYfouyf87"
1⤵
PID:931
- /usr/bin/pkill
  pkill -9 jUYfouyf87
  2⤵
  PID:932
- /bin/busybox
  busybox pkill -9 jUYfouyf87
  2⤵
  PID:933

/bin/sh
sh -c "pkill -9 6ke3 || busybox pkill -9 6ke3"
1⤵
PID:934
- /usr/bin/pkill
  pkill -9 6ke3
  2⤵
  - Reads CPU attributes
  PID:935
- /bin/busybox
  busybox pkill -9 6ke3
  2⤵
  PID:936

/bin/sh
sh -c "pkill -9 TOKYO3 || busybox pkill -9 TOKYO3"
1⤵
PID:937
- /usr/bin/pkill
  pkill -9 TOKYO3
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:938
- /bin/busybox
  busybox pkill -9 TOKYO3
  2⤵
  PID:939

/bin/sh
sh -c "pkill -9 lyEeaXul2dULCVxh || busybox pkill -9 lyEeaXul2dULCVxh"
1⤵
PID:940
- /usr/bin/pkill
  pkill -9 lyEeaXul2dULCVxh
  2⤵
  - Reads CPU attributes
  PID:941
- /bin/busybox
  busybox pkill -9 lyEeaXul2dULCVxh
  2⤵
  PID:942

/bin/sh
sh -c "pkill -9 93OfjHZ2z || busybox pkill -9 93OfjHZ2z"
1⤵
PID:943
- /usr/bin/pkill
  pkill -9 93OfjHZ2z
  2⤵
  - Reads runtime system information
  PID:944
- /bin/busybox
  busybox pkill -9 93OfjHZ2z
  2⤵
  PID:945

/bin/sh
sh -c "pkill -9 TY2gD6MZvKc7KU6r || busybox pkill -9 TY2gD6MZvKc7KU6r"
1⤵
PID:946
- /usr/bin/pkill
  pkill -9 TY2gD6MZvKc7KU6r
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:947
- /bin/busybox
  busybox pkill -9 TY2gD6MZvKc7KU6r
  2⤵
  PID:948

/bin/sh
sh -c "pkill -9 mMkiy6f87l || busybox pkill -9 mMkiy6f87l"
1⤵
PID:949
- /usr/bin/pkill
  pkill -9 mMkiy6f87l
  2⤵
  PID:950
- /bin/busybox
  busybox pkill -9 mMkiy6f87l
  2⤵
  PID:951

/bin/sh
sh -c "pkill -9 A023UU4U24UIU || busybox pkill -9 A023UU4U24UIU"
1⤵
PID:952
- /usr/bin/pkill
  pkill -9 A023UU4U24UIU
  2⤵
  - Reads runtime system information
  PID:953
- /bin/busybox
  busybox pkill -9 A023UU4U24UIU
  2⤵
  PID:954

/bin/sh
sh -c "pkill -9 TheWeeknd || busybox pkill -9 TheWeeknd"
1⤵
PID:955
- /usr/bin/pkill
  pkill -9 TheWeeknd
  2⤵
  - Reads CPU attributes
  PID:956
- /bin/busybox
  busybox pkill -9 TheWeeknd
  2⤵
  PID:957

/bin/sh
sh -c "pkill -9 mioribitches || busybox pkill -9 mioribitches"
1⤵
PID:958
- /usr/bin/pkill
  pkill -9 mioribitches
  2⤵
  PID:959
- /bin/busybox
  busybox pkill -9 mioribitches
  2⤵
  PID:960

/bin/sh
sh -c "pkill -9 A5p9 || busybox pkill -9 A5p9"
1⤵
PID:961
- /usr/bin/pkill
  pkill -9 A5p9
  2⤵
  - Reads CPU attributes
  PID:962
- /bin/busybox
  busybox pkill -9 A5p9
  2⤵
  PID:963

/bin/sh
sh -c "pkill -9 TheWeeknds || busybox pkill -9 TheWeeknds"
1⤵
PID:964
- /usr/bin/pkill
  pkill -9 TheWeeknds
  2⤵
  - Reads CPU attributes
  PID:965
- /bin/busybox
  busybox pkill -9 TheWeeknds
  2⤵
  PID:966

/bin/sh
sh -c "pkill -9 mnblkjpoi || busybox pkill -9 mnblkjpoi"
1⤵
PID:967
- /usr/bin/pkill
  pkill -9 mnblkjpoi
  2⤵
  - Reads CPU attributes
  PID:968
- /bin/busybox
  busybox pkill -9 mnblkjpoi
  2⤵
  PID:969

/bin/sh
sh -c "pkill -9 AbAd || busybox pkill -9 AbAd"
1⤵
PID:970
- /usr/bin/pkill
  pkill -9 AbAd
  2⤵
  PID:971
- /bin/busybox
  busybox pkill -9 AbAd
  2⤵
  PID:972

/bin/sh
sh -c "pkill -9 Tokyos || busybox pkill -9 Tokyos"
1⤵
PID:973
- /usr/bin/pkill
  pkill -9 Tokyos
  2⤵
  - Reads CPU attributes
  PID:974
- /bin/busybox
  busybox pkill -9 Tokyos
  2⤵
  PID:975

/bin/sh
sh -c "pkill -9 neb || busybox pkill -9 neb"
1⤵
PID:976
- /usr/bin/pkill
  pkill -9 neb
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:977
- /bin/busybox
  busybox pkill -9 neb
  2⤵
  PID:978

/bin/sh
sh -c "pkill -9 Akiru || busybox pkill -9 Akiru"
1⤵
PID:979
- /usr/bin/pkill
  pkill -9 Akiru
  2⤵
  - Reads runtime system information
  PID:980
- /bin/busybox
  busybox pkill -9 Akiru
  2⤵
  PID:981

/bin/sh
sh -c "pkill -9 U8inTz || busybox pkill -9 U8inTz"
1⤵
PID:982
- /usr/bin/pkill
  pkill -9 U8inTz
  2⤵
  - Reads CPU attributes
  PID:983
- /bin/busybox
  busybox pkill -9 U8inTz
  2⤵
  PID:984

/bin/sh
sh -c "pkill -9 netstats || busybox pkill -9 netstats"
1⤵
PID:985
- /usr/bin/pkill
  pkill -9 netstats
  2⤵
  - Reads CPU attributes
  PID:986
- /bin/busybox
  busybox pkill -9 netstats
  2⤵
  PID:987

/bin/sh
sh -c "pkill -9 Alex || busybox pkill -9 Alex"
1⤵
PID:988
- /usr/bin/pkill
  pkill -9 Alex
  2⤵
  - Reads CPU attributes
  PID:989
- /bin/busybox
  busybox pkill -9 Alex
  2⤵
  PID:990

/bin/sh
sh -c "pkill -9 W9RCAKM20T || busybox pkill -9 W9RCAKM20T"
1⤵
PID:991
- /usr/bin/pkill
  pkill -9 W9RCAKM20T
  2⤵
  - Reads CPU attributes
  PID:992
- /bin/busybox
  busybox pkill -9 W9RCAKM20T
  2⤵
  PID:993

/bin/sh
sh -c "pkill -9 newnetword || busybox pkill -9 newnetword"
1⤵
PID:994
- /usr/bin/pkill
  pkill -9 newnetword
  2⤵
  PID:995
- /bin/busybox
  busybox pkill -9 newnetword
  2⤵
  PID:996

/bin/sh
sh -c "pkill -9 Ayo215 || busybox pkill -9 Ayo215"
1⤵
PID:997
- /usr/bin/pkill
  pkill -9 Ayo215
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:998
- /bin/busybox
  busybox pkill -9 Ayo215
  2⤵
  PID:999

/bin/sh
sh -c "pkill -9 Word || busybox pkill -9 Word"
1⤵
PID:1000
- /usr/bin/pkill
  pkill -9 Word
  2⤵
  - Reads CPU attributes
  PID:1001
- /bin/busybox
  busybox pkill -9 Word
  2⤵
  PID:1002

/bin/sh
sh -c "pkill -9 nloads || busybox pkill -9 nloads"
1⤵
PID:1003
- /usr/bin/pkill
  pkill -9 nloads
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1004
- /bin/busybox
  busybox pkill -9 nloads
  2⤵
  PID:1005

/bin/sh
sh -c "pkill -9 BAdAsV || busybox pkill -9 BAdAsV"
1⤵
PID:1006
- /usr/bin/pkill
  pkill -9 BAdAsV
  2⤵
  PID:1007
- /bin/busybox
  busybox pkill -9 BAdAsV
  2⤵
  PID:1008

/bin/sh
sh -c "pkill -9 Wordmane || busybox pkill -9 Wordmane"
1⤵
PID:1009
- /usr/bin/pkill
  pkill -9 Wordmane
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1010
- /bin/busybox
  busybox pkill -9 Wordmane
  2⤵
  PID:1011

/bin/sh
sh -c "pkill -9 notyakuzaa || busybox pkill -9 notyakuzaa"
1⤵
PID:1012
- /usr/bin/pkill
  pkill -9 notyakuzaa
  2⤵
  - Reads CPU attributes
  PID:1013
- /bin/busybox
  busybox pkill -9 notyakuzaa
  2⤵
  PID:1014

/bin/sh
sh -c "pkill -9 Belch || busybox pkill -9 Belch"
1⤵
PID:1015
- /usr/bin/pkill
  pkill -9 Belch
  2⤵
  PID:1016
- /bin/busybox
  busybox pkill -9 Belch
  2⤵
  PID:1017

/bin/sh
sh -c "pkill -9 Wordnets || busybox pkill -9 Wordnets"
1⤵
PID:1018
- /usr/bin/pkill
  pkill -9 Wordnets
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1019
- /bin/busybox
  busybox pkill -9 Wordnets
  2⤵
  PID:1020

/bin/sh
sh -c "pkill -9 obp || busybox pkill -9 obp"
1⤵
PID:1021
- /usr/bin/pkill
  pkill -9 obp
  2⤵
  - Reads CPU attributes
  PID:1022
- /bin/busybox
  busybox pkill -9 obp
  2⤵
  PID:1023

/bin/sh
sh -c "pkill -9 BigN0gg0r420 || busybox pkill -9 BigN0gg0r420"
1⤵
PID:1024
- /usr/bin/pkill
  pkill -9 BigN0gg0r420
  2⤵
  PID:1025

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

description	ioc	Process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads